Edit tour

Windows Analysis Report
https://download01.logi.com/web/ftp/pub/techsupport/optionsplus/logioptionsplus_installer.exe

Overview

General Information

Sample URL:	https://download01.logi.com/web/ftp/pub/techsupport/optionsplus/logioptionsplus_installer.exe
Analysis ID:	1416047
Infos:

Detection

Score:	35
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Signatures

Found detection on Joe Sandbox Cloud Basic

.NET source code references suspicious native API functions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

Modifies existing windows services

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries the volume information (name, serial number etc) of a device

Tries to load missing DLLs

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample searches for specific file, try point organization specific fake files to the analysis machine

Process Tree

System is w10x64native

chrome.exe (PID: 7176 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 464953824E644F10FFDC9E093FD18F94)

chrome.exe (PID: 6088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1996 /prefetch:8 MD5: 464953824E644F10FFDC9E093FD18F94)

chrome.exe (PID: 4300 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2972 /prefetch:8 MD5: 464953824E644F10FFDC9E093FD18F94)

chrome.exe (PID: 5760 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6164 /prefetch:8 MD5: 464953824E644F10FFDC9E093FD18F94)

chrome.exe (PID: 7244 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3352 /prefetch:8 MD5: 464953824E644F10FFDC9E093FD18F94)

chrome.exe (PID: 5580 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5480 /prefetch:8 MD5: 464953824E644F10FFDC9E093FD18F94)

chrome.exe (PID: 3048 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://download01.logi.com/web/ftp/pub/techsupport/optionsplus/logioptionsplus_installer.exe" MD5: 464953824E644F10FFDC9E093FD18F94)

logioptionsplus_installer.exe (PID: 3364 cmdline: "C:\Users\user\Downloads\logioptionsplus_installer.exe" MD5: 43D5805571B019C67F965C749AD18AA1)

logioptionsplus_setup.exe (PID: 1716 cmdline: --install-event=897bbe07-5e15-4275-a4f7-6d424b298ef0.optionsplus_install_finish_event MD5: AE8C1F75DCE5968EB9634E5A1E2C9E56)

vc_redist.x64.exe (PID: 6744 cmdline: "C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe" /install /quiet /norestart MD5: BE433764FA9BBE0F2F9C654F6512C9E0)

vc_redist.x64.exe (PID: 3740 cmdline: "C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe" -burn.filehandle.attached=532 -burn.filehandle.self=528 /install /quiet /norestart MD5: 94970FC3A8ED7B9DE44F4117419CE829)

VC_redist.x64.exe (PID: 8064 cmdline: "C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A922CA2A-29A1-4011-A158-7648632856CA} {2230389D-DB71-45B4-9086-D875DD617B8B} 3740 MD5: 94970FC3A8ED7B9DE44F4117419CE829)

msiexec.exe (PID: 2040 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_00539EB7 DecryptFileW,	13_2_00539EB7
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_0055F961 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	13_2_0055F961
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_00539C99 DecryptFileW,DecryptFileW,	13_2_00539C99
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F49EB7 DecryptFileW,	14_2_00F49EB7
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F6F961 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	14_2_00F6F961
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F49C99 DecryptFileW,DecryptFileW,	14_2_00F49C99
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A5F961 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	15_2_00A5F961
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A39C99 DecryptFileW,DecryptFileW,	15_2_00A39C99
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A39EB7 DecryptFileW,	15_2_00A39EB7

Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CC33000.00000002.00000001.01000000.00000006.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_f90ba2c7-2

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}

Jump to behavior

Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1028\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1029\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1031\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1036\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1040\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1041\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1042\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1045\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1046\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1049\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1055\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\2052\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\3082\license.rtf	Jump to behavior

Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: logioptionsplus_installer.exe, vc_redist.x64.exe, 0000000D.00000000.50335860026.000000000056B000.00000002.00000001.01000000.00000009.sdmp, vc_redist.x64.exe, 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmp, vc_redist.x64.exe, 0000000E.00000000.50337381117.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmp, vc_redist.x64.exe, 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmp, VC_redist.x64.exe, 0000000F.00000002.50382879992.0000000000A6B000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 0000000F.00000003.50349070384.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 0000000F.00000000.50344640784.0000000000A6B000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcamp140.amd64.pdb source: vcamp140.dll.19.dr
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: msvcp140.dll.19.dr
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcamp140.amd64.pdbGCTL source: vcamp140.dll.19.dr
Source:	Binary string: C:\builds\kiros\kiros\build\x64\logi\installer\Release\logi_installer_shared_optionsplus.pdb source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CC33000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F5914F3000.00000004.00000800.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB9B5000.00000002.00000001.01000000.00000012.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: d:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_00523BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	13_2_00523BC3
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_00564315 FindFirstFileW,FindClose,	13_2_00564315
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_0053993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	13_2_0053993E
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_00557A87 FindFirstFileExW,	13_2_00557A87
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F74315 FindFirstFileW,FindClose,	14_2_00F74315
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F4993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	14_2_00F4993E
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F33BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	14_2_00F33BC3
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F67A87 FindFirstFileExW,	14_2_00F67A87
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A64315 FindFirstFileW,FindClose,	15_2_00A64315
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A3993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	15_2_00A3993E
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A23BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	15_2_00A23BC3
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A57A87 FindFirstFileExW,	15_2_00A57A87

Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	File opened: C:\ProgramData\Package Cache\{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}v14.24.28127\NULL	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	File opened: C:\ProgramData\Package Cache\{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}v14.24.28127\packages\vcRuntimeMinimum_amd64	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	File opened: C:\ProgramData\Package Cache\{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}v14.24.28127\packages\vcRuntimeMinimum_amd64\NULL	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	File opened: C:\ProgramData\Package Cache\{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}v14.24.28127\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	File opened: C:\ProgramData\Package Cache\{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}v14.24.28127\packages	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	File opened: C:\ProgramData\Package Cache\{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}v14.24.28127\packages\NULL	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.234.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.234.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.51.132
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /web/ftp/pub/techsupport/optionsplus/logioptionsplus_installer.exe HTTP/1.1Host: download01.logi.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: download01.logi.com

Source: global traffic	TCP traffic: 192.168.11.20:52761 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:52761 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:52761 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:52761 -> 239.255.255.250:1900

Source: vc_redist.x64.exe, VC_redist.x64.exe	String found in binary or memory: http://appsyndication.org/2006/appsyn
Source: vc_redist.x64.exe, 0000000D.00000000.50335860026.000000000056B000.00000002.00000001.01000000.00000009.sdmp, vc_redist.x64.exe, 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmp, vc_redist.x64.exe, 0000000E.00000000.50337381117.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmp, vc_redist.x64.exe, 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmp, VC_redist.x64.exe, 0000000F.00000002.50382879992.0000000000A6B000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 0000000F.00000003.50349070384.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 0000000F.00000000.50344640784.0000000000A6B000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/logioptionsplus_setup;component/MainWindow.xaml
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/logioptionsplus_setup;component/Resources/DeviceImage1.png
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/logioptionsplus_setup;component/Resources/DeviceImage2.png
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/logioptionsplus_setup;component/Resources/DeviceImage3.png
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/logioptionsplus_setup;component/Resources/DeviceImage4.png
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/logioptionsplus_setup;component/Resources/DeviceImage5.png
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/logioptionsplus_setup;component/app.xaml
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/MainWindow.xaml
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Resources/DeviceImage1.png
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Resources/DeviceImage2.png
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Resources/DeviceImage3.png
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Resources/DeviceImage4.png
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Resources/DeviceImage5.png
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/app.xaml
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/app.baml
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/mainwindow.baml
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/resources/deviceimage1.png
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/resources/deviceimage2.png
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/resources/deviceimage3.png
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/resources/deviceimage4.png
Source: logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/resources/deviceimage5.png
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://opensource.logitech.com
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0A
Source: vc_redist.x64.exe, 0000000D.00000002.50390462752.000000000123E000.00000004.00000020.00020000.00000000.sdmp, vc_redist.x64.exe, 0000000D.00000003.50389226231.000000000123B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.c
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://subca.ocsp-certum.com01
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://subca.ocsp-certum.com02
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://subca.ocsp-certum.com05
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://util.logitech.io/brand
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://util.logitech.io/brandhttps://1f180ff7ee13484888aca6ea23e4919f
Source: vc_redist.x64.exe, 0000000E.00000002.50387365161.0000000003670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: logioptionsplus_installer.exe	String found in binary or memory: http://www.lineto.
Source: logioptionsplus_installer.exe	String found in binary or memory: http://www.lineto.c
Source: logioptionsplus_installer.exe	String found in binary or memory: http://www.lineto.com/Lineto.com/Font
Source: logioptionsplus_installer.exe	String found in binary or memory: http://www.lineto.com/The
Source: logioptionsplus_installer.exe	String found in binary or memory: http://www.lineto.comht
Source: logioptionsplus_installer.exe	String found in binary or memory: http://www.lineto.comhttp:
Source: logioptionsplus_installer.exe	String found in binary or memory: http://www.lineto.comhttp:/
Source: logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.logi.com
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cpgbackup.logitech.com
Source: logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cpgbackup.logitech.comt
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CC33000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F5914F3000.00000004.00000800.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB9B5000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CC33000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F5914F3000.00000004.00000800.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB9B5000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CC33000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F5914F3000.00000004.00000800.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB9B5000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://custom.ultimateears.com
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datapipeline.logitech.io
Source: logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://datapipeline.logitech.ioB
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://device-compatibility.np.logitech.io
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://id.logi.com/
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kiros.logitech.io
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kiros.logitech.iohttps://sandbox.accounts.logi.comhttps://accounts.logi.com547af993-8be7-44a
Source: logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kiros.logitech.iow
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logi-prestage-65.logitech.com/
Source: logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://logi-prestage-65.logitech.com/t
Source: logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logismartactions.uservoice.com/widget_environment/
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logitech.uservoice.com/widget_environment/
Source: logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://logitech.uservoice.com/widget_environment/O
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logitech.uservoice.com/widget_environment/api_keyOyZTk229rDJKPdsUFvzL5g.jslogitech_macros_us
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://opensource.logitech.com
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://opensource.logitech.com/
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://pro.ultimateears.com
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raviga-dev.np.logitech.io
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50420168445.000001F5EE269000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sandbox.accounts.logi.com
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sandbox.id.logi.com/
Source: logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sandbox.id.logi.com/K
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stg-datapipeline.np.logitech.io
Source: logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stg-datapipeline.np.logitech.ioE
Source: logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stg.optionsbackup.logitech.com
Source: logioptionsplus_installer.exe	String found in binary or memory: https://support.logi.com/hc/articles/360025297893
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://support.logicool.co.jp/response-center
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://support.logitech.com/response-center
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://updates-beta.logitech.com
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://updates.logitech.com
Source: logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://updates.logitech.comZ
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://updates.optionsplus.logitechg.com
Source: logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://updates.optionsplus.logitechg.compublicoptionsplus3invalid
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: logioptionsplus_installer.exe	String found in binary or memory: https://www.logicool.co.jp/
Source: logioptionsplus_installer.exe	String found in binary or memory: https://www.logicool.co.jp/assets/65580/logitech-eula.pdf
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logicool.co.jp/footer/subscription-management
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logicool.co.jp/ja-jp/legal/product-privacy-policy/product-privacy-policy-archive.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logicool.co.jp/ja-jp/legal/web-privacy-policy.html
Source: logioptionsplus_installer.exe, logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.logitech.com/
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/da-dk/legal/product-privacy-policy/product-privacy-policy-archive.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/de-de/legal/product-privacy-policy/product-privacy-policy-archive.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/de-de/legal/web-privacy-policy.html
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/de-de/my-account/email-preferences.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/el-gr/legal/product-privacy-policy/product-privacy-policy-archive.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/el-gr/legal/web-privacy-policy.html
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/el-gr/my-account/email-preferences.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/en-us/legal/product-privacy-policy.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/en-us/legal/product-privacy-policy/product-privacy-policy-archive.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/en-us/legal/web-privacy-policy.html
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/en-us/my-account/email-preferences.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/es-es/legal/product-privacy-policy/product-privacy-policy-archive.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/es-es/legal/web-privacy-policy.html
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/es-es/my-account/email-preferences.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/fi-fi/legal/product-privacy-policy/product-privacy-policy-archive.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/fi-fi/legal/web-privacy-policy.html
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/fi-fi/my-account/email-preferences.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/fr-fr/legal/product-privacy-policy/product-privacy-policy-archive.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/fr-fr/legal/web-privacy-policy.html
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/fr-fr/my-account/email-preferences.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/it-it/legal/product-privacy-policy/product-privacy-policy-archive.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/it-it/legal/web-privacy-policy.html
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/it-it/my-account/email-preferences.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/ko-kr/legal/product-privacy-policy/product-privacy-policy-archive.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/ko-kr/legal/web-privacy-policy.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/ko-kr/my-account/email-preferences.html
Source: logioptionsplus_installer.exe	String found in binary or memory: https://www.logitech.com/legal/eula.html
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/legal/product-privacy-policy.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/legal/web-privacy-policy.html
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/my-account/email-preferences.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/nl-nl/legal/product-privacy-policy/product-privacy-policy-archive.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/nl-nl/legal/web-privacy-policy.html
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/nl-nl/my-account/email-preferences.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/no-no/legal/product-privacy-policy/product-privacy-policy-archive.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/no-no/legal/web-privacy-policy.html
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/no-no/my-account/email-preferences.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/pl-pl/legal/product-privacy-policy/product-privacy-policy-archive.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/pl-pl/legal/web-privacy-policy.html
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/pl-pl/my-account/email-preferences.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/pt-br/legal/product-privacy-policy/product-privacy-policy-archive.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/pt-br/legal/web-privacy-policy.html
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/pt-br/my-account/email-preferences.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/sv-se/legal/product-privacy-policy/product-privacy-policy-archive.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/sv-se/legal/web-privacy-policy.html
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/sv-se/my-account/email-preferences.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/zh-cn/legal/product-privacy-policy/product-privacy-policy-archive.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/zh-cn/legal/web-privacy-policy.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/zh-cn/my-account/email-preferences.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/zh-tw/legal/product-privacy-policy/product-privacy-policy-archive.html
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/zh-tw/legal/web-privacy-policy.html
Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.logitech.com/zh-tw/my-account/email-preferences.html

Source: unknown	Network traffic detected: HTTP traffic on port 65527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55499
Source: unknown	Network traffic detected: HTTP traffic on port 60207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53385
Source: unknown	Network traffic detected: HTTP traffic on port 62332 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60207
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62332
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61211
Source: unknown	Network traffic detected: HTTP traffic on port 55499 -> 443

System Summary

Found detection on Joe Sandbox Cloud Basic

Source: https://download01.logi.com/web/ftp/pub/techsupport/optionsplus/logioptionsplus_installer.exe

Joe Sandbox Cloud Basic: Detection: malicious Score: 48 Threat Name: Analyzer: w10x64

Perma Link

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\90cbdf.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICCF8.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\vcamp140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\vcomp140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\concrt140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140_1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140_2.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140_codecvt_ids.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\vccorlib140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\90cbe2.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\90cbe2.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\90cbe3.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{8678BA04-D161-45BE-ACA4-CC5D13073F35}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID12F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140chs.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140cht.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140deu.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140enu.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140esn.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140fra.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140ita.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140jpn.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140kor.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140rus.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140u.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfcm140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfcm140u.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\90cbe6.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\90cbe6.msi	Jump to behavior

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe

File deleted: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe

Jump to behavior

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_0054C0FA	13_2_0054C0FA
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_00526184	13_2_00526184
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_0055022D	13_2_0055022D
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_0055A3B0	13_2_0055A3B0
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_00550662	13_2_00550662
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_0052A7EF	13_2_0052A7EF
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_0055A85E	13_2_0055A85E
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_0054F919	13_2_0054F919
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_005369CC	13_2_005369CC
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_00550A97	13_2_00550A97
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_00552B21	13_2_00552B21
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_00552D50	13_2_00552D50
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_0055ED4C	13_2_0055ED4C
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_0054FE15	13_2_0054FE15
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F469CC	14_2_00F469CC
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F5C0FA	14_2_00F5C0FA
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F36184	14_2_00F36184
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F6022D	14_2_00F6022D
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F6A3B0	14_2_00F6A3B0
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F60662	14_2_00F60662
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F3A7EF	14_2_00F3A7EF
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F6A85E	14_2_00F6A85E
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F5F919	14_2_00F5F919
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F60A97	14_2_00F60A97
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F62B21	14_2_00F62B21
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F62D50	14_2_00F62D50
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F6ED4C	14_2_00F6ED4C
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F5FE15	14_2_00F5FE15
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A4C0FA	15_2_00A4C0FA
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A26184	15_2_00A26184
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A5022D	15_2_00A5022D
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A5A3B0	15_2_00A5A3B0
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A50662	15_2_00A50662
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A2A7EF	15_2_00A2A7EF
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A5A85E	15_2_00A5A85E
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A369CC	15_2_00A369CC
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A4F919	15_2_00A4F919
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A50A97	15_2_00A50A97
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A52B21	15_2_00A52B21
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A5ED4C	15_2_00A5ED4C
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A52D50	15_2_00A52D50
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A4FE15	15_2_00A4FE15

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: String function: 0056061A appears 34 times
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: String function: 0056012F appears 678 times
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: String function: 005237D3 appears 496 times
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: String function: 005631C7 appears 85 times
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: String function: 00521F20 appears 54 times
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: String function: 00F731C7 appears 83 times
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: String function: 00F31F20 appears 54 times
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: String function: 00F7061A appears 34 times
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: String function: 00F7012F appears 678 times
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: String function: 00F337D3 appears 496 times
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: String function: 00A237D3 appears 496 times
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: String function: 00A6012F appears 678 times
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: String function: 00A6061A appears 34 times
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: String function: 00A631C7 appears 83 times
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: String function: 00A21F20 appears 54 times

Source: Unconfirmed 521320.crdownload.0.dr

Static PE information: Resource name: RT_RCDATA type: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows

Source: mfc140rus.dll.19.dr	Static PE information: No import functions for PE file found
Source: mfc140fra.dll.19.dr	Static PE information: No import functions for PE file found
Source: mfc140deu.dll.19.dr	Static PE information: No import functions for PE file found
Source: mfc140ita.dll.19.dr	Static PE information: No import functions for PE file found
Source: mfc140jpn.dll.19.dr	Static PE information: No import functions for PE file found
Source: mfc140cht.dll.19.dr	Static PE information: No import functions for PE file found
Source: mfc140kor.dll.19.dr	Static PE information: No import functions for PE file found
Source: mfc140enu.dll.19.dr	Static PE information: No import functions for PE file found
Source: mfc140esn.dll.19.dr	Static PE information: No import functions for PE file found
Source: 0d281a76-4c68-45b6-b4fa-575fcee7f44b.tmp.0.dr	Static PE information: No import functions for PE file found
Source: logioptionsplus_setup.exe.11.dr	Static PE information: No import functions for PE file found
Source: mfc140chs.dll.19.dr	Static PE information: No import functions for PE file found

Source: 0d281a76-4c68-45b6-b4fa-575fcee7f44b.tmp.0.dr

Static PE information: Data appended to the last section found

Source: C:\Users\user\Downloads\logioptionsplus_installer.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Downloads\logioptionsplus_installer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: dxva2.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: wmp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: wmploc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: usoapi.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: sxproxy.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior

Source: classification engine

Classification label: sus35.evad.win@42/120@4/4

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe

Code function: 13_2_0055FD20 FormatMessageW,GetLastError,LocalFree,

13_2_0055FD20

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_005244E9 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	13_2_005244E9
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F344E9 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	14_2_00F344E9
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A244E9 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	15_2_00A244E9

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe

Code function: 13_2_00562F23 GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess,

13_2_00562F23

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe

Code function: 13_2_00546945 ChangeServiceConfigW,GetLastError,

13_2_00546945

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\0d281a76-4c68-45b6-b4fa-575fcee7f44b.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe

Mutant created: NULL

Source: C:\Users\user\Downloads\logioptionsplus_installer.exe

File created: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe

Jump to behavior

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Command line argument: cabinet.dll	13_2_00521070
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Command line argument: msi.dll	13_2_00521070
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Command line argument: version.dll	13_2_00521070
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Command line argument: wininet.dll	13_2_00521070
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Command line argument: comres.dll	13_2_00521070
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Command line argument: clbcatq.dll	13_2_00521070
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Command line argument: msasn1.dll	13_2_00521070
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Command line argument: crypt32.dll	13_2_00521070
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Command line argument: feclient.dll	13_2_00521070
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Command line argument: cabinet.dll	14_2_00F31070
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Command line argument: msi.dll	14_2_00F31070
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Command line argument: version.dll	14_2_00F31070
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Command line argument: wininet.dll	14_2_00F31070
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Command line argument: comres.dll	14_2_00F31070
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Command line argument: clbcatq.dll	14_2_00F31070
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Command line argument: msasn1.dll	14_2_00F31070
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Command line argument: crypt32.dll	14_2_00F31070
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Command line argument: feclient.dll	14_2_00F31070
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Command line argument: cabinet.dll	15_2_00A21070
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Command line argument: msi.dll	15_2_00A21070
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Command line argument: version.dll	15_2_00A21070
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Command line argument: wininet.dll	15_2_00A21070
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Command line argument: comres.dll	15_2_00A21070
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Command line argument: clbcatq.dll	15_2_00A21070
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Command line argument: msasn1.dll	15_2_00A21070
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Command line argument: crypt32.dll	15_2_00A21070
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Command line argument: feclient.dll	15_2_00A21070

Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Downloads\logioptionsplus_installer.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CC33000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F5914F3000.00000004.00000800.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB9B5000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CC33000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F5914F3000.00000004.00000800.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB9B5000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CC33000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F5914F3000.00000004.00000800.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB9B5000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: logioptionsplus_installer.exe	String found in binary or memory: --no-keys-sync-on-install
Source: logioptionsplus_installer.exe	String found in binary or memory: no-keys-sync-on-install
Source: logioptionsplus_installer.exe	String found in binary or memory: /install /quiet /norestart
Source: logioptionsplus_installer.exe	String found in binary or memory: --install-event=
Source: logioptionsplus_installer.exe	String found in binary or memory: o-keys-sync-on-install
Source: logioptionsplus_installer.exe	String found in binary or memory: -install-event=
Source: logioptionsplus_installer.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: vc_redist.x64.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: vc_redist.x64.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: VC_redist.x64.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1996 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://download01.logi.com/web/ftp/pub/techsupport/optionsplus/logioptionsplus_installer.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2972 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6164 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3352 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5480 /prefetch:8
Source: unknown	Process created: C:\Users\user\Downloads\logioptionsplus_installer.exe "C:\Users\user\Downloads\logioptionsplus_installer.exe"
Source: C:\Users\user\Downloads\logioptionsplus_installer.exe	Process created: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe --install-event=897bbe07-5e15-4275-a4f7-6d424b298ef0.optionsplus_install_finish_event
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process created: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe "C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe" /install /quiet /norestart
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Process created: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe "C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe" -burn.filehandle.attached=532 -burn.filehandle.self=528 /install /quiet /norestart
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Process created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe "C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A922CA2A-29A1-4011-A158-7648632856CA} {2230389D-DB71-45B4-9086-D875DD617B8B} 3740
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1996 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2972 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6164 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3352 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5480 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Downloads\logioptionsplus_installer.exe	Process created: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe --install-event=897bbe07-5e15-4275-a4f7-6d424b298ef0.optionsplus_install_finish_event	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process created: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe "C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe" /install /quiet /norestart	Jump to behavior
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Process created: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe "C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe" -burn.filehandle.attached=532 -burn.filehandle.self=528 /install /quiet /norestart	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Process created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe "C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A922CA2A-29A1-4011-A158-7648632856CA} {2230389D-DB71-45B4-9086-D875DD617B8B} 3740	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe

Window detected: Number of UI elements: 23

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}

Jump to behavior

Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: logioptionsplus_installer.exe, vc_redist.x64.exe, 0000000D.00000000.50335860026.000000000056B000.00000002.00000001.01000000.00000009.sdmp, vc_redist.x64.exe, 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmp, vc_redist.x64.exe, 0000000E.00000000.50337381117.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmp, vc_redist.x64.exe, 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmp, VC_redist.x64.exe, 0000000F.00000002.50382879992.0000000000A6B000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 0000000F.00000003.50349070384.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 0000000F.00000000.50344640784.0000000000A6B000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcamp140.amd64.pdb source: vcamp140.dll.19.dr
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: msvcp140.dll.19.dr
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcamp140.amd64.pdbGCTL source: vcamp140.dll.19.dr
Source:	Binary string: C:\builds\kiros\kiros\build\x64\logi\installer\Release\logi_installer_shared_optionsplus.pdb source: logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CC33000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F5914F3000.00000004.00000800.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB9B5000.00000002.00000001.01000000.00000012.sdmp

Source: logi_installer_shared_optionsplus.dll.12.dr	Static PE information: real checksum: 0x0 should be: 0x8d34ae
Source: 0d281a76-4c68-45b6-b4fa-575fcee7f44b.tmp.0.dr	Static PE information: real checksum: 0x1d0f3ec should be: 0x12508

Source: 0d281a76-4c68-45b6-b4fa-575fcee7f44b.tmp.0.dr	Static PE information: section name: SHARED
Source: 0d281a76-4c68-45b6-b4fa-575fcee7f44b.tmp.0.dr	Static PE information: section name: _RDATA
Source: Unconfirmed 521320.crdownload.0.dr	Static PE information: section name: SHARED
Source: Unconfirmed 521320.crdownload.0.dr	Static PE information: section name: _RDATA
Source: vc_redist.x64.exe.12.dr	Static PE information: section name: .wixburn
Source: logi_installer_shared_optionsplus.dll.12.dr	Static PE information: section name: CPADinfo
Source: vc_redist.x64.exe.13.dr	Static PE information: section name: .wixburn
Source: VC_redist.x64.exe.14.dr	Static PE information: section name: .wixburn
Source: VC_redist.x64.exe.15.dr	Static PE information: section name: .wixburn
Source: mfc140.dll.19.dr	Static PE information: section name: .didat
Source: mfc140u.dll.19.dr	Static PE information: section name: .didat
Source: mfcm140.dll.19.dr	Static PE information: section name: .nep
Source: mfcm140u.dll.19.dr	Static PE information: section name: .nep
Source: vcomp140.dll.19.dr	Static PE information: section name: _RDATA
Source: msvcp140.dll.19.dr	Static PE information: section name: .didat
Source: vcruntime140.dll.19.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Code function: 12_2_00007FFCB342D2A5 pushad ; iretd	12_2_00007FFCB342D2A6
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Code function: 12_2_00007FFCB3542BC4 pushfd ; ret	12_2_00007FFCB3542BE2
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Code function: 12_2_00007FFCB3544866 pushad ; retf 5D46h	12_2_00007FFCB3544A2D
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Code function: 12_2_00007FFCB3542BB8 pushfd ; ret	12_2_00007FFCB3542BC2
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Code function: 12_2_00007FFCB35416BA push edx; ret	12_2_00007FFCB35416D2
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Code function: 12_2_00007FFCB35429D1 push edi; ret	12_2_00007FFCB35429D2
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Code function: 12_2_00007FFCB35448A9 pushad ; retf 5D46h	12_2_00007FFCB3544A2D
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Code function: 12_2_00007FFCB3542911 push esi; ret	12_2_00007FFCB3542912
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_0054E876 push ecx; ret	13_2_0054E889
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F5E876 push ecx; ret	14_2_00F5E889
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A4E876 push ecx; ret	15_2_00A4E889

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140kor.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140_2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140jpn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140_codecvt_ids.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140esn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140ita.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140deu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140u.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140chs.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfcm140u.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140_1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140enu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140fra.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\vcruntime140_1.dll	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 521320.crdownload	Jump to dropped file
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\wixstdba.dll	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\logioptionsplus_installer.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcamp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\concrt140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\vccorlib140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	File created: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	File created: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\logi_installer_shared_optionsplus.dll	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\0d281a76-4c68-45b6-b4fa-575fcee7f44b.tmp	Jump to dropped file
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	File created: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcomp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140cht.dll	Jump to dropped file
Source: C:\Users\user\Downloads\logioptionsplus_installer.exe	File created: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140rus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfcm140.dll	Jump to dropped file
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	File created: C:\ProgramData\Package Cache\{282975d8-55fe-4991-bbbb-06a72581ce58}\VC_redist.x64.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	File created: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	File created: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\logi_installer_shared_optionsplus.dll	Jump to dropped file
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	File created: C:\ProgramData\Package Cache\{282975d8-55fe-4991-bbbb-06a72581ce58}\VC_redist.x64.exe	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140kor.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140_2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140jpn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140_codecvt_ids.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140ita.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140esn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140u.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140deu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140chs.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfcm140u.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140_1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140enu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140fra.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\vcruntime140_1.dll	Jump to dropped file
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\wixstdba.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcamp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\concrt140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\vccorlib140.dll	Jump to dropped file
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	File created: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcomp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140cht.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140rus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfcm140.dll	Jump to dropped file

Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1028\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1029\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1031\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1036\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1040\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1041\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1042\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1045\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1046\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1049\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1055\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\2052\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	File created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\3082\license.rtf	Jump to behavior

Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore

Jump to behavior

Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {282975d8-55fe-4991-bbbb-06a72581ce58}	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {282975d8-55fe-4991-bbbb-06a72581ce58}	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {282975d8-55fe-4991-bbbb-06a72581ce58}	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {282975d8-55fe-4991-bbbb-06a72581ce58}	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Memory allocated: 1F5EE3F0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Memory allocated: 1F5EFE10000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140_2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140kor.dll	Jump to dropped file
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Dropped PE file which has not been started: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\wixstdba.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140_codecvt_ids.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140jpn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140ita.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\vcamp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140esn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140deu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\concrt140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140u.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\vccorlib140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfcm140u.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140chs.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Dropped PE file which has not been started: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\logi_installer_shared_optionsplus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140enu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\vcomp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140cht.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140fra.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfcm140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140rus.dll	Jump to dropped file

Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Evaded block: after key decision
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Evaded block: after key decision
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Evaded block: after key decision
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Evaded block: after key decision
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Evaded block: after key decision
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Evaded block: after key decision

Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe

Evasive API call chain: GetLocalTime,DecisionNodes

Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_0055FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0055FE5Dh	13_2_0055FDC2
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_0055FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 0055FE56h	13_2_0055FDC2
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F6FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00F6FE5Dh	14_2_00F6FDC2
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F6FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00F6FE56h	14_2_00F6FDC2
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A5FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00A5FE5Dh	15_2_00A5FDC2
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A5FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00A5FE56h	15_2_00A5FDC2

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_00523BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	13_2_00523BC3
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_00564315 FindFirstFileW,FindClose,	13_2_00564315
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_0053993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	13_2_0053993E
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_00557A87 FindFirstFileExW,	13_2_00557A87
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F74315 FindFirstFileW,FindClose,	14_2_00F74315
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F4993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	14_2_00F4993E
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F33BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	14_2_00F33BC3
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F67A87 FindFirstFileExW,	14_2_00F67A87
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A64315 FindFirstFileW,FindClose,	15_2_00A64315
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A3993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	15_2_00A3993E
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A23BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	15_2_00A23BC3
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A57A87 FindFirstFileExW,	15_2_00A57A87

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe

Code function: 13_2_0056962D VirtualQuery,GetSystemInfo,

13_2_0056962D

Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	File opened: C:\ProgramData\Package Cache\{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}v14.24.28127\NULL	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	File opened: C:\ProgramData\Package Cache\{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}v14.24.28127\packages\vcRuntimeMinimum_amd64	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	File opened: C:\ProgramData\Package Cache\{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}v14.24.28127\packages\vcRuntimeMinimum_amd64\NULL	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	File opened: C:\ProgramData\Package Cache\{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}v14.24.28127\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	File opened: C:\ProgramData\Package Cache\{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}v14.24.28127\packages	Jump to behavior
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	File opened: C:\ProgramData\Package Cache\{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}v14.24.28127\packages\NULL	Jump to behavior

Source: logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: AVMcI
Source: logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllp

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe

Code function: 13_2_0054E625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

13_2_0054E625

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_00554812 mov eax, dword ptr fs:[00000030h]	13_2_00554812
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F64812 mov eax, dword ptr fs:[00000030h]	14_2_00F64812
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A54812 mov eax, dword ptr fs:[00000030h]	15_2_00A54812

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe

Code function: 13_2_005238D4 GetProcessHeap,RtlAllocateHeap,

13_2_005238D4

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_0054E188 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_0054E188
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_0054E625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_0054E625
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_0054E773 SetUnhandledExceptionFilter,	13_2_0054E773
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Code function: 13_2_00553BB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00553BB0
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F5E188 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_00F5E188
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F5E625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00F5E625
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F5E773 SetUnhandledExceptionFilter,	14_2_00F5E773
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Code function: 14_2_00F63BB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00F63BB0
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A4E188 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00A4E188
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A4E625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00A4E625
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A4E773 SetUnhandledExceptionFilter,	15_2_00A4E773
Source: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	Code function: 15_2_00A53BB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00A53BB0

Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: logioptionsplus_setup.exe.11.dr, InstallerExternalHelper.cs	Reference to suspicious API methods: Core.GetProcAddress(m_module, functionName)
Source: logioptionsplus_setup.exe.11.dr, Bootstrap.cs	Reference to suspicious API methods: LoadLibraryW("kernel32.dll")
Source: logioptionsplus_setup.exe.11.dr, MainWindow.cs	Reference to suspicious API methods: ((FrameworkElement)this).FindResource((object)"FadeInStoryboard")

Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Process created: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe "C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe" /install /quiet /norestart	Jump to behavior
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Process created: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe "C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe" -burn.filehandle.attached=532 -burn.filehandle.self=528 /install /quiet /norestart	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Process created: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe "C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A922CA2A-29A1-4011-A158-7648632856CA} {2230389D-DB71-45B4-9086-D875DD617B8B} 3740	Jump to behavior

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Process created: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe "c:\windows\temp\{716d2a00-ed5f-4b2e-85fd-2f355fa256a9}\.cr\vc_redist.x64.exe" -burn.clean.room="c:\programdata\logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe" -burn.filehandle.attached=532 -burn.filehandle.self=528 /install /quiet /norestart
Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	Process created: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe "c:\windows\temp\{716d2a00-ed5f-4b2e-85fd-2f355fa256a9}\.cr\vc_redist.x64.exe" -burn.clean.room="c:\programdata\logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe" -burn.filehandle.attached=532 -burn.filehandle.self=528 /install /quiet /norestart			Jump to behavior

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe

Code function: 13_2_005615CB InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,

13_2_005615CB

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe

Code function: 13_2_0056393B AllocateAndInitializeSid,CheckTokenMembership,

13_2_0056393B

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe

Code function: 13_2_0054E9A7 cpuid

13_2_0054E9A7

Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	Queries volume information: C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\logo.png VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe

Code function: 13_2_00534CE8 ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree,

13_2_00534CE8

Source: C:\Users\user\Downloads\logioptionsplus_installer.exe

Code function: 11_2_00007FF61B1E6960 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

11_2_00007FF61B1E6960

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe

Code function: 13_2_005260BA GetUserNameW,GetLastError,

13_2_005260BA

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe

Code function: 13_2_00568733 GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,

13_2_00568733

Source: C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe

Code function: 13_2_0052508D GetModuleHandleW,CoInitializeEx,GetVersionExW,GetLastError,CoUninitialize,

13_2_0052508D

Source: C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	13 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	12 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	13 Command and Scripting Interpreter	12 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Network Service Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	1 Registry Run Keys / Startup Folder	12 Windows Service	2 Obfuscated Files or Information	Security Account Manager	11 Peripheral Device Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	12 Process Injection	1 DLL Side-Loading	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 File Deletion	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Masquerading	Cached Domain Credentials	26 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Virtualization/Sandbox Evasion	DCSync	21 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 Process Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://download01.logi.com/web/ftp/pub/techsupport/optionsplus/logioptionsplus_installer.exe	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner
C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\logi_installer_shared_optionsplus.dll	0%	ReversingLabs
C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe	0%	ReversingLabs
C:\ProgramData\Package Cache\{282975d8-55fe-4991-bbbb-06a72581ce58}\VC_redist.x64.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe	0%	ReversingLabs
C:\Users\user\Downloads\Unconfirmed 521320.crdownload	0%	ReversingLabs
C:\Users\user\Downloads\logioptionsplus_installer.exe (copy)	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\concrt140.dll	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140.dll	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140_1.dll	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140_2.dll	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140_codecvt_ids.dll	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\vccorlib140.dll	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\vcruntime140.dll	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\vcruntime140_1.dll	0%	ReversingLabs
C:\Windows\System32\mfc140.dll	0%	ReversingLabs
C:\Windows\System32\mfc140chs.dll	0%	ReversingLabs
C:\Windows\System32\mfc140cht.dll	0%	ReversingLabs
C:\Windows\System32\mfc140deu.dll	0%	ReversingLabs
C:\Windows\System32\mfc140enu.dll	0%	ReversingLabs
C:\Windows\System32\mfc140esn.dll	0%	ReversingLabs
C:\Windows\System32\mfc140fra.dll	0%	ReversingLabs
C:\Windows\System32\mfc140ita.dll	0%	ReversingLabs
C:\Windows\System32\mfc140jpn.dll	0%	ReversingLabs
C:\Windows\System32\mfc140kor.dll	0%	ReversingLabs
C:\Windows\System32\mfc140rus.dll	0%	ReversingLabs
C:\Windows\System32\mfc140u.dll	0%	ReversingLabs
C:\Windows\System32\mfcm140.dll	0%	ReversingLabs
C:\Windows\System32\mfcm140u.dll	0%	ReversingLabs
C:\Windows\System32\vcamp140.dll	0%	ReversingLabs
C:\Windows\System32\vcomp140.dll	0%	ReversingLabs
C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\wixstdba.dll	0%	ReversingLabs
C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe	0%	ReversingLabs
C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://datapipeline.logitech.ioB	0%	Avira URL Cloud	safe
https://stg-datapipeline.np.logitech.ioE	0%	Avira URL Cloud	safe
http://foo/Resources/DeviceImage2.png	0%	Avira URL Cloud	safe
https://cpgbackup.logitech.comt	0%	Avira URL Cloud	safe
http://foo/bar/resources/deviceimage1.png	0%	Avira URL Cloud	safe
https://curl.se/docs/hsts.html	0%	Avira URL Cloud	safe
http://foo/Resources/DeviceImage5.png	0%	Avira URL Cloud	safe
http://schemas.microsoft.c	0%	Avira URL Cloud	safe
http://www.lineto.comht	0%	Avira URL Cloud	safe
https://updates.logitech.comZ	0%	Avira URL Cloud	safe
https://curl.se/docs/alt-svc.html	0%	Avira URL Cloud	safe
http://defaultcontainer/logioptionsplus_setup;component/MainWindow.xaml	0%	Avira URL Cloud	safe
http://www.lineto.comhttp:/	0%	Avira URL Cloud	safe
http://foo/bar/mainwindow.baml	0%	Avira URL Cloud	safe
http://defaultcontainer/logioptionsplus_setup;component/Resources/DeviceImage1.png	0%	Avira URL Cloud	safe
http://foo/MainWindow.xaml	0%	Avira URL Cloud	safe
https://kiros.logitech.iow	0%	Avira URL Cloud	safe
http://defaultcontainer/logioptionsplus_setup;component/Resources/DeviceImage3.png	0%	Avira URL Cloud	safe
https://www.logicool.co.jp/	0%	Avira URL Cloud	safe
http://www.lineto.	0%	Avira URL Cloud	safe
https://kiros.logitech.iohttps://sandbox.accounts.logi.comhttps://accounts.logi.com547af993-8be7-44a	0%	Avira URL Cloud	safe
http://appsyndication.org/2006/appsyn	0%	Avira URL Cloud	safe
http://foo/bar/resources/deviceimage4.png	0%	Avira URL Cloud	safe
http://defaultcontainer/logioptionsplus_setup;component/Resources/DeviceImage5.png	0%	Avira URL Cloud	safe
http://foo/bar/resources/deviceimage2.png	0%	Avira URL Cloud	safe
https://www.logicool.co.jp/ja-jp/legal/product-privacy-policy/product-privacy-policy-archive.html	0%	Avira URL Cloud	safe
http://www.lineto.comhttp:	0%	Avira URL Cloud	safe
https://www.logicool.co.jp/ja-jp/legal/web-privacy-policy.html	0%	Avira URL Cloud	safe
https://datapipeline.logitech.io	0%	Avira URL Cloud	safe
http://subca.ocsp-certum.com05	0%	Avira URL Cloud	safe
http://foo/Resources/DeviceImage1.png	0%	Avira URL Cloud	safe
http://subca.ocsp-certum.com01	0%	Avira URL Cloud	safe
http://subca.ocsp-certum.com02	0%	Avira URL Cloud	safe
https://updates.optionsplus.logitechg.compublicoptionsplus3invalid	0%	Avira URL Cloud	safe
http://defaultcontainer/logioptionsplus_setup;component/app.xaml	0%	Avira URL Cloud	safe
http://util.logitech.io/brand	0%	Avira URL Cloud	safe
http://foo/Resources/DeviceImage3.png	0%	Avira URL Cloud	safe
http://foo/bar/app.baml	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	142.250.72.164	true	false	high
d1q20hs7kavmn5.cloudfront.net	18.154.132.65	true	false	high
download01.logi.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://foo/bar/resources/deviceimage1.png	logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://logi-prestage-65.logitech.com/t	logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.logitech.com/legal/product-privacy-policy.html	logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://www.logitech.com/el-gr/my-account/email-preferences.html	logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
http://wixtoolset.org/schemas/thmutil/2010	vc_redist.x64.exe, 0000000E.00000002.50387365161.0000000003670000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.logitech.com/zh-tw/legal/web-privacy-policy.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://logitech.uservoice.com/widget_environment/O	logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.logitech.com/no-no/legal/product-privacy-policy/product-privacy-policy-archive.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://stg-datapipeline.np.logitech.ioE	logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.lineto.com/Lineto.com/Font	logioptionsplus_installer.exe	false		high
http://schemas.microsoft.c	vc_redist.x64.exe, 0000000D.00000002.50390462752.000000000123E000.00000004.00000020.00020000.00000000.sdmp, vc_redist.x64.exe, 0000000D.00000003.50389226231.000000000123B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.logitech.com/pt-br/legal/web-privacy-policy.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://updates.logitech.comZ	logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.logitech.com/it-it/legal/web-privacy-policy.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://stg.optionsbackup.logitech.com	logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.logitech.com/fi-fi/my-account/email-preferences.html	logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://updates.logitech.com	logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	false		high
https://curl.se/docs/hsts.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CC33000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F5914F3000.00000004.00000800.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB9B5000.00000002.00000001.01000000.00000012.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Resources/DeviceImage2.png	logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.logitech.com/zh-tw/legal/product-privacy-policy/product-privacy-policy-archive.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://datapipeline.logitech.ioB	logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.logitech.com/it-it/legal/product-privacy-policy/product-privacy-policy-archive.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://www.logitech.com/pl-pl/legal/product-privacy-policy/product-privacy-policy-archive.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://www.logitech.com/de-de/legal/web-privacy-policy.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
http://www.lineto.comht	logioptionsplus_installer.exe	false	Avira URL Cloud: safe	unknown
http://www.certum.pl/CPS0	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	false		high
https://www.logitech.com/da-dk/legal/product-privacy-policy/product-privacy-policy-archive.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://www.logitech.com/nl-nl/legal/web-privacy-policy.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://opensource.logitech.com	logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://www.logitech.com/en-us/my-account/email-preferences.html	logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://updates-beta.logitech.com	logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.logitech.com/sv-se/legal/web-privacy-policy.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
http://crl.certum.pl/ctnca.crl0k	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	false		high
http://foo/Resources/DeviceImage5.png	logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.logitech.com/en-us/legal/web-privacy-policy.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://support.logitech.com/response-center	logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://cpgbackup.logitech.comt	logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/logioptionsplus_setup;component/MainWindow.xaml	logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://curl.se/docs/alt-svc.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CC33000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F5914F3000.00000004.00000800.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB9B5000.00000002.00000001.01000000.00000012.sdmp	false	Avira URL Cloud: safe	unknown
https://www.logitech.com/es-es/legal/web-privacy-policy.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://www.logitech.com/legal/web-privacy-policy.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://logitech.uservoice.com/widget_environment/	logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	false		high
http://defaultcontainer/logioptionsplus_setup;component/Resources/DeviceImage1.png	logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.logitech.com/zh-cn/legal/product-privacy-policy/product-privacy-policy-archive.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://custom.ultimateears.com	logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
http://defaultcontainer/logioptionsplus_setup;component/Resources/DeviceImage3.png	logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://foo/bar/mainwindow.baml	logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://foo/MainWindow.xaml	logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.lineto.comhttp:/	logioptionsplus_installer.exe	false	Avira URL Cloud: safe	unknown
https://www.logitech.com/en-us/legal/product-privacy-policy/product-privacy-policy-archive.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://www.logitech.com/zh-cn/legal/web-privacy-policy.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://kiros.logitech.iow	logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://updates.optionsplus.logitechg.com	logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.logicool.co.jp/	logioptionsplus_installer.exe	false	Avira URL Cloud: safe	unknown
https://www.logitech.com/my-account/email-preferences.html	logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://www.logitech.com/es-es/legal/product-privacy-policy/product-privacy-policy-archive.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://www.logitech.com/fr-fr/my-account/email-preferences.html	logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
http://www.lineto.	logioptionsplus_installer.exe	false	Avira URL Cloud: safe	unknown
https://www.logitech.com/el-gr/legal/product-privacy-policy/product-privacy-policy-archive.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://www.logitech.com/pt-br/my-account/email-preferences.html	logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
http://foo/bar/resources/deviceimage4.png	logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://sandbox.id.logi.com/	logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	false		high
https://id.logi.com/	logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	false		high
http://appsyndication.org/2006/appsyn	vc_redist.x64.exe, VC_redist.x64.exe	false	Avira URL Cloud: safe	unknown
https://kiros.logitech.iohttps://sandbox.accounts.logi.comhttps://accounts.logi.com547af993-8be7-44a	logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.logitech.com/fi-fi/legal/web-privacy-policy.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
http://repository.certum.pl/ctsca2021.cer0A	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	false		high
http://crl.certum.pl/ctsca2021.crl0o	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	false		high
https://support.logi.com/hc/articles/360025297893	logioptionsplus_installer.exe	false		high
http://defaultcontainer/logioptionsplus_setup;component/Resources/DeviceImage5.png	logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.logitech.com/de-de/my-account/email-preferences.html	logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://www.logitech.com/legal/eula.html	logioptionsplus_installer.exe	false		high
https://logi-prestage-65.logitech.com/	logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	false		high
http://foo/bar/resources/deviceimage2.png	logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.logitech.com/fr-fr/legal/product-privacy-policy/product-privacy-policy-archive.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
http://opensource.logitech.com	logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://www.logicool.co.jp/ja-jp/legal/product-privacy-policy/product-privacy-policy-archive.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://www.logitech.com/ko-kr/legal/web-privacy-policy.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://www.logicool.co.jp/ja-jp/legal/web-privacy-policy.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://www.logitech.com/fr-fr/legal/web-privacy-policy.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://www.logitech.com/el-gr/legal/web-privacy-policy.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://www.logitech.com/de-de/legal/product-privacy-policy/product-privacy-policy-archive.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
http://www.lineto.comhttp:	logioptionsplus_installer.exe	false	Avira URL Cloud: safe	unknown
https://logitech.uservoice.com/widget_environment/api_keyOyZTk229rDJKPdsUFvzL5g.jslogitech_macros_us	logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	false		high
https://datapipeline.logitech.io	logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://subca.ocsp-certum.com05	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://www.logitech.com/sv-se/legal/product-privacy-policy/product-privacy-policy-archive.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
https://www.logitech.com/nl-nl/legal/product-privacy-policy/product-privacy-policy-archive.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high
http://foo/Resources/DeviceImage1.png	logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://subca.ocsp-certum.com02	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://subca.ocsp-certum.com01	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://updates.optionsplus.logitechg.compublicoptionsplus3invalid	logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.certum.pl/ctnca2.crl0l	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	false		high
http://repository.certum.pl/ctnca2.cer09	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmp	false		high
http://defaultcontainer/logioptionsplus_setup;component/app.xaml	logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://util.logitech.io/brand	logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Resources/DeviceImage3.png	logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://foo/bar/app.baml	logioptionsplus_setup.exe, 0000000C.00000002.50395219687.000001F580001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://cpgbackup.logitech.com	logioptionsplus_installer.exe, 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50422347125.000001F5F04F7000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ED772000.00000002.00000001.01000000.00000007.sdmp, logioptionsplus_setup.exe, 0000000C.00000002.50397241993.000001F591421000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.logitech.com/fi-fi/legal/product-privacy-policy/product-privacy-policy-archive.html	logioptionsplus_installer.exe, 0000000B.00000000.50291850932.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmp, logioptionsplus_setup.exe, 0000000C.00000000.50308900246.000001F5ECD72000.00000002.00000001.01000000.00000007.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.154.132.65	d1q20hs7kavmn5.cloudfront.net	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.72.164	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.11.20

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1416047
Start date and time:	2024-03-26 19:36:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://download01.logi.com/web/ftp/pub/techsupport/optionsplus/logioptionsplus_installer.exe
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus35.evad.win@42/120@4/4
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 90% Number of executed functions: 142 Number of non-executed functions: 248

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, CompPkgSrv.exe, VSSVC.exe, TextInputHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.72.163, 142.250.141.84, 172.217.12.142, 34.104.35.123, 142.250.68.35, 142.250.176.3
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, update.googleapis.com, clientservices.googleapis.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target logioptionsplus_installer.exe, PID 3364 because there are no executed function
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://download01.logi.com/web/ftp/pub/techsupport/optionsplus/logioptionsplus_installer.exe

Simulations

Behavior and APIs

Time	Type	Description
15:39:41	Autostart	Run: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce {282975d8-55fe-4991-bbbb-06a72581ce58} "C:\ProgramData\Package Cache\{282975d8-55fe-4991-bbbb-06a72581ce58}\VC_redist.x64.exe" /burn.runonce

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	19148
Entropy (8bit):	5.5138101085796105
Encrypted:	false
SSDEEP:	192:QMzn0dnNS3xKHkPz2arzh7uh5eYs6B3Ih6B3wJClER5zdPDp2Sa:QGn0dnNS3xKHkPz9Z+A6Bu6BgBqSa
MD5:	1C437EE5340317F9E34F31B4F3946C56
SHA1:	971F6CB80254BEBCBEE5569E1BF3D457684640C4
SHA-256:	59E4C557811336EE4CC822D60D9D62BEC74E064045125D554B906935D6B4E2C8
SHA-512:	51A0299689A9F17888B49E3A32BD09A97021D88179E50203EC401579883C21380B1EE225306B88CF7AA1A09A51C6CD37A3987AA7236FE5042BE2727E60508D84
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@..zX.@.....@.....@.....@.....@.....@......&.{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19};.Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.24.28127..vc_runtimeMinimum_x64.msi.@.....@.m...@.....@........&.{5302C21D-28E2-4694-AA81-CE2C11CA6D8B}.....@.....@.....@.....@.......@.....@.....@.......@....;.Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.24.28127......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{3639FCCA-5969-316D-AC18-E0C6B2B532E9}&.{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}.@......&.{D2959D22-4DB7-32AF-A1B0-8405C4221749}&.{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}.@......&.{03C1EACE-7E47-3142-A7E7-F36508D02BD1}&.{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}.@......&.{B33258FD-750C-3B42-8BE4-535B48E97DB4}&.{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}.@......&.{2427B123-F132-4F0B-A958-50F7CDFCAA56}&.{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}.@......&.{22824972-0C4A-31B4-AEEF-9FC7596F1305}&

C:\Config.Msi\90cbe5.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	21397
Entropy (8bit):	5.359214708398255
Encrypted:	false
SSDEEP:	384:prHO6xZgIl8YupYbhjD43CwdsalckU72eC6NtQKlKqynyBt88iSw:py6xZgIl8YupYbh/aCwwDVA8i8Vw
MD5:	5697C6D587E5B9CED0E5F7B6F3DEA1E9
SHA1:	A586AECE87EFC39886AEC7C12EB77AB7E5C573C5
SHA-256:	740F68E22FED79B480B6CA0F10A047B35F938704F3629492093B7EE42DF42AE5
SHA-512:	D94162492F77F4F8AD806611CB7B2DC8DA9127D3D0E831A53686441FC6D9817170D2B22FE98A6647BB7F71BE0C25900810BB38A35FC50103C7C1098EA44C2A18
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@..zX.@.....@.....@.....@.....@.....@......&.{8678BA04-D161-45BE-ACA4-CC5D13073F35}>.Microsoft Visual C++ 2019 X64 Additional Runtime - 14.24.28127..vc_runtimeAdditional_x64.msi.@.....@.m...@.....@........&.{1FCB6B93-B382-48B7-9485-A319D74F4F84}.....@.....@.....@.....@.......@.....@.....@.......@....>.Microsoft Visual C++ 2019 X64 Additional Runtime - 14.24.28127......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{3639FCCA-5969-316D-AC18-E0C6B2B532E9}&.{8678BA04-D161-45BE-ACA4-CC5D13073F35}.@......&.{D2959D22-4DB7-32AF-A1B0-8405C4221749}&.{8678BA04-D161-45BE-ACA4-CC5D13073F35}.@......&.{99A922E3-648F-3C37-8AE6-78232F317B1E}&.{8678BA04-D161-45BE-ACA4-CC5D13073F35}.@......&.{8924DA15-E863-388D-A06B-E7A3931AD77B}&.{8678BA04-D161-45BE-ACA4-CC5D13073F35}.@......&.{32252141-0BE5-3AFE-9849-D281CD954D43}&.{8678BA04-D161-45BE-ACA4-CC5D13073F35}.@......&.{AD221A2C-956B-3F16-8F64-FC938

C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\PageInstalled.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe
File Type:	GIF image data, version 89a, 800 x 400
Category:	dropped
Size (bytes):	31395
Entropy (8bit):	7.921156286103369
Encrypted:	false
SSDEEP:	768:KSk1nkXNRd3Yt3YCF+1+/dacE11Qm2hjuXj:rkkXNRiyCF+1CNy11jj
MD5:	0B976C4D692865CF8C80DB344D689099
SHA1:	2603F13C380DB2AE80E3A48C6224ABD5043F6200
SHA-256:	E824FE62DE1B10B2A2EC5FFD8A8F2CF244F1D59319E7EA8AEC989C71EAD8EB8A
SHA-512:	BE8310EA8800C4C46F36417277130AA8307F008EE6ED49A22C4C028F10CA0B63463E46F89022E0B9607FE7BEAE675DEF27896B432BB0AD53BE52E4179E89BB2B
Malicious:	false
Reputation:	low
Preview:	GIF89a ....[..\|..N.............b.................t..j.....W..\.............S.............................................................e...................k.........V................_........M..........wH.\|K.U...............X..........i..........}S.....................................pD......................x[.........................\........................................h?..................................i....U.................s..........I...........kw.X.......Q..{.....\.....M..`..w.s.....i..P!...............Z_......t...)G......Y..T3..................]..6..th.`....~.............O.......j........(...........g.B}...W.....g............c........t....N...~.....................................o.y..........v..............X......n.!..NETSCAPE2.0.....!.......!..Optimized using ezgif.com.,.... ..........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.*]...P.J.J...X.j....`..K...h.]...p..K...x..........L..

C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\PageLegacyOptions.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe
File Type:	GIF image data, version 89a, 800 x 400
Category:	dropped
Size (bytes):	26348
Entropy (8bit):	7.8374027371239015
Encrypted:	false
SSDEEP:	384:qziDHiq66uuXE+xQq7Glhgbp2//UceVbp2//UcfxfVHFkBxQXar2nsJzIB:q+OqWuNMAU9etU9f1Vmv6qzIB
MD5:	AB5A77084D242F395D18A9178F780D3E
SHA1:	3808E300C9178FC372E08E14327060A550329D3F
SHA-256:	67F08D505222E99EC36C3D648F0733EB9E59B28823136B62F10599FA5D4B011A
SHA-512:	539BF77C03B647CDE54912D346FF77C9E1D585B1E531BA73B6A57963E0E1B5CB247CD467E5B7A5B7E5753E135C9E777E123675786710CA54322341359C330C5F
Malicious:	false
Reputation:	low
Preview:	GIF89a ....T...h..}.....q..................._..s.......{.....N.........................................i......{.u..............................z..M..R..Q..Z.Z..e....I.......................q..Z..........................t..............`.t....S.l.\|..........s.....]..h..W.d.u....................................U.....r.................kw.......................^........w.vH....i..P!.............Xc.......)G...........T3....[................b................................s...................................j.j.g@.B}.......................a.....................................................................................................................C...............m.......X....................h..^....x.4....................!..NETSCAPE2.0.....!...$...!..Optimized using ezgif.com.,.... ..........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.*]...P.J.J...X.j....`..K...h.]...p..K...x..........L..

C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\PageUnsupportedOs.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe
File Type:	GIF image data, version 89a, 800 x 400
Category:	dropped
Size (bytes):	24284
Entropy (8bit):	7.8366827140862645
Encrypted:	false
SSDEEP:	384:+1K892+1cJ8dQ8PeEVefcVimid5imnJhVT3395MG2GhmBUKdb:/8c+1TD2E4fc8mJmnJb3t5v2qGb
MD5:	C1056EE113BB012AABC09313914149E5
SHA1:	2BE86CAE925072BC99FCE2A3E880CAF9819E88D2
SHA-256:	48EA9399F9A2EDC71B4F137D7C13052D249F7A4C625E780A8EE2271BFC74AA1B
SHA-512:	EC3BA7F9781D645D118445B38FCD49FF77C175339B645DB49262DF2A754A23D4FE04556B7E00258DF5EB459AF8117376EC627E217468A9833662041A60268A6B
Malicious:	false
Reputation:	low
Preview:	GIF89a ....d...h..}......................^..s.....\|..........N....................i.....u..p..{....................R..g......M..Q..S.W.e............................I..............z.....q..Z...............`.Z.U.u.....Z..............t...........s........].....h..d.l....\|.....r........................kw.....................[.......w.......vH.i..P!..................t......)G.............Z`...T3....[....b...................................t...................o...........(.....i....j.g@.B}....................a................................................................................................................................................0........x.........................X....................^...................!..NETSCAPE2.0.....!.......,.... ..........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.*]...P.J.J...X.j....`..K...h.]...p..K...x..........L.....+^....#K.L....3k.....

C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\logi_installer_shared_optionsplus.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9193472
Entropy (8bit):	6.549040290153969
Encrypted:	false
SSDEEP:	98304:A+X2yMeGhmCAfM3D7YWeertxzdFWY/a1C60tpQXGgpr/:AJecmm3D7Reert9dFWY/aCltaXGK
MD5:	61673D5DCF657BD40FB9B45FF633376D
SHA1:	D51C0F800F27D922A56ED4AF649A79A6E44E1CB7
SHA-256:	56DCEC580072D530B5C4859502B2D30B2B2C9DBA2F61C92F50445F28417CD247
SHA-512:	412651EE0E52D7464ACBBAFBAC55C8ADE2743B0F84BB4C4EFD547A8BF8909C634D99EF763C1A5F75FA36425EA3FDEFB08784D05E6B4664ECC2FF60F626122C1B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......:OZv~.4%~.4%~.4%.P.%x.4%.P0$v.4%.P7$x.4%.P5$x.4%.S1$>.4%.p1$t.4%~.4%b.4%&[0$..4%iQ1$u.4%.^0$z.4%wV.%@.4%.S0$.,4%hQ7$..4%hQ0$_.4%.P1$U.4%.^2$\|.4%.^5$[.4%~.5%.-4%hQ1$?/4%hQ4$..4%hQ.%..4%~..%..4%hQ6$..4%Rich~.4%........PE..d......e.........." ...$.Bd...(.......L......................................0............`.........................................P.\|.....L.\|.4....p..H.......\|............ ..h.....t.T.....................t.(.....t.@............`d.@............................text...3Ad......Bd................. ..`.rdata..R....`d......Fd.............@..@.data...pS... }.......\|.............@....pdata..\|...........................@..@CPADinfo8....`......................@....rsrc...H....p......................@..@.reloc..h.... .......@..............@..B................................................................................................................

C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15060496
Entropy (8bit):	7.99595782028495
Encrypted:	true
SSDEEP:	393216:0+lptVYmfr7yBG/4oyFN/YuuccKU9oxcS:0upttD7yBG/PcXU9g5
MD5:	BE433764FA9BBE0F2F9C654F6512C9E0
SHA1:	B87C38D093872D7BE7E191F01107B39C87888A5A
SHA-256:	40EA2955391C9EAE3E35619C4C24B5AAF3D17AEAA6D09424EE9672AA9372AEED
SHA-512:	8A050EBD392654CE5981AF3D0BF99107BFA576529BCE8325A7CCC46F92917515744026A2D0EA49AFB72BBC4E4278638A0677C6596AD96B7019E47C250E438191
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'.u.'.u.'.u.......u.....[.u.....?.u...v.4.u...q.4.u...p...u.....".u....6.u.'.t.v.u...p.l.u....&.u.'..%.u...w.&.u.Rich'.u.........................PE..L......Z.....................v......m.............@..........................p............@..............................................;...............B...0...=.. t..T...................tt......@n..@...................$........................text.............................. ..`.rdata..............................@..@.data...@...........................@....wixburn8...........................@..@.tls................................@....gfids..............................@..@.rsrc....;.......<..................@..@.reloc...=...0...>..................@..B........................................................................................................................................................

C:\ProgramData\Package Cache\.unverified\cab2C04DDC374BD96EB5C8EB8208F2C7C92 (copy)

Download File

Process:	C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe
File Type:	Microsoft Cabinet archive data, many, 5688889 bytes, 14 files, at 0x44 +A "mfc140.dll" +A "mfc140chs.dll", flags 0x4, number 1, extra bytes 20 in head, 380 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	5705657
Entropy (8bit):	7.997088214823493
Encrypted:	true
SSDEEP:	98304:TJncNVoD2JrjTugGqM/Oi2dggyek4+Sz8O9mM51QYECjGMU37R:TySD2tugs2ick4O/M51ZECjGPR
MD5:	EEBCBF53D71F0E5019DE2F658EC94C7F
SHA1:	6D527EBE33DA1AF50E0D62E74834C0667BAFDED6
SHA-256:	048EFE883691244C917A68C0833343E12BB93613EB93831ADB943547A3597E0C
SHA-512:	0832109C420787360AF2ADF44600ECEEE021255B3F9B236FC962BB51D8899DC3834350B96DDFEF438A8654153B57F589F891E9E267D8E34A1453198EF4D58088
Malicious:	false
Reputation:	low
Preview:	MSCF....9.V.....D...........................9.V..A..............\|....EX.......;O. .mfc140.dll......EX...;O. .mfc140chs.dll.....0.X...;O. .mfc140cht.dll..)..H.Y...;O. .mfc140deu.dll.....X.Z...;O. .mfc140enu.dll..%..p.[...;O. .mfc140esn.dll..)....]...;O. .mfc140fra.dll..!...1^...;O. .mfc140ita.dll......R_...;O. .mfc140jpn.dll......+`...;O. .mfc140kor.dll.......a...;O. .mfc140rus.dll...X...b...;O. .mfc140u.dll..........;O.. .mfcm140.dll.....0`....;O.. .mfcm140u.dll.....48..CK.:{\|L.{..d"..5.W.T.x....mC.f.={4. NKi.."eR.C5.92.g.^..sQ..J4$.h'..x.ZD{..t.CE.y`.Z.={......~......o...;F.y%..q..~.^.+.....?:...?.7.+.9.X."..c.93..r..}e....s...^....7G7s....X......k....={..z.7==....8...:.7..Z...~../..z.R....]'......\.>........9.qm..Lpt=[[.~~fv.....#9n._...g.3I.k.z.b#...=.....)g`M..../>Gp\.,.8...,2vSK..}.I<$..0{L8.Gn.%..n.....+M\.{Zp.0.z.\.......<.k?W...y.K}...b.sjE..)....q\|.....P........Xj`....x.3..7m.u........ ...2.gd\S.^6..N....L....IG.3.gh.~3...W..L.......

C:\ProgramData\Package Cache\.unverified\cab5046A8AB272BF37297BB7928664C9503 (copy)

Download File

Process:	C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe
File Type:	Microsoft Cabinet archive data, many, 1505777 bytes, 51 files, at 0x44 +A "api_ms_win_core_console_l1_1_0.dll" +A "api_ms_win_core_datetime_l1_1_0.dll", flags 0x4, number 1, extra bytes 20 in head, 130 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1522785
Entropy (8bit):	7.995909715275866
Encrypted:	true
SSDEEP:	24576:ssN0Z7das2plqMzlvb9oruGL/N6YOOfTRgPVgXIpf/0TOGCQTPr+PaA72drPCaCl:ZI7das2plnzOua/NoOfO9gAkPrsaAErq
MD5:	6D712A35B36AB2B3DACB5174502BCE39
SHA1:	52A92EF8FFB1E096172BB5A86BD4672B0399BCE1
SHA-256:	99A29834AE7F3E1CC6D49458C4957F709F73455726AB28F21F746739C4966C22
SHA-512:	604E091715FC72522936830734A19B4348F7FAF246C6753885FC2B59AD770E609EE6734D0F257459527FAA0B7B71AF08F2A77488FD9CA61514509A5DEAA2CC6A
Malicious:	false
Reputation:	low
Preview:	MSCF............D...........3...................pB...................O........;O. .api_ms_win_core_console_l1_1_0.dll..M...O....;O. .api_ms_win_core_datetime_l1_1_0.dll..M..0.....;O. .api_ms_win_core_debug_l1_1_0.dll..M..H.....;O. .api_ms_win_core_errorhandling_l1_1_0.dll..[..`6....;O. .api_ms_win_core_file_l1_1_0.dll..M..x.....;O. .api_ms_win_core_file_l1_2_0.dll..M........;O. .api_ms_win_core_file_l2_1_0.dll..M...,....;O. .api_ms_win_core_handle_l1_1_0.dll..O...y....;O. .api_ms_win_core_heap_l1_1_0.dll..M........;O. .api_ms_win_core_interlocked_l1_1_0.dll..O........;O. .api_ms_win_core_libraryloader_l1_1_0.dll..W...d....;O. .api_ms_win_core_localization_l1_2_0.dll..O........;O. .api_ms_win_core_memory_l1_1_0.dll..M........;O. .api_ms_win_core_namedpipe_l1_1_0.dll..Q..(X....;O. .api_ms_win_core_processenvironment_l1_1_0.dll..U..@.....;O. .api_ms_win_core_processthreads_l1_1_0.dll..O..P.....;O. .api_ms_win_core_processthreads_l1_1_1.dll..K..hM....;O. .api_ms_win_core_

C:\ProgramData\Package Cache\.unverified\vcRuntimeAdditional_x64 (copy)

Download File

Process:	C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X64 Additional Runtime - 14.24.28127., Template: x64;1033, Revision Number: {1FCB6B93-B382-48B7-9485-A319D74F4F84}, Create Time/Date: Sat Sep 28 04:34:06 2019, Last Saved Time/Date: Sat Sep 28 04:34:06 2019, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	6.370952181269759
Encrypted:	false
SSDEEP:	3072:3viOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJd:3vipBaTDo1j//SZh
MD5:	1E871A0EB07A607D139A51C51FD42905
SHA1:	390AE27A35BDDFC7771D276BFDF2E0333F89D1A6
SHA-256:	057B0C94F2E0296A8999E7D55EFBFB4F4BC3114234607FE40FA5322E20D30489
SHA-512:	FF55CA28EAF9D5A46719374A52111920F8A1EBF1D4E0B038B0DF243458D958803BF51FBCF0F5193BA2C4183D0FAB48154CD16C5FBC9B263FF2666EF2028046B1
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Package Cache\.unverified\vcRuntimeMinimum_x64 (copy)

Download File

Process:	C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.24.28127., Template: x64;1033, Revision Number: {5302C21D-28E2-4694-AA81-CE2C11CA6D8B}, Create Time/Date: Sat Sep 28 04:31:14 2019, Last Saved Time/Date: Sat Sep 28 04:31:14 2019, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
Category:	dropped
Size (bytes):	192512
Entropy (8bit):	6.272664277384492
Encrypted:	false
SSDEEP:	3072:fviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJd8:fvipBaTDo1j//SZh8
MD5:	8AFD17A99D45A0E06F0A3A26CC156972
SHA1:	9087FD5435706A68768F9B8CFB73AFC6C3933935
SHA-256:	7E25CDA9F7D9298DF4C2070D2215C35159A7753DA01440416F37BB361811E173
SHA-512:	BA29CC9EDAB7EEE980D1AA8ECC73E1015AA053C118D9C3595D1736C010300D36C396537AF78A399E347C656C2F5776D20EB81E037614585650E78CE3D66B5792
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Package Cache\{282975d8-55fe-4991-bbbb-06a72581ce58}\VC_redist.x64.exe

Download File

Process:	C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	647904
Entropy (8bit):	7.216534710571963
Encrypted:	false
SSDEEP:	12288:BnMwHskY7gjcjhVIEhqgM7bWvcsi6aVHPIyacHwXK4Qzh+jMlWCEhG:VMysZgjS1hqgSC/izvffHwiz0wyG
MD5:	94970FC3A8ED7B9DE44F4117419CE829
SHA1:	AA1292F049C4173E2AB60B59B62F267FD884D21A
SHA-256:	DE1ACBB1DF68A39A5B966303AC1B609DDE2688B28EBF3EBA8D2ADEEB3D90BF5E
SHA-512:	B17BD215B83BFA46512B73C3D9F430806CA3BEA13BEBDE971E8EDD972614E54A7BA3D6FC3439078CDFDAA7EEB1F3F9054BF03ED5C45B622B691B968D4EC0566F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'.u.'.u.'.u.......u.....[.u.....?.u...v.4.u...q.4.u...p...u.....".u....6.u.'.t.v.u...p.l.u....&.u.'..%.u...w.&.u.Rich'.u.........................PE..L......Z.....................v......m.............@..........................p.......r....@..............................................;...............$...0...=.. t..T...................tt......@n..@...................$........................text.............................. ..`.rdata..............................@..@.data...@...........................@....wixburn8...........................@..@.tls................................@....gfids..............................@..@.rsrc....;.......<..................@..@.reloc...=...0...>..................@..B........................................................................................................................................................

C:\ProgramData\Package Cache\{282975d8-55fe-4991-bbbb-06a72581ce58}\state.rsm

Download File

Process:	C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe
File Type:	data
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	2.842209069426475
Encrypted:	false
SSDEEP:	12:7ZK34pgMClGttDa+xU9m4YSYttun2QSbAlyuh7pBUBl5yuMqT6un2QM0bAlyuh7A:lKUgMClccD/uAlLG7lMqEgAlLG7lM
MD5:	8C64FEE149F9A73FDD25F2FBF0C845FE
SHA1:	9D3126F33AD561A059194C1DB7A946995FD0683D
SHA-256:	C0068A5E56B4B362DF4F04A744F92845DA48E90860CFF8124C248A70EDD8881D
SHA-512:	270D68DFC43127615335003D1C0904A401DF9359E1F2C0E717DF749ADACC3700B49EC2A2375ECC9AB2017B060D1445151DAD7CFEFC237B10D838D8C130C396B5
Malicious:	false
Reputation:	low
Preview:	J...............................................................................................................................................................................................................................................W.i.x.B.u.n.d.l.e.F.o.r.c.e.d.R.e.s.t.a.r.t.P.a.c.k.a.g.e.....................W.i.x.B.u.n.d.l.e.L.a.s.t.U.s.e.d.S.o.u.r.c.e.................................W.i.x.B.u.n.d.l.e.N.a.m.e.....B...M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.5.-.2.0.1.9. .R.e.d.i.s.t.r.i.b.u.t.a.b.l.e. .(.x.6.4.). .-. .1.4...2.4...2.8.1.2.7.............W.i.x.B.u.n.d.l.e.O.r.i.g.i.n.a.l.S.o.u.r.c.e.....f...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.L.o.g.i.s.h.r.d.\.{.6.b.7.4.5.5.a.e.-.a.3.2.a.-.4.c.6.f.-.8.6.5.1.-.d.a.4.9.6.9.0.9.7.6.0.4.}._.l.o.g.i.o.p.t.i.o.n.s.p.l.u.s._.s.e.t.u.p.\.v.c._.r.e.d.i.s.t...x.6.4...e.x.e.............W.i.x.B.u.n.d.l.e.O.r.i.g.i.n.a.l.S.o.u.r.c.e.F.o.l.d.e.r.....U...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.L.o.g.i.s.h.r.d.\.{.6.b.7.4.5.5.a.e.-.a.3.2.a.-.4.c.6.f.-.8.

C:\ProgramData\Package Cache\{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}v14.24.28127\packages\vcRuntimeMinimum_amd64\cab1.cab (copy)

Download File

Process:	C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe
File Type:	Microsoft Cabinet archive data, many, 1505777 bytes, 51 files, at 0x44 +A "api_ms_win_core_console_l1_1_0.dll" +A "api_ms_win_core_datetime_l1_1_0.dll", flags 0x4, number 1, extra bytes 20 in head, 130 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1522785
Entropy (8bit):	7.995909715275866
Encrypted:	true
SSDEEP:	24576:ssN0Z7das2plqMzlvb9oruGL/N6YOOfTRgPVgXIpf/0TOGCQTPr+PaA72drPCaCl:ZI7das2plnzOua/NoOfO9gAkPrsaAErq
MD5:	6D712A35B36AB2B3DACB5174502BCE39
SHA1:	52A92EF8FFB1E096172BB5A86BD4672B0399BCE1
SHA-256:	99A29834AE7F3E1CC6D49458C4957F709F73455726AB28F21F746739C4966C22
SHA-512:	604E091715FC72522936830734A19B4348F7FAF246C6753885FC2B59AD770E609EE6734D0F257459527FAA0B7B71AF08F2A77488FD9CA61514509A5DEAA2CC6A
Malicious:	false
Reputation:	low
Preview:	MSCF............D...........3...................pB...................O........;O. .api_ms_win_core_console_l1_1_0.dll..M...O....;O. .api_ms_win_core_datetime_l1_1_0.dll..M..0.....;O. .api_ms_win_core_debug_l1_1_0.dll..M..H.....;O. .api_ms_win_core_errorhandling_l1_1_0.dll..[..`6....;O. .api_ms_win_core_file_l1_1_0.dll..M..x.....;O. .api_ms_win_core_file_l1_2_0.dll..M........;O. .api_ms_win_core_file_l2_1_0.dll..M...,....;O. .api_ms_win_core_handle_l1_1_0.dll..O...y....;O. .api_ms_win_core_heap_l1_1_0.dll..M........;O. .api_ms_win_core_interlocked_l1_1_0.dll..O........;O. .api_ms_win_core_libraryloader_l1_1_0.dll..W...d....;O. .api_ms_win_core_localization_l1_2_0.dll..O........;O. .api_ms_win_core_memory_l1_1_0.dll..M........;O. .api_ms_win_core_namedpipe_l1_1_0.dll..Q..(X....;O. .api_ms_win_core_processenvironment_l1_1_0.dll..U..@.....;O. .api_ms_win_core_processthreads_l1_1_0.dll..O..P.....;O. .api_ms_win_core_processthreads_l1_1_1.dll..K..hM....;O. .api_ms_win_core_

C:\ProgramData\Package Cache\{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}v14.24.28127\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi (copy)

Download File

Process:	C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.24.28127., Template: x64;1033, Revision Number: {5302C21D-28E2-4694-AA81-CE2C11CA6D8B}, Create Time/Date: Sat Sep 28 04:31:14 2019, Last Saved Time/Date: Sat Sep 28 04:31:14 2019, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
Category:	dropped
Size (bytes):	192512
Entropy (8bit):	6.272664277384492
Encrypted:	false
SSDEEP:	3072:fviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJd8:fvipBaTDo1j//SZh8
MD5:	8AFD17A99D45A0E06F0A3A26CC156972
SHA1:	9087FD5435706A68768F9B8CFB73AFC6C3933935
SHA-256:	7E25CDA9F7D9298DF4C2070D2215C35159A7753DA01440416F37BB361811E173
SHA-512:	BA29CC9EDAB7EEE980D1AA8ECC73E1015AA053C118D9C3595D1736C010300D36C396537AF78A399E347C656C2F5776D20EB81E037614585650E78CE3D66B5792
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Package Cache\{8678BA04-D161-45BE-ACA4-CC5D13073F35}v14.24.28127\packages\vcRuntimeAdditional_amd64\cab1.cab (copy)

Download File

Process:	C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe
File Type:	Microsoft Cabinet archive data, many, 5688889 bytes, 14 files, at 0x44 +A "mfc140.dll" +A "mfc140chs.dll", flags 0x4, number 1, extra bytes 20 in head, 380 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	5705657
Entropy (8bit):	7.997088214823493
Encrypted:	true
SSDEEP:	98304:TJncNVoD2JrjTugGqM/Oi2dggyek4+Sz8O9mM51QYECjGMU37R:TySD2tugs2ick4O/M51ZECjGPR
MD5:	EEBCBF53D71F0E5019DE2F658EC94C7F
SHA1:	6D527EBE33DA1AF50E0D62E74834C0667BAFDED6
SHA-256:	048EFE883691244C917A68C0833343E12BB93613EB93831ADB943547A3597E0C
SHA-512:	0832109C420787360AF2ADF44600ECEEE021255B3F9B236FC962BB51D8899DC3834350B96DDFEF438A8654153B57F589F891E9E267D8E34A1453198EF4D58088
Malicious:	false
Reputation:	low
Preview:	MSCF....9.V.....D...........................9.V..A..............\|....EX.......;O. .mfc140.dll......EX...;O. .mfc140chs.dll.....0.X...;O. .mfc140cht.dll..)..H.Y...;O. .mfc140deu.dll.....X.Z...;O. .mfc140enu.dll..%..p.[...;O. .mfc140esn.dll..)....]...;O. .mfc140fra.dll..!...1^...;O. .mfc140ita.dll......R_...;O. .mfc140jpn.dll......+`...;O. .mfc140kor.dll.......a...;O. .mfc140rus.dll...X...b...;O. .mfc140u.dll..........;O.. .mfcm140.dll.....0`....;O.. .mfcm140u.dll.....48..CK.:{\|L.{..d"..5.W.T.x....mC.f.={4. NKi.."eR.C5.92.g.^..sQ..J4$.h'..x.ZD{..t.CE.y`.Z.={......~......o...;F.y%..q..~.^.+.....?:...?.7.+.9.X."..c.93..r..}e....s...^....7G7s....X......k....={..z.7==....8...:.7..Z...~../..z.R....]'......\.>........9.qm..Lpt=[[.~~fv.....#9n._...g.3I.k.z.b#...=.....)g`M..../>Gp\.,.8...,2vSK..}.I<$..0{L8.Gn.%..n.....+M\.{Zp.0.z.\.......<.k?W...y.K}...b.sjE..)....q\|.....P........Xj`....x.3..7m.u........ ...2.gd\S.^6..N....L....IG.3.gh.~3...W..L.......

C:\ProgramData\Package Cache\{8678BA04-D161-45BE-ACA4-CC5D13073F35}v14.24.28127\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi (copy)

Download File

Process:	C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X64 Additional Runtime - 14.24.28127., Template: x64;1033, Revision Number: {1FCB6B93-B382-48B7-9485-A319D74F4F84}, Create Time/Date: Sat Sep 28 04:34:06 2019, Last Saved Time/Date: Sat Sep 28 04:34:06 2019, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	6.370952181269759
Encrypted:	false
SSDEEP:	3072:3viOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJd:3vipBaTDo1j//SZh
MD5:	1E871A0EB07A607D139A51C51FD42905
SHA1:	390AE27A35BDDFC7771D276BFDF2E0333F89D1A6
SHA-256:	057B0C94F2E0296A8999E7D55EFBFB4F4BC3114234607FE40FA5322E20D30489
SHA-512:	FF55CA28EAF9D5A46719374A52111920F8A1EBF1D4E0B038B0DF243458D958803BF51FBCF0F5193BA2C4183D0FAB48154CD16C5FBC9B263FF2666EF2028046B1
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20240326163939.log

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	ASCII text, with very long lines (323), with CRLF line terminators
Category:	dropped
Size (bytes):	16908
Entropy (8bit):	5.551323610782874
Encrypted:	false
SSDEEP:	192:LVsXBnZ1V1b1Y1k1L1x121lAgZmGUcZb8jNj9JRfz00zywQnYn+ozCulEX:LVsZOAgZQ4b8hJJpDEozCuEX
MD5:	B270DF305D8FDE81B63021C7E9D9C726
SHA1:	BDE9B97282996F495A2C508D84685015147FF5A7
SHA-256:	E1A7149829221B0EE1F07E2DADC1A95D60A856B29E191061392AE5E1B05210CD
SHA-512:	E6FC222FD9A8E4294EE7549133046658FA620597229F3F12DA56E1E99F52DBD0249D4E7A7EF251EB91ACFF01EDFFD335027E09170F2E68ADF252E1DE86E6014A
Malicious:	false
Reputation:	low
Preview:	[0E9C:1B84][2024-03-26T16:39:39]i001: Burn v3.10.4.4718, Windows v10.0 (Build 19042: Service Pack 0), path: C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe..[0E9C:1B84][2024-03-26T16:39:39]i009: Command Line: '-burn.clean.room=C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe -burn.filehandle.attached=532 -burn.filehandle.self=528 /install /quiet /norestart'..[0E9C:1B84][2024-03-26T16:39:39]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe'..[0E9C:1B84][2024-03-26T16:39:39]i000: Setting string variable 'WixBundleOriginalSourceFolder' to value 'C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\'..[0E9C:1B84][2024-03-26T16:39:39]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20240326163939.log'..

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20240326163939_000_vcRuntimeMinimum_x64.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (319), with CRLF line terminators
Category:	dropped
Size (bytes):	134898
Entropy (8bit):	3.830859366780662
Encrypted:	false
SSDEEP:	1536:95dePpDrZggK3kOVzfW/4hix5OGp3f34PUk3nHClIj7o2ooooooooo449NtY5:9xJj7Vooooooooo449NtK
MD5:	C0052BD90AF0C8F64B5D962556F8BE6B
SHA1:	903848AAB5C8A919A7F0DB5EAD2148C6B38164EA
SHA-256:	E0904B98305F9CD7DAFBB4388F02EE69F31D623E7672EE2A2FF1102EDF4A7EAE
SHA-512:	F322A3D580629A390B09FDB9FDE656F3B5E7A189D79F662065CFE966321C7A85DA38A2211E4221614C8193BBE48DC0EEEC9B1711CD0F4AD1D2DCB8BB0463668E
Malicious:	false
Reputation:	low
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .2.6./.0.3./.2.0.2.4. . .1.6.:.3.9.:.4.0. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.{.2.0.9.F.F.B.A.C.-.C.0.6.D.-.4.1.9.7.-.A.9.5.5.-.9.2.B.5.A.1.6.A.C.5.2.3.}.\...b.e.\.V.C._.r.e.d.i.s.t...x.6.4...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.8.0.:.C.0.). .[.1.6.:.3.9.:.4.0.:.9.0.0.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.8.0.:.C.0.). .[.1.6.:.3.9.:.4.0.:.9.0.0.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .0.....M.S.I. .(.c.). .(.8.0.:.C.0.). .[.1.6.:.3.9.:.4.0.:.9.0.0.].:. ........ .R.u.n.E.n.g.i.n.e.:..... . . . . . . . . . . ........ .P.r.o.d.u.c.t.:. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.P.a.c.k.a.g.e. .C.a.c.h.e.\.{.7.D.C.3.8.7.B.8.-.E.6.A.2.-.4.8.0.C.-.8.E.F.9.-.A.6.E.5.1.A.E.8.1.C.1.9.}.v.1.4...2.4...2.8.1.2.7.\.p.a.c.k.a.g.e.s.\.v.c.R.u.n.t.i.m.e.

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20240326163939_001_vcRuntimeAdditional_x64.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (411), with CRLF line terminators
Category:	dropped
Size (bytes):	133676
Entropy (8bit):	3.8305616352158376
Encrypted:	false
SSDEEP:	3072:mcZj9p+GGGGGGGGGGGGGLDbwu8fs389IQzMefE:DjJ
MD5:	F4371312B5DB0D92B5EA2E3014A415FB
SHA1:	1E5A0C98F429E558DBB2A290FEC2253D6F016E85
SHA-256:	A0D57A5B86A222586DE1FCE371F46099007CB83F0CBF28439BDE64868B89AE66
SHA-512:	082F2DFE7217A634B8F1FDE3E2D0C38D0B4B5C740092855A3E64E59D5C13AF4937C05B1AAC71125D127746E103B0176EEEF8F876CA3F4AD704510332F238EA7B
Malicious:	false
Reputation:	low
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .2.6./.0.3./.2.0.2.4. . .1.6.:.3.9.:.4.2. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.{.2.0.9.F.F.B.A.C.-.C.0.6.D.-.4.1.9.7.-.A.9.5.5.-.9.2.B.5.A.1.6.A.C.5.2.3.}.\...b.e.\.V.C._.r.e.d.i.s.t...x.6.4...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.8.0.:.4.0.). .[.1.6.:.3.9.:.4.2.:.1.6.8.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.8.0.:.4.0.). .[.1.6.:.3.9.:.4.2.:.1.6.8.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .0.....M.S.I. .(.c.). .(.8.0.:.4.0.). .[.1.6.:.3.9.:.4.2.:.1.6.8.].:. ........ .R.u.n.E.n.g.i.n.e.:..... . . . . . . . . . . ........ .P.r.o.d.u.c.t.:. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.P.a.c.k.a.g.e. .C.a.c.h.e.\.{.8.6.7.8.B.A.0.4.-.D.1.6.1.-.4.5.B.E.-.A.C.A.4.-.C.C.5.D.1.3.0.7.3.F.3.5.}.v.1.4...2.4...2.8.1.2.7.\.p.a.c.k.a.g.e.s.\.v.c.R.u.n.t.i.m.e.

C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe

Download File

Process:	C:\Users\user\Downloads\logioptionsplus_installer.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	29747968
Entropy (8bit):	7.6769433621099425
Encrypted:	false
SSDEEP:	393216:6nsqS5Gwb6+lptVYmfr7yBG/4oyFN/YuuccKU9oxcS2MMcmm3D7geRjFWY/aClti:6n+5GU6upttD7yBG/PcXU9g55Mhm3bQ
MD5:	AE8C1F75DCE5968EB9634E5A1E2C9E56
SHA1:	C698AB5F0AF335A08971606E783CF89F42B27F63
SHA-256:	A2BFE42192FBDD2EED1FE65C795EB89BB322AF5003211377B5E93790CB056C46
SHA-512:	0761317444C9BCD371150AC8CE2581A9A06D0604C37A575D56482071AD33E6C5322B4BB1FFCADE04E38839B71C3BB95793511F3DACFC68CDEE96C0DF9CE6897E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......e.........."...0..d...\........... .....@..... ..............................n.....`...@......@............... ..................................L[...............)........................................................................... ..H............text....c... ...d.................. ..`.rsrc...L[.......\...f..............@..@........................................H.......................8................................................0..........~M...~S...o....o...., ~M...~S...o....o.......o....,..~M...~S...o....o....o....,%~M...~S...o....o....o.......o....,..~M...r...po.......o....,.....0..f8......s....%.r...po ...%.r#..po ...%.rq..po ...%.r...po ...%.r...po ...%.r...po ...%.r...po ...%.r...po ...%.r!..po ...%..rY..po ...%..r...po ...%..r...po ...%..r...po ...%..r=..po ...%..r...po ...%..r...po ...%..r...po ...%..r...po ...%..ro..po ...%

C:\Users\user\Downloads\0d281a76-4c68-45b6-b4fa-575fcee7f44b.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	6.0994749815162494
Encrypted:	false
SSDEEP:	384:EPXqFlx7qFpGHqBI4AqpfrF3gWN/itOkilVzfwDJzq2egnA7CqvJX/K8cJwBQJ3C:EPGN8fkeymCSx
MD5:	DF37FBAEC53F1DD2199DE1646B67B55E
SHA1:	ED2D2356D3F4E9C0EC74E3129E83EF105ED16994
SHA-256:	72F5D810E297A7A8CACD9967E7884D007D2D9F6440C4C136E098C9E4662A7479
SHA-512:	FA00B2489BBFD8E2688DD48788CC21F2FAF81C161D9B3A60738E909B7F6404B7D7A9EE275E93AB1024378050E296CBC1B4C47024A441896A558B415130C08685
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#...gg..gg..gg..n. .]g......`g..gg...g......1g......wg......og.......g......kg......rg..q...ng..q.L.fg..gg$.fg..q...fg..Richgg..........................PE..d......e.........."....$............x`.........@..........................................`.....................................................D........M... ..LD.......)......t.... .......................!..(.......@............................................text............................... ..`.rdata..:...........................@..@.data...4=.......$..................@....pdata..LD... ...F..................@..@SHARED.......p.......*..............@..._RDATA..\............,..............@..@.rsrc....M.......N..................@..@.reloc..t............\|..............@..B........................................................................................................................................

C:\Users\user\Downloads\Unconfirmed 521320.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30454528
Entropy (8bit):	7.662632911697404
Encrypted:	false
SSDEEP:	393216:oznsqS5Gwb6+lptVYmfr7yBG/4oyFN/YuuccKU9oxcS2MMcmm3D7geRjFWY/aClK:ozn+5GU6upttD7yBG/PcXU9g55Mhm3bq
MD5:	43D5805571B019C67F965C749AD18AA1
SHA1:	BFF43969B3F58FDDFF391DC2882E5F9A165D497A
SHA-256:	CB4A77594158CA821DEF348B1640F63DBB080FA99634F007B16751111505CEBD
SHA-512:	B4EC470E77AC2EAC70C70BD5E1A00168659E0BB7089D168D836C01DCD5D883106847B2CAECCBFA97AA8BB586ECF5CD543BE8107656AB86BBCCF2146799DF3CA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#...gg..gg..gg..n. .]g......`g..gg...g......1g......wg......og.......g......kg......rg..q...ng..q.L.fg..gg$.fg..q...fg..Richgg..........................PE..d......e.........."....$............x`.........@..........................................`.....................................................D........M... ..LD.......)......t.... .......................!..(.......@............................................text............................... ..`.rdata..:...........................@..@.data...4=.......$..................@....pdata..LD... ...F..................@..@SHARED.......p.......*..............@..._RDATA..\............,..............@..@.rsrc....M.......N..................@..@.reloc..t............\|..............@..B........................................................................................................................................

C:\Users\user\Downloads\logioptionsplus_installer.exe (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30454528
Entropy (8bit):	7.662632911697404
Encrypted:	false
SSDEEP:	393216:oznsqS5Gwb6+lptVYmfr7yBG/4oyFN/YuuccKU9oxcS2MMcmm3D7geRjFWY/aClK:ozn+5GU6upttD7yBG/PcXU9g55Mhm3bq
MD5:	43D5805571B019C67F965C749AD18AA1
SHA1:	BFF43969B3F58FDDFF391DC2882E5F9A165D497A
SHA-256:	CB4A77594158CA821DEF348B1640F63DBB080FA99634F007B16751111505CEBD
SHA-512:	B4EC470E77AC2EAC70C70BD5E1A00168659E0BB7089D168D836C01DCD5D883106847B2CAECCBFA97AA8BB586ECF5CD543BE8107656AB86BBCCF2146799DF3CA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#...gg..gg..gg..n. .]g......`g..gg...g......1g......wg......og.......g......kg......rg..q...ng..q.L.fg..gg$.fg..q...fg..Richgg..........................PE..d......e.........."....$............x`.........@..........................................`.....................................................D........M... ..LD.......)......t.... .......................!..(.......@............................................text............................... ..`.rdata..:...........................@..@.data...4=.......$..................@....pdata..LD... ...F..................@..@SHARED.......p.......*..............@..._RDATA..\............,..............@..@.rsrc....M.......N..................@..@.reloc..t............\|..............@..B........................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\concrt140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	333592
Entropy (8bit):	6.2250246412576855
Encrypted:	false
SSDEEP:	6144:1ndGd0wl7XIbBx5C9YtkO2MUWghMWbGynWzgcZ6rO4i47:zCpIRC6tcG5zKiU
MD5:	EB42B164D603672E07997019BB00E4AD
SHA1:	9F73F2323B167215874A7D3DD4A7F7750312F219
SHA-256:	DABDB0732B2FC14040CEDBBFD369D9EB3C7A2E66B38A79892E1C05E6D6A8526D
SHA-512:	1E74EA24BFCAA5DD1EF0654A45F96C99900DBFCA406BCFB73AE3ABFDAD7C1D0D12E773817A9AB3FD8D1D927A85D5FA6447B3C521192DCCF33957F5BEA00B3CC8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z.l.).l.).l.)$..).l.)..j).l.)E..(.l.).l.).l.)E..(.l.)E..(.l.)E..(.l.)E..(.l.)E..).l.)E..(.l.)Rich.l.)........................PE..d....h.].........." .................................................................u....`A.............................................M...X.................. 7.......A......l....l..8............................l...............................................text...L........................... ..`.rdata...j.......l..................@..@.data....?...p...8...V..............@....pdata.. 7.......8..................@..@.rsrc...............................@..@.reloc..l...........................@..B................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	618264
Entropy (8bit):	6.364904733913565
Encrypted:	false
SSDEEP:	12288:ttc7Tg4ObbZu3JZfzeUQEKZm+jWodEEVTMj:U7Tg4+Zu3jJQEKZm+jWodEEVMj
MD5:	A1D30EF2114E18E26E2BB96555BE81BF
SHA1:	A5E3E5A5910DD0781CAF0A9F58DD7B519DE8C927
SHA-256:	F87819AE8C6F7C90D3237A1ABB9809E8CBA9DCD0C80AC3F0969A5E68EF652CA4
SHA-512:	5C5BDAE87327B3FB724844087257A0BA0E7AD31C194AB5F632845E8F09633F63982817CA551D1735523B1A65763EFA3C2DDC8789B3BF23324D7882456E3AA6F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wt.33.{`3.{`3.{`...`1.{`:m.`%.{`3.z`..{`.xza0.{`.x.a;.{`.xxa0.{`.x~a..{`.x{a2.{`.x.`2.{`.xya2.{`Rich3.{`................PE..d....h.].........." .........P............................................................`A............................................h...H........p...........@.......A..............8.......................................................@....................text............................... ..`.rdata..............................@..@.data....:..........................@....pdata...@.......B..................@..@.didat..h....`......................@....rsrc........p......................@..@.reloc............... ..............@..B................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140_1.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31512
Entropy (8bit):	6.482032898193078
Encrypted:	false
SSDEEP:	384:6i/3lk2SyA04U9Kqnd5ZWcR5gW546QpBj0HRN73YxQHRN7MCMlvz:bObyl4+Kqd5DPXqW3Yx8A
MD5:	A0B595F95BE9CCE12BFF7EF199F874C4
SHA1:	7FC5F91033CD83F11CE03AB2478D9B29036E6535
SHA-256:	B05F3DFD4E999C3E110219FB59151CBAA322757F4F3CE52B64DDDC853E5C105C
SHA-512:	182A0CC4227AFB43228EBE5033977FCFB4C8EBB2F047D2DECFAB8F33453FD2262E62DD80B2B0F34CDED9A8EE784D7449120A000AEB1949642BDF8CC563282B8E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0"3.tC].tC].tC]....vC].};.pC]...Y.sC]...^.uC].tC\._C]...\.qC]...X.gC]...].uC].....uC]..._.uC].RichtC].........PE..d....h.].........." .........$......p...............................................>.....`A........................................0>..L...\|?..x....p.......`..L....:...A......d...@3..8............................3...............0..@............................text...T........................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..L....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..d............8..............@..B................................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140_2.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	203544
Entropy (8bit):	6.524738965377334
Encrypted:	false
SSDEEP:	3072:0m2dow+wS2vEYFBeoVM4ZaeEQDjQdA05+TiIfH+YKpHANGbaQLvaOvV:0xhbBFBnPZTL0mfiAN9Q7aOd
MD5:	BBCF50B71928EDB1C32C969D0533753C
SHA1:	FACA1DB3873D478B17FC6791B94FAE651202627A
SHA-256:	7D5D180C8E41B1964835B2550191E2D9054D8F4BEFF898ADE67B3D5DD25B5101
SHA-512:	E3890679D21E76A19361CC181EDA9323BA31FB1211124E40FA3C9834CB0BFAB6F7B3B34CF349EE4D7B3CC10E50813AE728DD01DD254EEE098F3971F07679D710
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.C!..C!..C!....c.A!..JY..O!..L..K!..L..A!..C!..+!..L..F!..L..W!..L..B!..Ls.B!..L..B!..RichC!..........................PE..d....h.].........." ................`........................................ ......X.....`A........................................@...................................A...........j..8...........................0k..................@............................text............................... ..`.rdata..d...........................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\msvcp140_codecvt_ids.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27416
Entropy (8bit):	6.632124616879162
Encrypted:	false
SSDEEP:	384:OTDpEPOCAbHWi/EWz46QpBj0HRN7bX8QHRN7ep1x09lT9D:qNEFa1XqWbX88epQD
MD5:	E42F86965CEB093D95B9C93BD87B179D
SHA1:	4184B271261B3EB9C0193E5E6874B8847B18DC22
SHA-256:	1E56CEE876940AFFE9883AECCEE9132280D03FD4282AB6552ADF75FBEEED2BAC
SHA-512:	6B355D468FD8214CF50CEF7D30A9098C812B60F0215726DA937361E0CF2D2B8362AE5BC2B88C5E8DD48298C13B1BE1A52D7F68D075C2A8D9C93480354B0E8420
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v....L...L...LYj.L...L.L...L...L...L8..M...L8..M...L8..M...L8..M...L8..M...L8..L...L8..M...LRich...L........PE..d....h.].........." ................ ........................................p......D.....`A.........................................&..0... (..P....P..0....@..t....*...A...`......`!..8............................!............... ...............................text...$........................... ..`.rdata....... ......................@..@.data........0......................@....pdata..t....@....... ..............@..@.rsrc...0....P......."..............@..@.reloc.......`.......(..............@..B................................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\vccorlib140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	366360
Entropy (8bit):	5.892148382940522
Encrypted:	false
SSDEEP:	3072:WB16MsQd1V0rSJkRd2Ygeu1qs93J2FooJafVMkZuP9Dy4s5zTG22+xF0KA6ppDwQ:WBXT1V0WojDy4s5MQV0jm
MD5:	DDD9457EF184CC3897B8198D262F4339
SHA1:	964BB431D74DEC7E0957E62F45822CFCF2E1BEA0
SHA-256:	41B6AF9484C860804C69E00C9D7FEE22EFE5F769C51355936FC9DE248221DE94
SHA-512:	0319E603DFFBD78B43ED7CA676A51E760E49D43120AC76756222C0E2B0F03CFF6ED7F0269FA3CDB2875B41979A23B9B70EB2BA3672A50951F85A12A4CC52A1CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;...Zy.Zy.Zy."..Zy.a7x.Zy.a7\|.Zy.a7}.Zy.a7z.Zy....Zy.Zx..Zy.a7p.Zy.a7y.Zy.a7..Zy.a7{.Zy.Rich.Zy.........PE..d....j.].........." .................y..............................................j.....`A.........................................3...>..4r.......p.......@..."...V...A..........@...8............................................................................text...o........................... ..`.rdata..r...........................@..@.data................l..............@....pdata..."...@...$..................@..@.rsrc........p.......6..............@..@.reloc...............:..............@..B........................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\vcruntime140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	89880
Entropy (8bit):	6.5375654036547255
Encrypted:	false
SSDEEP:	1536:fTSVLL1/VfZPtsO6nBy0r8Z3j5X7K0d4HIH8d2//zoXnf7toecbNCOAS7Z:fW/tB8n8F4i/LoXfeecbNCA
MD5:	23105A395B807D9335219958B4D0CEC1
SHA1:	FB60050D82E3BC1BE3B10877B9355F5D48E04854
SHA-256:	61832990E364DCA5BFA2C61D930F00ACAAE6D1AAA3130392403455AE9A1125A5
SHA-512:	EF91D19E632D0D146FA68D52BEB04FFCB9B972079CD9C255F44EA5201637A8B00907EC8E3358C7B5CC37338470E29E43DBAEC7DDC0562810B49AB2E8115CC805
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8O.q\|.."\|.."\|..".)"~.."uVU"w.."\|.."P..".C.#p..".C.#l..".C.#b..".C.#}..".C9"}..".C.#}.."Rich\|.."................PE..d....h.].........." .........Z...............................................p......y$....`A............................................4............P.......0...........A...`......0...8...........................p................................................text............................... ..`.rdata...<.......>..................@..@.data........ ......................@....pdata.......0......................@..@_RDATA.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\8B783CD72A6EC084E89F6A5EA18EC191\14.24.28127\vcruntime140_1.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44312
Entropy (8bit):	6.623047237297825
Encrypted:	false
SSDEEP:	768:vG3xRsJTKdiibUoT2zvivbXXyJWqWZ8DZX:vG7DyM22DiJMCtX
MD5:	9040ED0FDF4CE7558CBFFB73D4C17761
SHA1:	669C8380959984CC62B05535C18836F815308362
SHA-256:	6CC4315DACEB0522816C60678344466CB452426267F70C7FAAE925361674E774
SHA-512:	303143006C781260540E9D0D3739ACC33F2D54F884358C7485599DD22B87CCE9B81F68D6AD80F0F5BB1798CE54A79677152C1D3600E443E192AECD442EA0A2E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j&=..Hn..Hn..Hn@..n..Hn!fIo..Hn.s.n..Hn..In..Hn!fKo..Hn!fLo..Hn!fMo..Hn!fHo..Hn!f.n..Hn!fJo..HnRich..Hn........PE..d....h.].........." .....:...4.......A..............................................?.....`A.........................................j......<k..x....................l...A......(....a..8...........................0b...............P..X............................text...t9.......:.................. ..`.rdata..P ...P..."...>..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..(............j..............@..B................................................................................................................................................................................................................................................................

C:\Windows\Installer\90cbdf.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.24.28127., Template: x64;1033, Revision Number: {5302C21D-28E2-4694-AA81-CE2C11CA6D8B}, Create Time/Date: Sat Sep 28 04:31:14 2019, Last Saved Time/Date: Sat Sep 28 04:31:14 2019, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
Category:	dropped
Size (bytes):	192512
Entropy (8bit):	6.272664277384492
Encrypted:	false
SSDEEP:	3072:fviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJd8:fvipBaTDo1j//SZh8
MD5:	8AFD17A99D45A0E06F0A3A26CC156972
SHA1:	9087FD5435706A68768F9B8CFB73AFC6C3933935
SHA-256:	7E25CDA9F7D9298DF4C2070D2215C35159A7753DA01440416F37BB361811E173
SHA-512:	BA29CC9EDAB7EEE980D1AA8ECC73E1015AA053C118D9C3595D1736C010300D36C396537AF78A399E347C656C2F5776D20EB81E037614585650E78CE3D66B5792
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\90cbe2.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.24.28127., Template: x64;1033, Revision Number: {5302C21D-28E2-4694-AA81-CE2C11CA6D8B}, Create Time/Date: Sat Sep 28 04:31:14 2019, Last Saved Time/Date: Sat Sep 28 04:31:14 2019, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
Category:	dropped
Size (bytes):	192512
Entropy (8bit):	6.272664277384492
Encrypted:	false
SSDEEP:	3072:fviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJd8:fvipBaTDo1j//SZh8
MD5:	8AFD17A99D45A0E06F0A3A26CC156972
SHA1:	9087FD5435706A68768F9B8CFB73AFC6C3933935
SHA-256:	7E25CDA9F7D9298DF4C2070D2215C35159A7753DA01440416F37BB361811E173
SHA-512:	BA29CC9EDAB7EEE980D1AA8ECC73E1015AA053C118D9C3595D1736C010300D36C396537AF78A399E347C656C2F5776D20EB81E037614585650E78CE3D66B5792
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\90cbe3.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X64 Additional Runtime - 14.24.28127., Template: x64;1033, Revision Number: {1FCB6B93-B382-48B7-9485-A319D74F4F84}, Create Time/Date: Sat Sep 28 04:34:06 2019, Last Saved Time/Date: Sat Sep 28 04:34:06 2019, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	6.370952181269759
Encrypted:	false
SSDEEP:	3072:3viOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJd:3vipBaTDo1j//SZh
MD5:	1E871A0EB07A607D139A51C51FD42905
SHA1:	390AE27A35BDDFC7771D276BFDF2E0333F89D1A6
SHA-256:	057B0C94F2E0296A8999E7D55EFBFB4F4BC3114234607FE40FA5322E20D30489
SHA-512:	FF55CA28EAF9D5A46719374A52111920F8A1EBF1D4E0B038B0DF243458D958803BF51FBCF0F5193BA2C4183D0FAB48154CD16C5FBC9B263FF2666EF2028046B1
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\90cbe6.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X64 Additional Runtime - 14.24.28127., Template: x64;1033, Revision Number: {1FCB6B93-B382-48B7-9485-A319D74F4F84}, Create Time/Date: Sat Sep 28 04:34:06 2019, Last Saved Time/Date: Sat Sep 28 04:34:06 2019, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	6.370952181269759
Encrypted:	false
SSDEEP:	3072:3viOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJd:3vipBaTDo1j//SZh
MD5:	1E871A0EB07A607D139A51C51FD42905
SHA1:	390AE27A35BDDFC7771D276BFDF2E0333F89D1A6
SHA-256:	057B0C94F2E0296A8999E7D55EFBFB4F4BC3114234607FE40FA5322E20D30489
SHA-512:	FF55CA28EAF9D5A46719374A52111920F8A1EBF1D4E0B038B0DF243458D958803BF51FBCF0F5193BA2C4183D0FAB48154CD16C5FBC9B263FF2666EF2028046B1
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICCF8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	8857
Entropy (8bit):	5.660127886364669
Encrypted:	false
SSDEEP:	96:NLqDp6rDp1050uka7EdgEnUygtE8M8M8M8M8M8M8M8M8M8VuHxxTce2DpAe0oSeU:hemsN2xfrkhBjeQ3aWcbD
MD5:	948F967030DAFCF2EF1A9FAA2947D86C
SHA1:	30BCBDDF26090B9571ED3B3018CB85EB2700B74D
SHA-256:	5F16BD6FF5D7729369156812B17FD4263795111FBB562ED2624B4884008DA2E3
SHA-512:	FD23FBC565B31EBE7B2787435E02AF84CA8C8ECF457C7D814FDB549045DBE1B837D97C2EF9002966537DC2E40B5F2085C6CF02D914F8FD5208CD1660C2F124AB
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@..zX.@.....@.....@.....@.....@.....@......&.{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19};.Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.24.28127..vc_runtimeMinimum_x64.msi.@.....@.m...@.....@........&.{5302C21D-28E2-4694-AA81-CE2C11CA6D8B}.....@.....@.....@.....@.......@.....@.....@.......@....;.Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.24.28127......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{3639FCCA-5969-316D-AC18-E0C6B2B532E9}@.02:\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X64\Version.@.......@.....@.....@......&.{D2959D22-4DB7-32AF-A1B0-8405C4221749}@.22:\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X64\Version.@.......@.....@.....@......&.{03C1EACE-7E47-3142-A7E7-F36508D02BD1}...@.......@.....@.....@......&.{B33258FD-750C-3B42-8BE4-535B48E97DB4}$.C:\Windows\system32\vcruntime140.dll.@.......@.....@.....@.....

C:\Windows\Installer\MSID12F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	10068
Entropy (8bit):	5.686058068241611
Encrypted:	false
SSDEEP:	192:4rHp5mQrtONHWxSQjmxmY2Otr7aTHiQheevrkC5Wfc5hu:4rHpjZONHW0QjmxmY2OtLkFWfcO
MD5:	B16EDCC47A6C91DF57F1EDD9FF9B7294
SHA1:	42AA2793277DD382C6AA6CD418C1AACB12532207
SHA-256:	A9BA7659249198162947F6C84C0A436E30B28370728C1823D186FBE1EBA1C153
SHA-512:	591B2783469049B6BC65D44D1B56AFCD18086B3807EE2F923690EC2E012E150AC9331128E1E7B759E56858527AC5BD2AF58E53CB4195D190F7AD85E81030A3B6
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@..zX.@.....@.....@.....@.....@.....@......&.{8678BA04-D161-45BE-ACA4-CC5D13073F35}>.Microsoft Visual C++ 2019 X64 Additional Runtime - 14.24.28127..vc_runtimeAdditional_x64.msi.@.....@.m...@.....@........&.{1FCB6B93-B382-48B7-9485-A319D74F4F84}.....@.....@.....@.....@.......@.....@.....@.......@....>.Microsoft Visual C++ 2019 X64 Additional Runtime - 14.24.28127......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{3639FCCA-5969-316D-AC18-E0C6B2B532E9}@.02:\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X64\Version.@.......@.....@.....@......&.{D2959D22-4DB7-32AF-A1B0-8405C4221749}@.22:\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X64\Version.@.......@.....@.....@......&.{99A922E3-648F-3C37-8AE6-78232F317B1E}..C:\Windows\system32\mfc140.dll.@.......@.....@.....@......&.{8924DA15-E863-388D-A06B-E7A3931AD77B}..C:\Windows\system32\mfc1

C:\Windows\Installer\SourceHash{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.2073689159838055
Encrypted:	false
SSDEEP:	12:JSbX72FjrsXAlfLIlHuRpZhG7777777777777777777777777ZDHFb7A9hhh9saP:JsUIwEi9sYTHCcF
MD5:	76DB359D7A7E2092FCD780232804538F
SHA1:	59D065E28B48FC54381E7E2325132C39C82EB91F
SHA-256:	2A0BF0BAF1E123FBE325659C186400C968E0D2153B2A767DF20132FF356EBA82
SHA-512:	AB6D776843C4E9F2C82B9F6AA77D14B43F0CF22072544590D8EA8A69FD86CA1C5F22AB0EFEDFE5E49D8058183E24E4096A63F037FE59EF858DF50D2118AC4E5C
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{8678BA04-D161-45BE-ACA4-CC5D13073F35}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.2089159800810565
Encrypted:	false
SSDEEP:	12:JSbX72FjWGsXAlfLIlHuRpWBhG7777777777777777777777777ZDHFJfrt4RRUG:JMJUIwUiTZhcF
MD5:	44B396F40428EF26C7126AB8B237376D
SHA1:	5F62755CAF1D05A284E9BA73F4FDCF7CBC151FE9
SHA-256:	31176390E8BEF5A3B4E6E51575EE94FDC3068468F8068FDB4FAAF22A2875E8EC
SHA-512:	9B3A1BEBC0F9E3214C943D040D0E45658E965CAD1B85D102A6F71893A0C7F76F471E85B172253AD202E44F3F0B8C3DD7E2987ECBDF91F6418545AC3D9FDDFE75
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5247422966155266
Encrypted:	false
SSDEEP:	48:J8PhpuRc06WXi7jT5xPdrF26RLjxL3OCDf2SmRSZASIVRZsc5i:Ehp11jTHl0aLVL3OC72VR/JRZsc
MD5:	095C3A5270770715DBC325537A79519D
SHA1:	4BB21AA4A37988844C607D8C7FA831A07B97D424
SHA-256:	101409F6DD5FDF01B675B5381F67F216D079E098B5101434F46AB48353EB1E2A
SHA-512:	35E1726696394F11327416ACA86F1B421B874144C5E2725A3BBCC9E204CEB9E6A0CE7B587BCE9E0322065D339CB7A196E04A5BD42231105BA52FDAB02DCA7275
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	871616
Entropy (8bit):	5.413203815714778
Encrypted:	false
SSDEEP:	3072:76sAoN1IAMVcB6J3l7NPh7sOyQSiMbRolrNWG6x+Rkeov8Qj9lOx2s9OW1LRuuGQ:TFfxq8RfKF0Dux6lvJ3c7v/3dmOkc1
MD5:	7FB4B7FD67F9DFE77FC9B1DC1C057823
SHA1:	104C27725F8EF226CA065CD63CD77D8EC5AFE5FB
SHA-256:	48594B40CC7BC87C263DE9AC65BFF1F8A85F0F7082CE3FDFBE3E5879BFB5F33D
SHA-512:	0061CE58ADE183CC5B4BDE246C9D4D7645AC14643AEF26BF0A8EF6EF16DA38EF9E267873F6A8357479C88692691A555DE01CC8B377ADFED5E7A3BF6F7521856D
Malicious:	false
Reputation:	low
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 09:59:37.236 [4684]: Command line: D:\wd\compilerTemp\BMT.i51yo0aa.beh\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 09:59:37.255 [4684]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 09:59:37.299 [4684]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 09:59:37.299 [4684]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 09:59:37.299 [

C:\Windows\System32\mfc140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5784856
Entropy (8bit):	6.654532274304144
Encrypted:	false
SSDEEP:	49152:uBjK4/uFPvZ2fJG6/GGbhWG+fB/XmGroRVkbyWHuSwIbFLOAkGy3zdnErPSCTomH:kuj86/hFLOAkGkzdnEVomFHKnP
MD5:	64FCC1C770B0B3C8321F2FF94E5C2673
SHA1:	CC1BB4B8B2A4FE45D4D48EA525F2FBF75F19E5EB
SHA-256:	18DAA8900B4B4EB905137476E1AA6D587FD104F77374E46D75A1461FD20ACB13
SHA-512:	3C9433D79A65FC26DC2EA06DD750052549A79B42DAD1D79D255D015567038E3ED33505F5895B8381F27B1CBCA672D74B264C35CCCC450A493936B89894A21190
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................LL......LL......LL.......k.....-.......-.......-.......LL..............-.......-...n...-.......-.......-.......Rich............................PE..d....j.].........." ......,...+.....`.+.......................................X.......X...`A..........................................<.d...t.=.......A......@?..?....X..A...0W..o..p.6.8.............................................,.....H.<......................text...\.,.......,................. ..`.rdata...-....,.......,.............@..@.data....3....>.......=.............@....pdata...?...@?..@....>.............@..@.didat..H.....A.......@.............@....rsrc.........A.......@.............@..@.reloc...o...0W..p....V.............@..B........................................................................................................................................................................

C:\Windows\System32\mfc140chs.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47384
Entropy (8bit):	6.139883542385704
Encrypted:	false
SSDEEP:	384:WA5dBlsNKvsXtWUdWAYbMktLiBr8uuPgldyevyBb7DVLN1kSVeQpBj0HRN7jlQH/:jdzvsXlG9tLkr8yTby97DVLqqWjl8P
MD5:	48B63647BD4FE00480264102207A4B8F
SHA1:	2A515702847B22AFEBEB7D50C9F79E6586F41F3B
SHA-256:	11CE613A727B83F9C9182A01960E7721769FE55817B1578D9AB60913FE237970
SHA-512:	5AF7BB04BB994EF0A52B386655815E8D41DCADFA0AD01D29CDFF504FA5A4B1BE78C10C945FBC6F948D2977DC06683767A35F92D98C3E4B5AE527060ED767DDE3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.<.u.R.u.R.u.R.....t.R...P.t.R.Richu.R.PE..d....j.].........." .........v............................................................`.......................................................... ..8s...........x...A..............8............................................................................rdata..............................@..@.rsrc...8s... ...t..................@..@.....j.]........]...8...8........j.]........T...........RSDSQ...dJ.DV..K[=....d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\MFC140CHS.amd64.pdb............8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1...a...rsrc$02................................................................................................................................................................................................................................................................

C:\Windows\System32\mfc140cht.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47384
Entropy (8bit):	6.180449818728053
Encrypted:	false
SSDEEP:	768:HhffucVI4HC7kYw4JUM3i/EhWcKvqWD88Vpnj:xucVI4HC4YJUM3XhWlZwy
MD5:	F4427432439741DEDA5FF26F3DC85658
SHA1:	D2DFC05BA027DDB64ED5C6230F7F37352D9C4224
SHA-256:	9E435F5836D7AAEFAE68C20E4436EDA1E2020A8E3F38461A2BEAE3F70014227F
SHA-512:	82CB0687B009A400391C87AC3E7FFA0A3670C6F52106F07A092971446D67433116B6434EB8303DB8A2473D84357AE966890999331D31E1EE113A2540594509D8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.<.u.R.u.R.u.R.....t.R...P.t.R.Richu.R.PE..d....j.].........." .........v...........................................................`.......................................................... ..`s...........x...A..............8............................................................................rdata..............................@..@.rsrc...`s... ...t..................@..@.....j.]........]...8...8........j.]........T...........RSDS..]...tJ...........d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\MFC140CHT.amd64.pdb............8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1...a...rsrc$02................................................................................................................................................................................................................................................................

C:\Windows\System32\mfc140deu.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	76048
Entropy (8bit):	4.780958509472558
Encrypted:	false
SSDEEP:	1536:mVPidQr0UZqnn0BDqfPS6VFaGCWKZ+e0petNSaBhp0vcsjsr8gWb8C1dCuf93tUd:mVidQr0UZqnnSqfPS6VFaGCWKZX0Whpr
MD5:	CC69F2DF8F820F3230CDF6EFC57060AC
SHA1:	41C1C8B0E4912B454158CB41D584260442F799BC
SHA-256:	8912AECC335A248CCA80051D12D09C586F54DDB5CFC3A6523C13C3AA664AF5B6
SHA-512:	76329CEEC5EABD690A4852F71AA33CA168243C8D847A75BEB431E883E9BD9F477A2766AE09C7A0B8C9C6E64184B0A62F95877B7EB46F39C2F3A46A6675A2FD90
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.<.u.R.u.R.u.R.....t.R...P.t.R.Richu.R.PE..d....j.].........." ................................................................l:....`.......................................................... ..X................A..............8............................................................................rdata..............................@..@.rsrc...X.... ......................@..@.....j.]........]...8...8........j.]........T...........RSDS...8~6.L....N..J....d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\MFC140DEU.amd64.pdb............8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1.......rsrc$02................................................................................................................................................................................................................................................................

C:\Windows\System32\mfc140enu.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	66328
Entropy (8bit):	4.925352252505867
Encrypted:	false
SSDEEP:	768:eVmijcBEhCgyP5Au1HLPLNqyf/nWHBNhdBU2fd5dqWTY8H:eVdzfyP5AuhPLNXf/nWHNfddTpH
MD5:	A6222D950DAD1788AF996EA47B4318CF
SHA1:	93DEC0CD63474A72DE28A88B7D6CF977151E0929
SHA-256:	48D8C8BCE9DD987D6E5A1AE1B5E8A3D91F2ACA7D648F2646DE7832529273AEF1
SHA-512:	F6E98C72EF272C182FA38B987D5D79F57DE19950B0CC48EFB0FEFDB508ACEAE9837576E0B4A9A22FD540E1A4C43260122DDB6210B22730CD19782164407B5B16
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.<.u.R.u.R.u.R.....t.R...P.t.R.Richu.R.PE..d....j.].........." ......................................................................`.......................................................... ..................A..............8............................................................................rdata..............................@..@.rsrc....... ......................@..@.....j.]........]...8...8........j.]........T...........RSDSx../.$.G..x..8X_....d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\MFC140ENU.amd64.pdb............8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1..X....rsrc$02................................................................................................................................................................................................................................................................

C:\Windows\System32\mfc140esn.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	75032
Entropy (8bit):	4.7542776967950005
Encrypted:	false
SSDEEP:	768:/K0KnBU6hH6qg/iKuCOCF3OKWRElMRZ/IvprqWH8:jwq6hH6B/iKuFm3OKWxRZ/IXc
MD5:	3983BABF1F6F5FCCA2FCE174F0FD6C99
SHA1:	2386A617A394CD8869860B986ADE44AD3DB441A7
SHA-256:	C8B8C95FB8EFDDE4D8C228FCCBDD07341D987CDDC83CAE32148657AE35640236
SHA-512:	BC6C528363DDDEC598AAD8085A9B4EF9A2EEDF9E187597DF8DB5E7008D70F8B0A5BBEBC453C64C2C66DE20DD077D97B5C6B8BC5ACF1F1FCC247C3D06117894BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.<.u.R.u.R.u.R.....t.R...P.t.R.Richu.R.PE..d....j.].........." ................................................................/.....`.......................................................... ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@.....j.]........]...8...8........j.]........T...........RSDS..V#^%L.?S.}.......d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\MFC140ESN.amd64.pdb............8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1.......rsrc$02................................................................................................................................................................................................................................................................

C:\Windows\System32\mfc140fra.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	76056
Entropy (8bit):	4.76194579109694
Encrypted:	false
SSDEEP:	768:f26iNYajZELLoYFmNRYxAaTafCp5eQYZmZUjyyyyyyyyyyyyyyyUGQFUbWTVNeOx:fNuqLLo6A2SCHu0jes6W8iM
MD5:	34D7A60E7E5109ABF091082EAE1B7B75
SHA1:	D97CFFCA7BFF72967F860A508DF8D220B286BC16
SHA-256:	9BC3FB20598381BC9A032778B071A72ED432C138678C194136F2F5D08ED9D77B
SHA-512:	91030D3AC2993981A41A6C3E3F432FD9E62FF512589887FB3C777116BD73483341F1DDC14AEC676DA9FE03E00E1DB8B5811680E9179DF5579B14D8A754B17B4C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.<.u.R.u.R.u.R.....t.R...P.t.R.Richu.R.PE..d....j.].........." .................................................................7....`.......................................................... ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@.....j.]........]...8...8........j.]........T...........RSDS.6...9.J.%c+.J......d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\MFC140FRA.amd64.pdb............8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1..0....rsrc$02................................................................................................................................................................................................................................................................

C:\Windows\System32\mfc140ita.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74008
Entropy (8bit):	4.7589747243949585
Encrypted:	false
SSDEEP:	768:IQE6XaCyqbK15MNpwgDGxNIlW3jSCQQQjeqS1hDDg1UWTVZqWLk8ApV7:IQass5MNpwgSxNIlW3GoiTZL9w7
MD5:	A0EE5C3B34D46DC83CB2E94F18462BB8
SHA1:	94D7D32D343ABB5DD431611648DA044AAED157D9
SHA-256:	A49157E502E43654B8B06017C70C1640162971D3E08242D6D0CA1395CC32B2C3
SHA-512:	32B83ACA71FF96377AA27181D6D95AA89E4B73FE0013A773DEDCC3D6B2C97BF412A4BF4977E9F3D65DC7AD87B959259DD8F0F6FEB1E4A3C20190A87725A3C792
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.<.u.R.u.R.u.R.....t.R...P.t.R.Richu.R.PE..d....j.].........." ................................................................d#....`.......................................................... ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@.....j.]........]...8...8........j.]........T...........RSDS\|.).zh.E....q]....d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\MFC140ITA.amd64.pdb............8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1.......rsrc$02................................................................................................................................................................................................................................................................

C:\Windows\System32\mfc140jpn.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	55576
Entropy (8bit):	5.943337548685519
Encrypted:	false
SSDEEP:	768:opxanVn/WHfJxsr10/eu9RHrePqWRK8QHbj:opcnp/WDgunSZ
MD5:	0E64CE63194C08BB3884DBAB2236BDC2
SHA1:	D245F4EABF1460115E2F05E0906BDF48981F661A
SHA-256:	174E7BED9F11115C5E08FF1A7BA796C14BBDEF8526428F1D290F1F034563287D
SHA-512:	42E985D2EDD683E9B30334755A963D1E02DF31255ED958EF9E754D5B0CD5D0B1A8E8B7643E37CE91629A3B6EC26A7B372077D4D6921EA5459F587BC5434FC4AB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.<.u.R.u.R.u.R.....t.R...P.t.R.Richu.R.PE..d....j.].........." .................................................................Y....`.......................................................... ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@.....j.]........]...8...8........j.]........T...........RSDS.]^..x.D............d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\MFC140JPN.amd64.pdb............8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1.......rsrc$02................................................................................................................................................................................................................................................................

C:\Windows\System32\mfc140kor.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54552
Entropy (8bit):	6.10987276953441
Encrypted:	false
SSDEEP:	768:ajVQO54LQTNMSUaHqNA3B2I7CvqDqW1o8:ajZ51TNMIqNAx2I7Cvq115
MD5:	EC68DD3A65DC676976E5E2D04EF58718
SHA1:	AD681EBC0DB37D8A78B1F55B930B9AA81419ABB7
SHA-256:	AF6128FB4E5D7AA377EBEAE133AECE05E640380DCDB4D7881098A15E53D425F3
SHA-512:	06AC46F23446DB7862E101E586A40E4EC547AB2EC0B32D66DF7C309C556C6510287013FFECBFC79ABC424C39767A7693F99195BB8A31695123743B9E83697BFB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.<.u.R.u.R.u.R.....t.R...P.t.R.Richu.R.PE..d....j.].........." ......................................................................`.......................................................... ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@.....j.]........]...8...8........j.]........T...........RSDS9.#..N......ld....d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\MFC140KOR.amd64.pdb............8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1..@~...rsrc$02................................................................................................................................................................................................................................................................

C:\Windows\System32\mfc140rus.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	71960
Entropy (8bit):	5.313872638699593
Encrypted:	false
SSDEEP:	768:fEAv/gFXOv15iqNWTMHVhtZgFckD9ZqW/h8:n6XOv1rhTWl/K
MD5:	F54758F534383B7F3D861AC35F42F7CF
SHA1:	DBA9AB42B379ECFA29721A7F57586E6A1C79FACE
SHA-256:	39FE1F61E0C38DB08CD53EE83C34737D3BD56731CC352F8A4B570D2CFA7EB2C2
SHA-512:	33B8FEF17D60B5174AFEB6A4969A98D83E0BCDE4AFC7BCA0CF020F3C9109BB0705A30C9D366AD6A84DE33ED435549C3D7C36BE05FD43BF389631D3D201BD6FE6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.<.u.R.u.R.u.R.....t.R...P.t.R.Richu.R.PE..d....j.].........." ................................................................j7....`.......................................................... ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@.....j.]........]...8...8........j.]........T...........RSDS..).N.tE.4.+L.......d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\MFC140RUS.amd64.pdb............8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1..H....rsrc$02................................................................................................................................................................................................................................................................

C:\Windows\System32\mfc140u.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5813016
Entropy (8bit):	6.633447726562357
Encrypted:	false
SSDEEP:	49152:wAY0b2f3rYE4ZXMVZ2Of5TdVktCWEdlQ2GA0hfmtl5xNjc5tlkPuSwIbFLOAkGyW:Y+L9YHlN5FLOAkGkzdnEVomFHKnP
MD5:	C6A732F23B907BC6D37982F47F4B4453
SHA1:	C27DD881CD6D1E3337FD5DFC0031F8975A5C44A0
SHA-256:	C8DAB45709404E6607B21A641895C6B6953550780B2245C3792E64244A10DA8E
SHA-512:	5065F798C5FF5D3FA1EBD8C9B9004E31493D96705152C16300AFBF7000A7A3A0BF2D11DE888E0D896825CF336F9631340574C1B2000F73DCD1C5F8054303217F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P..B....P..B....P..B....P...(j..P..#=...P..#=...P..#=...P..B....P...P...S..#=...P..#=..`Q..#=...P..#=...P..#=...P..Rich.P..........PE..d....j.].........." ......,...,.......+......................................0Y.....7HY...`A.........................................2=.......>.......B.......?..A...rX..A....W..p....7.8.............................................,.H...H.=......................text.....,.......,................. ..`.rdata........,.......,.............@..@.data....6...p>......P>.............@....pdata...A....?..B... ?.............@..@.didat..H.....B......bA.............@....rsrc.........B......hA.............@..@.reloc...p....W..r....W.............@..B........................................................................................................................................................................................

C:\Windows\System32\mfcm140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	103192
Entropy (8bit):	6.332116676482748
Encrypted:	false
SSDEEP:	1536:gAH9hBRZa4HXuGJqP/c1xwX4uwLswGSTD38loJoZgNUsu:F7Za4HXuG4PawX4uwLsuD8l89U/
MD5:	E79C4777DB60A9EB2A870C7BB8F624AD
SHA1:	D72E5181AB8C29CBF06B17C8A0C9D363C27BC99D
SHA-256:	37E0A431C44F5445636D5D44E0856BA6E970EE96C80B76301CDF19867C2A1534
SHA-512:	1BFD29A8648D39D9A328CFD4E6EFCBF6ED1A441FEB2999AF65D4CB76C6A601D8F3D13CFD3EE576925719BC1004424FF72D71BB7976A2EF8F405394EEE5BAF414
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(^..l?..l?..l?...q.n?..rm..n?...R..h?...R..d?...R..n?..eG..j?...j.i?..l?...?...R..I?...R..m?...Rz.m?...R..m?..Richl?..........................PE..d....j.].........." .....H...........Q..............................................Zp....`.........................................PX.......Y.......................R...A.......... z..8............................y...............p..p...........Pv..H............text....B.......D.................. ..`.nep.........`.......H.............. ..`.rdata.......p.......L..............@..@.data...H....p.......@..............@....pdata...............H..............@..@.rsrc................L..............@..@.reloc...............P..............@..B........................................................................................................................................................................................

C:\Windows\System32\mfcm140u.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	103192
Entropy (8bit):	6.323423253274282
Encrypted:	false
SSDEEP:	1536:cEHdBTRvL4HRMT+Fk/IfgGULswG/XoxiTsoS7Zl9K:RxvL4HRAd/IfgGULsIsTsT8
MD5:	61A335B209AFB260E54CC26ABB67B732
SHA1:	26394AEAE1ED1EE1B3176A8407FB9D81DC4964F1
SHA-256:	B0AD34FEC4316318A27878A56C9B5C0F8DF9FA40EF59A4E0E579DDE11D517B28
SHA-512:	B819E75ACD2C5D7933C98F65EBE686BE4C62751EDCC0CF9D28045C40033006A54F06E750F2DE27EE51ADD0AB547A583EEC4C798AD097FC6756DBF5547FEB72BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(^..l?..l?..l?...q.n?..rm..n?...R..h?...R..d?...R..n?..eG..j?...j.i?..l?...?...R..I?...R..m?...Rz.m?...R..m?..Richl?..........................PE..d....j.].........." .....H...........Q...............................................I....`.........................................PX.......Y.......................R...A.......... z..8............................y...............p..p...........Pv..H............text....B.......D.................. ..`.nep.........`.......H.............. ..`.rdata.......p.......L..............@..@.data...H....p.......@..............@....pdata...............H..............@..@.rsrc................L..............@..@.reloc...............P..............@..B........................................................................................................................................................................................

C:\Windows\System32\vcamp140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	454424
Entropy (8bit):	6.069109694380889
Encrypted:	false
SSDEEP:	6144:u0vVKw/IgGCc/jETCN2JW7yBE8TnBBkD1738jNuLJb2tkltY+:Lsw/g/SJ8yB7TBBymNuVc+
MD5:	2E0785446F5DCC636E3D3AA6D1F1B9FA
SHA1:	7B83E68FC65A108016995D431E10F4DD821E1AFF
SHA-256:	7AE6E08D3A08D14817EDC23A15DC13DBDEB94C506033FE10C3914B92035307DF
SHA-512:	4C56C79458CE0E290E2E5879CD91A254F19EA144ABF70C77051AECF277C7992EE6EE00F2C74DA3195E10EB8C26CBDE88FD5BBDFF8E21AAC7D4A2264C0DD6668F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V...7k.7k.7k.O..7k.NZj.7k.NZn.7k.NZo.7k.NZh.7k./...7k.7j..7k.NZb.7k.NZk.7k.NZ..7k.7..7k.NZi.7k.Rich.7k.........PE..d....j.].........." .................M...............................................:....`A........................................p...,8......@.......8$...p...7.......A......0...P...8.......................(....................................................text............................... ..`.rdata...f.......h..................@..@.data....3...0...,..................@....pdata...7...p...8...H..............@..@.rsrc...8$.......&..................@..@.reloc..0...........................@..B................................................................................................................................................................................................................................................

C:\Windows\System32\vcomp140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	160024
Entropy (8bit):	6.413670293686391
Encrypted:	false
SSDEEP:	3072:OlaI2Qrk+EIYz6BspZOXDDmBOxNrB9s/aUMJinxkux/83/:O8h92YzjsD+mNr8W/
MD5:	5AEA86CFF3A0FA7625D2BD51FE260568
SHA1:	EE1E3DED6D4E9A14A3A2668F8804E3B2BF591C6C
SHA-256:	BBCB6A4B9D113C46D13762E5687E14D95C599E34DA59C3B4C4873B86A6F0653C
SHA-512:	6D2BB57E82324B7969D4AB1E7F1D4559B08F8407574B4ECD8399F3C950A67EDA6D3189774CE95A2ED60C8D81797EB12CD326977F9AD6CA6E7EF4FEA5561A8F18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|../../../....../....../......./3...../3...../R../../../.../3...../3...../3...../3../../3...../Rich../........PE..d....j.].........." .....N...........c....................................................`.................................................8...<....`.......0.......0...A...p..........8............................................`...............................text....M.......N.................. ..`.rdata.......`.......R..............@..@.data...............................@....pdata.......0......................@..@_RDATA.......P......................@..@.rsrc........`......................@..@.reloc.......p.......*..............@..B........................................................................................................................................................................................................

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1028\license.rtf

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	18127
Entropy (8bit):	4.036737741619669
Encrypted:	false
SSDEEP:	192:xaz+aCQbjdBCLCgfvtfLEmmVxJzLKLIW7cBFCoSM0fvJ93eyryH1MqG1xcRY/c5f:seh/IMHexG4q2
MD5:	B7F65A3A169484D21FA075CCA79083ED
SHA1:	5DBFA18928529A798FF84C14FD333CB08B3377C0
SHA-256:	32585B93E69272B6D42DAC718E04D954769FE31AC9217C6431510E9EEAD78C49
SHA-512:	EDA2F946C2E35464E4272B1C3E4A8DC5F17093C05DAB9A685DBEFD5A870B9D872D8A1645ED6F5B9A72BBB2A59D22DFA58FBF420F6440278CCBE07B6D0555C283
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset134 SimSun;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT \f1\'dc\'9b\'f3\'77\'ca\'da\'99\'e0\'97\'6c\'bf\'ee\f0\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0\f1\'b1\'be\'ca\'da\'99\'e0\'97\'6c\'bf\'ee\'ca\'c7\'d9\'46\'d3\'c3\'91\'f4\'c5\'63\f0 Microsoft Corporation (\f1\'bb\'f2\'c6\'e4\'ea\'50\'82\'53\'c6\'f3\'98\'49\'a3\'ac\'d2\'95\'d9\'46\'d3\'c3\'91\'f4\'cb\'f9\'be\'d3\'d7\'a1\'b5\'c4\'b5\'d8\'fc\'63\'b6\'f8\'b6\'a8\f0 ) \f1\'d6\'ae\'e9\'67\'b3\'c9\'c1\'a2\'b5\'c4\'ba\'cf\'bc\'73\'a1\'a3\'cb\'fb\'82\'83\'df\'6d\'d3\'c3\'ec\'b6\'c9\'cf\'ca\'f6\'dc\'9b\'f3\'77\'a3\'ac\'b1\'be\'ca\'da\'99\'e0\'97\'6c\'bf\'ee\'d2\'e0\'df\'6d\'d3\'c3\'ec\'b6\'c8\'ce\'ba\'ce\f0 Microsoft \f1\'b7\'fe\'84\'d5\'bb\'f2\'b1\'be\'dc\'9b\'f3\'77\'d6\'ae\'b8\'fc\'d0\'c2\'a3

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1028\thm.wxl

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.163758160900388
Encrypted:	false
SSDEEP:	48:c5DiTlOtMes9T/JhDXsA9EHSniarRFeOrw8N3mZNNTN2N08CEjMUWFPmDlTKJKy2:uDiTlFrDDsA9tfHP8+8nhM0WamzqDFqD
MD5:	472ABBEDCBAD24DBA5B5F5E8D02C340F
SHA1:	974F62B5C2E149C3879DD16E5A9DBB9406C3DB85
SHA-256:	8E2E660DFB66CB453E17F1B6991799678B1C8B350A55F9EBE2BA0028018A15AD
SHA-512:	676E29378AAED25DE6008D213EFA10D1F5AAD107833E218D71F697E728B7B5B57DE42E7A910F121948D7B1B47AB4F7AE63F71196C747E8AE2B4827F754FC2699
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">....</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ................. ......................../passive \| /quiet - .... UI ........... UI.... ........... UI ........../norestart - ................UI ............./log log.txt - .........

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1029\license.rtf

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	13053
Entropy (8bit):	5.125552901367032
Encrypted:	false
SSDEEP:	192:TKwfs7OUpXLa5HEXQwNCNvZSjotXxiwH++3kamdEj6ZDbugDHgbGNlv6NbrYGY9x:Lfs7c5DRH0aHmJGpafU0AliwGra2
MD5:	B408556A89FCE3B47CD61302ECA64AC9
SHA1:	AAC1CDAF085162EFF5EAABF562452C93B73370CB
SHA-256:	21DDCBB0B0860E15FF9294CBB3C4E25B1FE48619210B8A1FDEC90BDCDC8C04BC
SHA-512:	BDE33918E68388C60750C964CDC213EC069CE1F6430C2AA7CF1626E6785C7C865094E59420D00026918E04B9B8D19FA22AC440F851ADC360759977676F8891E7
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset238 Tahoma;}{\f2\fnil\fcharset0 Garamond;}{\f3\fnil Tahoma;}{\f4\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 LICEN\f1\'c8N\f0\'cd PODM\'cdNKY PRO SOFTWARE SPOLE\f1\'c8NOSTI MICROSOFT\par..\f0 MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Tyto licen\f1\'e8n\f0\'ed podm\'ednky p\f1\'f8edstavuj\f0\'ed smlouvu mezi spole\f1\'e8nost\f0\'ed Microsoft Corporation (nebo n\f1\'eckterou z\~jej\f0\'edch afilac\'ed v\~z\'e1vislosti na tom, kde bydl\'edte) a\~v\'e1mi. Vztahuj\'ed se na v\'fd\f1\'9ae uveden\f0\'fd software. Podm\'ednky se rovn\f1\'ec\'9e vztahuj\f0\'ed na jak\'e9koli slu\f1\'9eby Microsoft nebo aktualizace pro software, pokud se na slu\'9eby nebo aktualizace nevztahuj\f0\'ed odli\f1\'9an\f0\'e9 podm\'ednky.\par..\b DODR\f1\'8e\f0\'cdTE-LI TYTO

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1029\thm.wxl

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3333
Entropy (8bit):	5.370651462060085
Encrypted:	false
SSDEEP:	48:c5DiTlOtesM6H2hDdxHOjZxsaIIy3Iy5sDMN3mkNFN7NwcfiPc3hKPnWZLF0hKqZ:uDiTlVxxHOy/9xXfpZJYnL8xK2S
MD5:	16343005D29EC431891B02F048C7F581
SHA1:	85A14C40C482D9351271F6119D272D19407C3CE9
SHA-256:	07FB3EC174F25DFBE532D9D739234D9DFDA8E9D34F01FE660C5B4D56989FA779
SHA-512:	FF1AE9C21DCFB018DD4EC82A6D43362CB8C591E21F45DD1C25955D83D328B57C8D454BBE33FBC73A70DADF1DFB3AE27502C9B3A8A3FF2DA97085CA0D9A68AB03
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instala.n. program [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Opravdu chcete akci zru.it?</String>.. <String Id="HelpHeader">N.pov.da nastaven.</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [adres..] . Nainstaluje, oprav., odinstaluje nebo.. vytvo.. .plnou m.stn. kopii svazku v adres..i. V.choz. mo.nost. je instalace...../passive \| /quiet . Zobraz. minim.ln. u.ivatelsk. rozhran. bez v.zev nebo nezobraz. ..dn. u.ivatelsk. rozhran. a.. ..dn. v.zvy. V.choz. mo.nost. je zobrazen. u.ivatelsk.ho rozhran. a v.ech v.zev...../noresta

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1031\license.rtf

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	11936
Entropy (8bit):	5.194264396634094
Encrypted:	false
SSDEEP:	192:+XkOmRUOl6WBsl4kA+sn+mvtI0qHl4qj+iPqk6kVV9iX9GzYNvQ8yOejIpRMrhC2:DDHMFPCeV3i4zOHyOejIpkC2
MD5:	C2CFA4CE43DFF1FCD200EDD2B1212F0A
SHA1:	E8286E843192802E5EBF1BE67AE30BCAD75AC4BB
SHA-256:	F861DB23B972FAAA54520558810387D742878947057CF853DC74E5F6432E6A1B
SHA-512:	6FDF02A2DC9EF10DD52404F19C300429E7EA40469F00A43CA627F3B7F3868D1724450F99C65B70B9B7B1F2E1FA9D62B8BE1833A8C5AA3CD31C940459F359F30B
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil Tahoma;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT-SOFTWARE-LIZENZBESTIMMUNGEN\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Diese Lizenzbestimmungen sind ein Vertrag zwischen Ihnen und der Microsoft Corporation (bzw. abh\'e4ngig von Ihrem Wohnsitz einem mit Microsoft verbundenen Unternehmen). Sie gelten f\'fcr die oben angef\'fchrte Software. Die Bestimmungen gelten ebenso f\'fcr jegliche von Microsoft angebotenen Dienste oder Updates f\'fcr die Software, sofern diesen keine anderen Bestimmungen beiliegen.\par..\b SOFERN SIE DIESE LIZENZBESTIMMUNGEN EINHALTEN, SIND SIE ZU FOLGENDEM BERECHTIGT:\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb120\sa120\sl240\slmult1\tx360 RECHTE ZUR INSTALLATION UND NUTZUNG. \

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1031\thm.wxl

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3379
Entropy (8bit):	5.094097800535488
Encrypted:	false
SSDEEP:	48:c5DiTlOZuesXJhDEVTORNxSMoZN3mteNSiNGNsZuiAXEqicMwhPXbhu9KwKlK8Kq:uDiTl3N7xSbu0N8+AhSNnm
MD5:	561F3F32DB2453647D1992D4D932E872
SHA1:	109548642FB7C5CC0159BEDDBCF7752B12B264C0
SHA-256:	8E0DCA6E085744BFCBFF46F7DCBCFA6FBD722DFA52013EE8CEEAF682D7509581
SHA-512:	CEF8C80BEF8F88208E0751305DF519C3D2F1C84351A71098DC73392EC06CB61A4ACA35182A0822CF6934E8EE42196E2BCFE810CC859965A9F6F393858A1242DF
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] - Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">M.chten Sie den Vorgang wirklich abbrechen?</String>.. <String Id="HelpHeader">Setup-Hilfe</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [Verzeichnis] - installiert, repariert, deinstalliert oder.. erstellt eine vollst.ndige lokale Kopie des Bundles im Verzeichnis. Installieren ist die Standardeinstellung...../passive \| /quiet - zeigt eine minimale Benutzeroberfl.che ohne Eingabeaufforderungen oder keine.. Benutzeroberfl.che und keine Eingabeaufforderungen an. Standardm..ig werden die Benutzeroberfl.che und alle Eingab

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1036\license.rtf

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	11593
Entropy (8bit):	5.106817099949188
Encrypted:	false
SSDEEP:	192:aRAbNYjVk+z5GUSLse5GgALEXmAWL+/3FEShP9sJgi8+Ra8woh+89EQdhwQPely6:K4yrPqm9LcVEg9sVp2ohHVdKoXJXci9a
MD5:	F0FF747B85B1088A317399B0E11D2101
SHA1:	F13902A39CEAE703A4713AC883D55CFEE5F1876C
SHA-256:	4D9B7F06BE847E9E135AB3373F381ED7A841E51631E3C2D16E5C40B535DA3BCF
SHA-512:	AA850F05571FFC361A764A14CA9C1A465E2646A8307DEEE0589852E6ACC61AF145AEF26B502835724D7245900F9F0D441451DD8C055404788CE64415F5B79506
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 TERMES DU CONTRAT DE LICENCE LOGICIEL MICROSOFT\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Les pr\'e9sents termes du contrat de licence constituent un contrat entre Microsoft Corporation (ou, en fonction de votre lieu de r\'e9sidence, l\rquote un de ses affili\'e9s) et vous. Ils s\rquote appliquent au logiciel vis\'e9 ci-dessus. Les termes s\rquote appliquent \'e9galement \'e0 tout service et \'e0 toute mise \'e0 jour Microsoft pour ce logiciel, \'e0 moins que d\rquote autres termes n\rquote accompagnent ces \'e9l\'e9ments.\par..\b SI VOUS VOUS CONFORMEZ AUX PR\'c9SENTS TERMES DU CONTRAT DE LICENCE, VOUS AVEZ LES DROITS CI-DESSOUS.\par....\pard{\pntext\f1\'B7\tab}{\\pn\pnlvlblt\pnf1\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb120\s

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1036\thm.wxl

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3366
Entropy (8bit):	5.0912204406356905
Encrypted:	false
SSDEEP:	48:c5DiTlO1BesgKLhD1K8cocDSN3m4NlN2ZfNmXL8ePZFcZkLPqUf9fQKRLKeKqZfj:uDiTlABzH1/qt4qgcXY
MD5:	7B46AE8698459830A0F9116BC27DE7DF
SHA1:	D9BB14D483B88996A591392AE03E245CAE19C6C3
SHA-256:	704DDF2E60C1F292BE95C7C79EE48FE8BA8534CEB7CCF9A9EA68B1AD788AE9D4
SHA-512:	FC536DFADBCD81B42F611AC996059A6264E36ECF72A4AEE7D1E37B87AEFED290CC5251C09B68ED0C8719F655B163AD0782ACD8CE6332ED4AB4046C12D8E6DBF6
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Installation de [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Voulez-vous vraiment annuler.?</String>.. <String Id="HelpHeader">Aide du programme d'installation</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installe, r.pare, d.sinstalle ou.. cr.e une copie locale compl.te du groupe dans le r.pertoire. Install est l'option par d.faut...../passive \| /quiet - affiche une interface minimale, sans invite, ou n'affiche ni interface.. ni invite. Par d.faut, l'interface et toutes les invites sont affich.es...../norestart - supprime toutes les tentatives de red.

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1040\license.rtf

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	11281
Entropy (8bit):	5.046489958240229
Encrypted:	false
SSDEEP:	192:WBGNX6UXR2+5SmgS/ChMErYkQvowHVw6zdgkycEGCDLQ+n3YJ2d8XSiej+T4Ma8f:gAzSVARBR5jEPLQY3YJpSjTP2
MD5:	9D98044BAC59684489C4CF66C3B34C85
SHA1:	36AAE7F10A19D336C725CAFC8583B26D1F5E2325
SHA-256:	A3F745C01DEA84CE746BA630814E68C7C592B965B048DDC4B1BBE1D6E533BE22
SHA-512:	D849BBB6C87C182CC98C4E2314C0829BB48BAD483D0CD97BF409E75457C3695049C3A8ADFE865E1ECBC989A910096D2C1CDF333705AAC4D22025DF91B355278E
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 CONTRATTO DI LICENZA PER IL SOFTWARE MICROSOFT\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Le presenti condizioni di licenza costituiscono il contratto tra Microsoft Corporation (o, in base al luogo di residenza del licenziatario, una delle sue consociate) e il licenziatario, Tali condizioni si applicano al software Microsoft di cui sopra. Le condizioni si applicano inoltre a qualsiasi servizio o aggiornamento di Microsoft relativo al software, a meno che questo non sia accompagnato da condizioni differenti.\par..\b QUALORA IL LICENZIATARIO SI ATTENGA ALLE PRESENTI CONDIZIONI DI LICENZA, DISPORR\'c0 DEI DIRITTI INDICATI DI SEGUITO.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\p

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1040\thm.wxl

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3319
Entropy (8bit):	5.019774955491369
Encrypted:	false
SSDEEP:	48:c5DiTlO1eesy+hD9BOtBFv5Vo8BbQhMNDJN3msNlNohNNz+wcPclM+PAoYKp+K/u:uDiTlfQvo8WutJ/s9FHNOJp
MD5:	D90BC60FA15299925986A52861B8E5D5
SHA1:	FADFCA9AB91B1AB4BD7F76132F712357BD6DB760
SHA-256:	0C57F40CC2091554307AA8A7C35DD38E4596E9513E9EFAE00AC30498EF4E9BC2
SHA-512:	11764D0E9F286B5AA7B1A9601170833E462A93A1E569A032FCBA9879174305582BD42794D4131B83FBCFBF1CF868A8D5382B11A4BD21F0F7D9B2E87E3C708C3F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Installazione di [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Annullare?</String>.. <String Id="HelpHeader">Guida alla configurazione</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installa, ripara, disinstalla o.. crea una copia locale completa del bundle nella directory. L'opzione predefinita . Install...../passive \| /quiet - visualizza un'interfaccia utente minima senza prompt oppure non visualizza alcuna interfaccia utente.. n. prompt. Per impostazione predefinita viene visualizzata l'intera interfaccia utente e tutti i prompt...../norestart - annulla quals

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1041\license.rtf

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	28232
Entropy (8bit):	3.7669201853275722
Encrypted:	false
SSDEEP:	192:Qkb65jNkzrUJVbpEiTskXHH1AZWoJxfnVnkDYUqfQFXBue6hX2JSfR7q05kWZxhY:epCD3y/ybox2yrk2
MD5:	8C49936EC4CF0F64CA2398191C462698
SHA1:	CC069FE8F8BC3B6EE2085A4EACF40DB26C842BAC
SHA-256:	7355367B7C48F1BBACC66DFFE1D4BF016C16156D020D4156F288C2B2207ED1C2
SHA-512:	4381147FF6707C3D31C5AE591F68BC61897811112CB507831EFF5E71DD281009400EDA3300E7D3EFDE3545B89BCB71F2036F776C6FDFC73B6B2B2B8FBC084499
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset128 MS Gothic;}{\f1\fnil\fcharset0 MS Gothic;}{\f2\fnil\fcharset134 SimSun;}{\f3\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9\'83\'7d\'83\'43\'83\'4e\'83\'8d\'83\'5c\'83\'74\'83\'67 \'83\'5c\'83\'74\'83\'67\'83\'45\'83\'46\'83\'41 \'83\'89\'83\'43\'83\'5a\'83\'93\'83\'58\'8f\'f0\'8d\'80\par..\f1 MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0\f0\'96\'7b\'83\'89\'83\'43\'83\'5a\'83\'93\'83\'58\'8f\'f0\'8d\'80\'82\'cd\f2\'a1\'a2\f1 Microsoft Corporation (\f0\'82\'dc\'82\'bd\'82\'cd\'82\'a8\'8b\'71\'97\'6c\'82\'cc\'8f\'8a\'8d\'dd\'92\'6e\'82\'c9\'89\'9e\'82\'b6\'82\'c4\'82\'cd\'82\'bb\'82\'cc\'8a\'d6\'98\'41\'89\'ef\'8e\'d0) \'82\'c6\'82\'a8\'8b\'71\'97\'6c\'82\'c6\'82\'cc\'8c\'5f\'96\'f1\'82\'f0\'8d\'5c\'90\'ac\'82\'b5\'82\'dc\'82\'b7\'81\'42\'96\'7b\'83\'89\'83\'43\'83\'5a\'83\'93\'83\'58\'8f\'f0\'8

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1041\thm.wxl

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3959
Entropy (8bit):	5.955167044943003
Encrypted:	false
SSDEEP:	96:uDiTlDuB1n+RNmvFo6bnpojeTPk0R/vueX5OA17IHdGWz:5uB1+gD1DU4EdGE
MD5:	DC81ED54FD28FC6DB6F139C8DA1BDED6
SHA1:	9C719C32844F78AAE523ADB8EE42A54D019C2B05
SHA-256:	6B9BBF90D75CFA7D943F036C01602945FE2FA786C6173E22ACB7AFE18375C7EA
SHA-512:	FD759C42C7740EE9B42EA910D66B0FA3F813600FD29D074BB592E5E12F5EC09DB6B529680E54F7943821CEFE84CE155A151B89A355D99C25A920BF8F254AA008
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.. <Control Control="InstallButton" X="275" Y="237" Width="110" Height="23"/>.. <Control Control="UninstallButton" X="270" Y="237" Width="120" Height="23"/>.. <Control Control="RepairButton" X="187" Y="237" Width="80" Height="23"/>.. .. <String Id="Caption">[WixBundleName] .......</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">..........</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ............ ......... .........................

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1042\license.rtf

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	27936
Entropy (8bit):	3.871317037004171
Encrypted:	false
SSDEEP:	384:kKIgbA2uBsarNG/HxPvCL1ewjxsXmEw4C7C7R4jAeqCBO968y7yNRylBSFfQv9yH:d3ar8Xa/XAeqoc0wfBB4qN
MD5:	184D94082717E684EAF081CEC3CBA4B1
SHA1:	960B9DA48F4CDDF29E78BBAE995B52204B26D51B
SHA-256:	A4C25DA9E3FBCED47464152C10538F16EE06D8E06BC62E1CF4808D293AA1AFA2
SHA-512:	E4016C0CA348299B5EF761F456E3B5AD9B99E5E100C07ACAB1369DFEC214E75AA88E9AD2A0952C0CC1B707E2732779E6E3810B3DA6C839F0181DC81E3560CBDA
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset129 Malgun Gothic;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 Microsoft \f1\'bc\'d2\'c7\'c1\'c6\'ae\'bf\'fe\'be\'ee\f0 \f1\'bb\'e7\'bf\'eb\'b1\'c7\f0 \f1\'b0\'e8\'be\'e0\'bc\'ad\f0\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0\f1\'ba\'bb\f0 \f1\'bb\'e7\'bf\'eb\'b1\'c7\f0 \f1\'b0\'e8\'be\'e0\'c0\'ba\f0 Microsoft Corporation(\f1\'b6\'c7\'b4\'c2\f0 \f1\'b0\'c5\'c1\'d6\f0 \f1\'c1\'f6\'bf\'aa\'bf\'a1\f0 \f1\'b5\'fb\'b6\'f3\f0 \f1\'b0\'e8\'bf\'ad\'bb\'e7\f0 \f1\'c1\'df\f0 \f1\'c7\'cf\'b3\'aa\f0 )\f1\'b0\'fa\f0 \f1\'b1\'cd\'c7\'cf\f0 \f1\'b0\'a3\'bf\'a1\f0 \f1\'c3\'bc\'b0\'e1\'b5\'c7\'b4\'c2\f0 \f1\'b0\'e8\'be\'e0\'c0\'d4\'b4\'cf\'b4\'d9\f0 . \f1\'ba\'bb\f0 \f1\'c1\'b6\'b0\'c7\'c0\'ba\f0 \f1\'c0\'a7\'bf\'a1\f0 \f1\'b8\'ed\'bd\'c3\'b5\'c8\f0 \f1

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1042\thm.wxl

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3249
Entropy (8bit):	5.985100495461761
Encrypted:	false
SSDEEP:	48:c5DiTlO4TesKOwhDNJCkt1NhEN3m/NFNkbKNdExpVgUnqx6IPaRc0KoUK9TKz0KR:uDiTlUJJCsgqf6YVoz4uU5vI54U5TY
MD5:	B3399648C2F30930487F20B50378CEC1
SHA1:	CA7BDAB3BFEF89F6FA3C4AAF39A165D14069FC3D
SHA-256:	AD7608B87A7135F408ABF54A897A0F0920080F76013314B00D301D6264AE90B2
SHA-512:	C5B0ECF11F6DADF2E68BC3AA29CC8B24C0158DAE61FE488042D1105341773166C9EBABE43B2AF691AD4D4B458BF4A4BF9689C5722C536439CA3CDC84C0825965
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] .. ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">.. ...</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ..... ... .. .. .... .., .., .. .... ...... ... .........../passive \| /quiet - .... .. .. UI. ..... UI ... ..... .... ..... ..... UI. .. ..... ........../norestart - .. .... .. .... ...

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1045\license.rtf

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	13265
Entropy (8bit):	5.358483628484379
Encrypted:	false
SSDEEP:	192:TKpWRd0NE41Y/od7V/sHFos7YLQY9DbLM5D+Vw1VAOb0P4/sHLS7VHwHMPw95a+Q:uy0CG9KZ7qQCw1VAOZ/sHOJfcY2wf6p2
MD5:	5B9DF97FC98938BF2936437430E31ECA
SHA1:	AB1DA8FECDF85CF487709774033F5B4B79DFF8DE
SHA-256:	8CB5EB330AA07ACCD6D1C8961F715F66A4F3D69FB291765F8D9F1850105AF617
SHA-512:	4EF61A484DF85C487BE326AB4F95870813B9D0644DF788CE22D3BEB6E062CDF80732CB0B77FCDA5D4C951A0D67AECF8F5DCD94EA6FA028CFCA11D85AA97714E3
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset238 Tahoma;}{\f2\fnil\fcharset0 Garamond;}{\f3\fnil Tahoma;}{\f4\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 POSTANOWIENIA LICENCYJNE DOTYCZ\f1\'a5CE OPROGRAMOWANIA\par..\f0 MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Niniejsze postanowienia licencyjne stanowi\f1\'b9 umow\'ea mi\'eadzy Microsoft Corporation (lub, w\~zale\'bfno\'9cci od miejsca zamieszkania Licencjobiorcy, jednym z\~podmiot\f0\'f3w stowarzyszonych Microsoft Corporation) a\~Licencjobiorc\f1\'b9. Maj\'b9 one zastosowanie do wskazanego powy\'bfej oprogramowania. Niniejsze postanowienia maj\'b9 r\f0\'f3wnie\f1\'bf zastosowanie do wszelkich us\'b3ug i aktualizacji Microsoft dla niniejszego oprogramowania, z wyj\'b9tkiem tych, kt\f0\'f3rym towarzysz\f1\'b9 inne postanowienia.\par..\b\

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1045\thm.wxl

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3212
Entropy (8bit):	5.268378763359481
Encrypted:	false
SSDEEP:	48:c5DiTlOPesar4hDo7zGriQjDCN3mDNN0NrsNGl3vxkIP2hUdKLK0KbK4n6W0sfNM:uDiTlusPGriQw8n2rOij4JsU
MD5:	15172EAF5C2C2E2B008DE04A250A62A1
SHA1:	ED60F870C473EE87DF39D1584880D964796E6888
SHA-256:	440B309FCDF61FFC03B269FE3815C60CB52C6AE3FC6ACAD14EAC04D057B6D6EA
SHA-512:	48AA89CF4A0B64FF4DCB82E372A01DFF423C12111D35A4D27B6D8DD793FFDE130E0037AB5E4477818A0939F61F7DB25295E4271B8B03F209D8F498169B1F9BAE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instalator [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Czy na pewno chcesz anulowa.?</String>.. <String Id="HelpHeader">Instalator . Pomoc</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [katalog] - Instaluje, naprawia, odinstalowuje.. lub tworzy pe.n. lokaln. kopi. pakietu w katalogu. Domy.lnie jest u.ywany prze..cznik install...../passive \| /quiet - Wy.wietla ograniczony interfejs u.ytkownika bez monit.w albo nie wy.wietla ani interfejsu u.ytkownika,.. ani monit.w. Domy.lnie jest wy.wietlany interfejs u.ytkownika oraz wszystkie monity...../norestart - Pom

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1046\license.rtf

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	10656
Entropy (8bit):	5.092962528947159
Encrypted:	false
SSDEEP:	192:WIPAufWXXF0+YkR6E0/CiTS0CsGlHIMqf29H7KxLY/aYzApT3anawLXCBX2:VPAufb+YSSCYrCb5BmW4UDaTqzLwX2
MD5:	360FC4A7FFCDB915A7CF440221AFAD36
SHA1:	009F36BBDAD5B9972E8069E53855FC656EA05800
SHA-256:	9BF79B54F4D62BE501FF53EEDEB18683052A4AE38FF411750A764B3A59077F52
SHA-512:	9550A99641F194BB504A76DE011D07C1183EE1D83371EE49782FC3D05BF779415630450174DD0C03CB182A5575F6515012337B899E2D084203717D9F110A6FFE
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 TERMOS DE LICEN\'c7A PARA SOFTWARE MICROSOFT\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Estes termos de licen\'e7a formam um contrato firmado entre a Microsoft Corporation (ou com base no seu pa\'eds de resid\'eancia, uma de suas afiliadas) e voc\'ea. Eles se aplicam ao software indicado acima. Os termos tamb\'e9m se aplicam a quaisquer servi\'e7os ou atualiza\'e7\'f5es da Microsoft para o software, exceto at\'e9 a extens\'e3o de que eles tenham termos diferentes.\par..\b SE VOC\'ca CONCORDAR COM ESTES TERMOS DE LICEN\'c7A, TER\'c1 OS DIREITOS INDICADOS ABAIXO.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb120\sa120\sl240\slmult1\t

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1046\thm.wxl

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3095
Entropy (8bit):	5.150868216959352
Encrypted:	false
SSDEEP:	48:c5DiTlO5es/4ThDzmU6lDj4N3mBl0N+NWNP4hHCc9skPDXeKKeK9KfKt4eJ2RQdg:uDiTlJhJGl2UsZMLe6
MD5:	BE27B98E086D2B8068B16DBF43E18D50
SHA1:	6FAF34A36C8D9DE55650D0466563852552927603
SHA-256:	F52B54A0E0D0E8F12CBA9823D88E9FD6822B669074DD1DC69DAD6553F7CB8913
SHA-512:	3B7C773EF72D40A8B123FDB8FC11C4F354A3B152CF6D247F02E494B0770C28483392C76F3C222E3719CF500FE98F535014192ACDDD2ED9EF971718EA3EC0A73E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] Instala..o</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Tem certeza de que deseja cancelar?</String>.. <String Id="HelpHeader">Ajuda da Instala..o</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [diret.rio - instala, repara, desinstala ou.. cria uma c.pia local completa do pacote no diret.rio. Install . o padr.o..../passive \| /quiet - exibe a IU m.nima sem nenhum prompt ou n.o exibe nenhuma IU e.. nenhum prompt. Por padr.o, a IU e todos os prompts s.o exibidos...../norestart - suprime qualquer tentativa de reiniciar. Por padr.o, a IU perguntar. antes de reiniciar

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1049\license.rtf

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	31915
Entropy (8bit):	3.6440775919653996
Encrypted:	false
SSDEEP:	384:ntaMxngQEqQUaAEJxkSjjujcme51oVwuZOFsrnkGxunWxGc9wtvVYgCzkSxN1S2:npgnmWWNEvVYgCzxD
MD5:	A59C893E2C2B4063AE821E42519F9812
SHA1:	C00D0B11F6B25246357053F6620E57D990EFC698
SHA-256:	0EC8368E87B3DFC92141885A2930BDD99371526E09FC52B84B764C91C5FC47B8
SHA-512:	B9AD8223DDA2208EC2068DBB85742A03BE0291942E60D4498E3DAB4DDF559AA6DCF9879952F5819223CFC5F4CB71D4E06E4103E129727AACFB8EFE48403A04FA
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset204 Tahoma;}{\f1\fnil\fcharset0 Tahoma;}{\f2\fnil\fcharset204 Garamond;}{\f3\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang1049\'d3\'d1\'cb\'ce\'c2\'c8\'df \'cb\'c8\'d6\'c5\'cd\'c7\'c8\'c8 \'cd\'c0 \'cf\'d0\'ce\'c3\'d0\'c0\'cc\'cc\'cd\'ce\'c5 \'ce\'c1\'c5\'d1\'cf\'c5\'d7\'c5\'cd\'c8\'c5 MICROSOFT\par..\f1\lang9 MICROSOFT VISUAL C++ 2019 RUNTIME\par..\b0\f0\lang1049\'cd\'e0\'f1\'f2\'ee\'ff\'f9\'e8\'e5 \'f3\'f1\'eb\'ee\'e2\'e8\'ff \'eb\'e8\'f6\'e5\'ed\'e7\'e8\'e8 \'ff\'e2\'eb\'ff\'fe\'f2\'f1\'ff \'f1\'ee\'e3\'eb\'e0\'f8\'e5\'ed\'e8\'e5\'ec \'ec\'e5\'e6\'e4\'f3 \'ea\'ee\'f0\'ef\'ee\'f0\'e0\'f6\'e8\'e5\'e9 Microsoft (\'e8\'eb\'e8, \'e2 \'e7\'e0\'e2\'e8\'f1\'e8\'ec\'ee\'f1\'f2\'e8 \'ee\'f2 \'ec\'e5\'f1\'f2\'e0 \'e2\'e0\'f8\'e5\'e3\'ee \'ef\'f0\'ee\'e6\'e8\'e2\'e0\'ed\'e8\'ff, \'ee\

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1049\thm.wxl

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	5.444436038992627
Encrypted:	false
SSDEEP:	48:c5DiTlDhQt9esbrohDTWJt49kAr7DHN3m5GNDCNvNLIkflhrWncPingGdZwK1Kqp:uDiTlDYVgmt4xJ88k193ipzjvL
MD5:	17C652452E5EE930A7F1E5E312C17324
SHA1:	59F3308B87143D8EA0EA319A1F1A1F5DA5759DD3
SHA-256:	7333BC8E52548821D82B53DBD7D7C4AA1703C85155480CB83CEFD78380C95661
SHA-512:	53FD207B96D6BCF0A442E2D90B92E26CBB3ECC6ED71B753A416730E8067E831E9EB32981A9E9368C4CCA16AFBCB2051483FDCFC474EA8F0D652FCA934634FBE8
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.. <Control Control="InstallButton" X="275" Y="237" Width="110" Height="23"/>.... <String Id="Caption">......... ......... [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">....... .. .........</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [.......] - ........., .............., ........ ..... ........ ...... ......... ..... ...... . ......... .. ......... - ............../passive \| /quiet - ........... ....

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1055\license.rtf

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	13379
Entropy (8bit):	5.214715951393874
Encrypted:	false
SSDEEP:	192:1fGkc01jIjZTUDUTvXt2QpfC5VAlCPpDwuOfH7df3YwnnbZIWG2XjQeoO9uBO8CA:Iiqx4Uh2QpMVA8haDdv9nbZzG6oQR2
MD5:	BD2DC15DFEE66076BBA6D15A527089E7
SHA1:	8768518F2318F1B8A3F8908A056213042A377CC4
SHA-256:	62A07232017702A32F4B6E43E9C6F063B67098A1483EEDDB31D7C73EAF80A6AF
SHA-512:	9C9467A2F2D0886FF4302A44AEA89734FCEFBD3CBE04D895BCEACBA1586AB746E62391800E07B6228E054014BE51F14FF63BA71237268F94019063C8C8B7EF74
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset238 Tahoma;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT YAZILIMI L\f1\u304?SANS KO\'aaULLARI\par..\f0 MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Bu lisans ko\f1\'baullar\u305?, Microsoft Corporation (veya ya\'baad\u305?\u287?\u305?n\u305?z yere g\f0\'f6re bir ba\f1\u287?l\u305? \'bairketi) ile sizin aran\u305?zda yap\u305?lan anla\'bamay\u305? olu\'baturur. Bu ko\'baullar, yukar\u305?da ad\u305? ge\f0\'e7en yaz\f1\u305?l\u305?m i\f0\'e7in ge\'e7erlidir. \f1\'aaartlar, yaz\u305?l\u305?m i\f0\'e7in t\'fcm Microsoft hizmetleri veya g\'fcncelle\f1\'batirmeleri i\f0\'e7in, beraberlerinde farkl\f1\u305? \'baartlar bulunmad\u305?\u287?\u305? s\f0\'fcrece ge\'e7erlidir.\par..\b BU L\f1\u304?SANS \'aaARTLARINA UYDU\u286?UNUZ TAKD\u304?RDE A\'aaA\u286?IDAK\u3

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\1055\thm.wxl

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3221
Entropy (8bit):	5.280530692056262
Encrypted:	false
SSDEEP:	48:c5DiTlOaesHEqhDTHV4zVy6oBzdp0DYK2GP2ZmN3majyNXNoNKQXVvChcPc+WKb0:uDiTl3PHcIflKNTPgdi12xgg
MD5:	DEFBEA001DC4EB66553630AC7CE47CCA
SHA1:	90CED64EC7C861F03484B5D5616FDBCDA8F64788
SHA-256:	E5ABE3CB3BF84207DAC4E6F5BBA1E693341D01AEA076DD2D91EAA21C6A6CB925
SHA-512:	B3B7A22D0CDADA21A977F1DCEAF2D73212A4CDDBD298532B1AC97575F36113D45E8D71C60A6D8F8CC2E9DBF18EE1000167CFBF0B2E7ED6F05462D77E0BCA0E90
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] Kurulumu</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.ptal etmek istedi.inizden emin misiniz?</String>.. <String Id="HelpHeader">Kurulum Yard.m.</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [dizin] - y.kler, onar.r, kald.r.r ya da.. dizindeki paketin tam bir yerel kopyas.n. olu.turur. Varsay.lan install de.eridir...../passive \| /quiet - en az d.zeyde istemsiz UI g.sterir ya da hi. UI g.stermez ve.. istem yoktur. Varsay.lan olarak UI ve t.m istemler g.r.nt.lenir...../norestart - yeniden ba.lama denemelerini engeller. Varsay.lan olarak UI yeniden ba.l

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\2052\license.rtf

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	17863
Entropy (8bit):	3.9617786349452775
Encrypted:	false
SSDEEP:	192:BxoqPyOj+/8Tk5VigWgijAlk5xWvSCI5lgios0EhGXxGMLVGW+uUoqyLZDvAJxMx:vbIeaE7q3KGgzD2
MD5:	3CF16377C0D1B2E16FFD6E32BF139AC5
SHA1:	D1A8C3730231D51C7BB85A7A15B948794E99BDCE
SHA-256:	E95CA64C326A0EF7EF3CED6CDAB072509096356C15D1761646E3C7FDA744D0E0
SHA-512:	E9862FD0E8EC2B2C2180183D06535A16A527756F6907E6A1D2DB85092636F72C497508E793EE8F2CC8E0D1A5E090C6CCF465F78BC1FA8E68DAF7C68815A0EE16
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset134 SimSun;}{\f1\fnil\fcharset0 Tahoma;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9\'ce\'a2\'c8\'ed\'c8\'ed\'bc\'fe\'d0\'ed\'bf\'c9\'cc\'f5\'bf\'ee\f1\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0\f0\'d5\'e2\'d0\'a9\'d0\'ed\'bf\'c9\'cc\'f5\'bf\'ee\'ca\'c7\f1 Microsoft Corporation\f0\'a3\'a8\'bb\'f2\'c4\'fa\'cb\'f9\'d4\'da\'b5\'d8\'b5\'c4\f1 Microsoft \f0\'b9\'d8\'c1\'aa\'b9\'ab\'cb\'be\'a3\'a9\'d3\'eb\'c4\'fa\'d6\'ae\'bc\'e4\'b4\'ef\'b3\'c9\'b5\'c4\'d0\'ad\'d2\'e9\'a1\'a3\'d5\'e2\'d0\'a9\'cc\'f5\'bf\'ee\'ca\'ca\'d3\'c3\'d3\'da\'c9\'cf\'ca\'f6\'c8\'ed\'bc\'fe\'a1\'a3\'d5\'e2\'d0\'a9\'cc\'f5\'bf\'ee\'d2\'b2\'ca\'ca\'d3\'c3\'d3\'da\'d5\'eb\'b6\'d4\'b8\'c3\'c8\'ed\'bc\'fe\'b5\'c4\'c8\'ce\'ba\'ce\'ce\'a2\'c8\'ed\'b7\'fe\'ce\'f1\'bb\'f2\'b8\'fc\'d0\'c2\'a3\'ac\'b5\'ab\'d3\'d0\'b2\'bb\'cd\

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\2052\thm.wxl

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2978
Entropy (8bit):	6.135205733555905
Encrypted:	false
SSDEEP:	48:c5DiTlOtKesi+hDtkQf7lz+W0gopN3m5+3cNONeN1ra8vWqPtlTKxKUTKlKXRoR+:uDiTlV5kQR9GLeE0ZxV6gIV
MD5:	3D1E15DEEACE801322E222969A574F17
SHA1:	58074C83775E1A884FED6679ACF9AC78ABB8A169
SHA-256:	2AC8B7C19A5189662DE36A0581C90DBAD96DF259EC00A28F609B644C3F39F9CA
SHA-512:	10797919845C57C5831234E866D730EBD13255E5BF8BA8087D53F1D0FC5D72DC6D5F6945DBEBEE69ACC6A2E20378750C4B78083AE0390632743C184532358E10
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [..] - .......... ..................Install ........../passive \| /quiet - ..... UI ......... UI ... ........ UI ........../norestart - ..................... UI.../log log.txt - ............. %TEMP% ...

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\3082\license.rtf

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	10714
Entropy (8bit):	5.122578090102117
Encrypted:	false
SSDEEP:	192:WthGE/9wd8eQF/hJOmQeNrXT77uOlQ+v3AqHqc3wpXGYdjvsk2cwBb2:mhGuhj+ed388Bb2
MD5:	FBF293EE95AFEF818EAF07BB088A1596
SHA1:	BBA1991BA6459C9F19B235C43A9B781A24324606
SHA-256:	1FEC058E374C20CB213F53EB3C44392DDFB2CAA1E04B7120FFD3FA7A296C83E2
SHA-512:	6971F20964EF74B19077EE81F953342DC6D2895A8640EC84855CECCEA5AEB581E6A628BCD3BA97A5D3ACB6CBE7971FDF84EF670BDDF901857C3CD28855212019
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 T\'c9RMINOS DE LA LICENCIA DE SOFTWARE DE MICROSOFT\par..MICROSOFT VISUAL C++ 2019 RUNTIME\par..\b0 Estos t\'e9rminos de licencia constituyen un contrato entre Microsoft Corporation (o, en funci\'f3n de donde resida, una de sus filiales) y usted. Se aplican al software antes mencionado. Los t\'e9rminos tambi\'e9n se aplican a cualquier servicio o actualizaci\'f3n de Microsoft para el software, excepto en la medida que tengan t\'e9rminos diferentes.\par..\b SI USTED CUMPLE CON LOS PRESENTES T\'c9RMINOS DE ESTA LICENCIA, DISPONDR\'c1 DE LOS DERECHOS QUE SE DESCRIBEN A CONTINUACI\'d3N.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb120\sa120\

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\3082\thm.wxl

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3265
Entropy (8bit):	5.0491645049584655
Encrypted:	false
SSDEEP:	48:c5DiTlO/esS6VGhDv4tiUiyRUqzC4U+aD6N3m7xNh1NWNGbPz+9o3PWeKK9K9KfT:uDiTlxouUTiySqyIwz9sgxqvjIk8
MD5:	47F9F8D342C9C22D0C9636BC7362FA8F
SHA1:	3922D1589E284CE76AB39800E2B064F71123C1C5
SHA-256:	9CBB2B312C100B309A1B1495E84E2228B937612885F7A642FBBD67969B632C3A
SHA-512:	E458DF875E9B0622AEBE3C1449868AA6A2826A1F851DB71165A872B2897CF870CCF85046944FF51FFC13BB15E54E9D9424EC36CAF5A2F38CE8B7D6DC0E9B2363
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instalaci.n de [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.Est. seguro de que desea cancelar la operaci.n?</String>.. <String Id="HelpHeader">Ayuda de configuraci.n</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - instala, repara, desinstala o.. crea una copia local completa del paquete en el directorio. La opci.n predeterminada es la instalaci.n...../passive \| /quiet - muestra una IU m.nima sin solicitudes o no muestra ninguna IU ni.. solicitud. De forma predeterminada, se muestran la IU y todas las solicitudes...../norestart - elimina cualquier intento

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\BootstrapperApplicationData.xml

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (591), with CRLF line terminators
Category:	dropped
Size (bytes):	13188
Entropy (8bit):	3.72805455167576
Encrypted:	false
SSDEEP:	192:X0s1HDnH5zHqQHG0Hd8Hz7HE06HA0rH3p9pycxLU7OzLG0L3jcBx7z8NkzzkvQYn:X0spdLbmnoNYQkyJ7jnVEpJEX
MD5:	215C04E42ACC38479298AEBD4F36435C
SHA1:	5EF4A4B6A23288077D52E1192665D1F0CEA7ECF4
SHA-256:	2E69B9B7C1695676C15B354F53BCB56257EC79799C6853FECA480CBC9DDAA5FD
SHA-512:	C598C562F8BF97C4532E57ED8381B5DEBBEF3EC243FD5BCC7367621B7AC50B648D9822594B12AB6BD6BFB3223B7992AA00EEA205C3CD8770049C6E6173752E6A
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.W.i.x.B.a.l.C.o.n.d.i.t.i.o.n. .C.o.n.d.i.t.i.o.n.=.".V.e.r.s.i.o.n.N.T.6.4. .&.g.t.;.=. .v.6...0. .O.R. .(.V.e.r.s.i.o.n.N.T.6.4. .=. .v.5...2. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .1.).". .M.e.s.s.a.g.e.=.".[.W.i.x.B.u.n.d.l.e.N.a.m.e.]. .c.a.n. .o.n.l.y. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .W.i.n.d.o.w.s. .X.P. .S.P.1. .(.x.6.4.). .a.n.d. .n.e.w.e.r. .p.l.a.t.f.o.r.m.s...". ./.>..... . .<.W.i.x.B.u.n.d.l.e.P.r.o.p.e.r.t.i.e.s. .D.i.s.p.l.a.y.N.a.m.e.=.".M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.5.-.2.0.1.9. .R.e.d.i.s.t.r.i.b.u.t.a.b.l.e. .(.x.6.4.). .-. .1.4...2.4...2.8.1.2.7.". .L.o.g.P.a.t.h.V.a.r.i.a.b.l.e.=.".W.i.x.B.u.n.d.l.e.L.o.g.". .C.o.m.p.r.e.s.s.e.d.=.".y.e.

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\license.rtf

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	9046
Entropy (8bit):	5.157073875669985
Encrypted:	false
SSDEEP:	192:W8lZ1UVDWkgWZTIsvPhghtQ1Qf4lCfnEtHixEGx736wHqItfSpOy2:9T15WZMgAYlOnjt5HLoL2
MD5:	2EABBB391ACB89942396DF5C1CA2BAD8
SHA1:	182A6F93703549290BCDE92920D37BC1DEC712BB
SHA-256:	E3156D170014CED8D17A02B3C4FF63237615E5C2A8983B100A78CB1F881D6F38
SHA-512:	20D656A123A220CD3CA3CCBF61CC58E924B44F1F0A74E70D6850F39CECD101A69BCE73C5ED14018456E022E85B62958F046AA4BD1398AA27303C2E86407C3899
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT SOFTWARE LICENSE TERMS\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 These license terms are an agreement between Microsoft Corporation (or based on where you live, one of its affiliates) and you. They apply to the software named above. The terms also apply to any Microsoft services or updates for the software, except to the extent those have different terms.\par..\b IF YOU COMPLY WITH THESE LICENSE TERMS, YOU HAVE THE RIGHTS BELOW.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb120\sa120\sl240\slmult1\tx360 INSTALLATION AND USE RIGHTS. \b0\par....\pard{\pntext\f2\'B7\tab}{\*\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-363\

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\logo.png

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1861
Entropy (8bit):	6.868587546770907
Encrypted:	false
SSDEEP:	24:q36cnTKM/3kTIQiBmYKHeQWalGt1Sj9kYIt1uZ+bYOQe0IChR95aW:qqiTKMPuUBm7eQJGtYJM1uZCVszaW
MD5:	D6BD210F227442B3362493D046CEA233
SHA1:	FF286AC8370FC655AEA0EF35E9CF0BFCB6D698DE
SHA-256:	335A256D4779EC5DCF283D007FB56FD8211BBCAF47DCD70FE60DED6A112744EF
SHA-512:	464AAAB9E08DE610AD34B97D4076E92DC04C2CDC6669F60BFC50F0F9CE5D71C31B8943BD84CEE1A04FB9AB5BBED3442BD41D9CB21A0DD170EA97C463E1CE2B5B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...@...@.............sRGB.........gAMA......a.....PLTE].q^.r_.r_.s`.s`.s`.ta.ta.ub.ub.vc.vd.vd.vd.we.we.xe.xg.yg yg zh zh"zi"{j#\|i${j$\|n~n.n,.o,.p..q0.r2.s3.t5.x;.x<.y>.z?.\|B.~C.}E..F..F..H..I..J..L..O..P..W..Y..^..a..c..g..i..q..r..}.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S......pHYs..%...%....^.....tEXtSoftware.Paint.NET v3.5.100.r.....IDATXG..iW.@...EJ.$M...`AEpG..7TpWT@\.."....(..(.._;...di:9.c>q..g....T...._...-....F..+..w.

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\thm.wxl

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2952
Entropy (8bit):	5.052095286906672
Encrypted:	false
SSDEEP:	48:c5DiTl/+desK19hDUNKwsqq8+JIDxN3mt7NlN1NVvAdMcgLPDHVXK8KTKjKnSnYF:uDiTl/BbTxmup/vrxATd
MD5:	FBFCBC4DACC566A3C426F43CE10907B6
SHA1:	63C45F9A771161740E100FAF710F30EED017D723
SHA-256:	70400F181D00E1769774FF36BCD8B1AB5FBC431418067D31B876D18CC04EF4CE
SHA-512:	063FB6685EE8D2FA57863A74D66A83C819FE848BA3072B6E7D1B4FE397A9B24A1037183BB2FDA776033C0936BE83888A6456AAE947E240521E2AB75D984EE35E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29" />.... <String Id="Caption">[WixBundleName] Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installs, repairs, uninstalls or.. creates a complete local copy of the bundle in directory. Install is the default...../passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt before restart.../log log.txt - logs to a specific file. B

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\thm.xml

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8332
Entropy (8bit):	5.184632608060528
Encrypted:	false
SSDEEP:	96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
MD5:	F62729C6D2540015E072514226C121C7
SHA1:	C1E189D693F41AC2EAFCC363F7890FC0FEA6979C
SHA-256:	F13BAE0EC08C91B4A315BB2D86EE48FADE597E7A5440DCE6F751F98A3A4D6916
SHA-512:	CBBFBFA7E013A2B85B78D71D32FDF65323534816978E7544CA6CEA5286A0F6E8E7E5FFC4C538200211F11B94373D5658732D5D8AA1D01F9CCFDBF20F154F1471
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="485" Height="300" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="500" Foreground="000000">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.... <Image X="11" Y="11" Width="64" Height="64" ImageFile="logo.png" Visible="yes"/>.. <Text X="80" Y="11" Width="-11" Heig

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.ba\wixstdba.dll

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	195600
Entropy (8bit):	6.682530937585544
Encrypted:	false
SSDEEP:	3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
MD5:	EAB9CAF4277829ABDF6223EC1EFA0EDD
SHA1:	74862ECF349A9BEDD32699F2A7A4E00B4727543D
SHA-256:	A4EFBDB2CE55788FFE92A244CB775EFD475526EF5B61AD78DE2BCDFADDAC7041
SHA-512:	45B15ADE68E0A90EA7300AEB6DCA9BC9E347A63DBA5CE72A635957564D1BDF0B1584A5E34191916498850FC7B3B7ECFBCBFCB246B39DBF59D47F66BC825C6FD2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3..R...R...R..h.N..R..h.L.R..h.M..R.......R.......R.......R...<..R...,..R...R...S..K....R..K....R..N.@..R...R(..R..K....R..Rich.R..................PE..L......Z...........!................d.....................................................@..............................................................D......,.......T...............................@...............X............................text............................... ..`.rdata.............................@..@.data...............................@....gfids..............................@..@.rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	647904
Entropy (8bit):	7.216534710571963
Encrypted:	false
SSDEEP:	12288:BnMwHskY7gjcjhVIEhqgM7bWvcsi6aVHPIyacHwXK4Qzh+jMlWCEhG:VMysZgjS1hqgSC/izvffHwiz0wyG
MD5:	94970FC3A8ED7B9DE44F4117419CE829
SHA1:	AA1292F049C4173E2AB60B59B62F267FD884D21A
SHA-256:	DE1ACBB1DF68A39A5B966303AC1B609DDE2688B28EBF3EBA8D2ADEEB3D90BF5E
SHA-512:	B17BD215B83BFA46512B73C3D9F430806CA3BEA13BEBDE971E8EDD972614E54A7BA3D6FC3439078CDFDAA7EEB1F3F9054BF03ED5C45B622B691B968D4EC0566F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'.u.'.u.'.u.......u.....[.u.....?.u...v.4.u...q.4.u...p...u.....".u....6.u.'.t.v.u...p.l.u....&.u.'..%.u...w.&.u.Rich'.u.........................PE..L......Z.....................v......m.............@..........................p.......r....@..............................................;...............$...0...=.. t..T...................tt......@n..@...................$........................text.............................. ..`.rdata..............................@..@.data...@...........................@....wixburn8...........................@..@.tls................................@....gfids..............................@..@.rsrc....;.......<..................@..@.reloc...=...0...>..................@..B........................................................................................................................................................

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	Microsoft Cabinet archive data, many, 5688889 bytes, 14 files, at 0x44 +A "mfc140.dll" +A "mfc140chs.dll", flags 0x4, number 1, extra bytes 20 in head, 380 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	5705657
Entropy (8bit):	7.997088214823493
Encrypted:	true
SSDEEP:	98304:TJncNVoD2JrjTugGqM/Oi2dggyek4+Sz8O9mM51QYECjGMU37R:TySD2tugs2ick4O/M51ZECjGPR
MD5:	EEBCBF53D71F0E5019DE2F658EC94C7F
SHA1:	6D527EBE33DA1AF50E0D62E74834C0667BAFDED6
SHA-256:	048EFE883691244C917A68C0833343E12BB93613EB93831ADB943547A3597E0C
SHA-512:	0832109C420787360AF2ADF44600ECEEE021255B3F9B236FC962BB51D8899DC3834350B96DDFEF438A8654153B57F589F891E9E267D8E34A1453198EF4D58088
Malicious:	false
Reputation:	low
Preview:	MSCF....9.V.....D...........................9.V..A..............\|....EX.......;O. .mfc140.dll......EX...;O. .mfc140chs.dll.....0.X...;O. .mfc140cht.dll..)..H.Y...;O. .mfc140deu.dll.....X.Z...;O. .mfc140enu.dll..%..p.[...;O. .mfc140esn.dll..)....]...;O. .mfc140fra.dll..!...1^...;O. .mfc140ita.dll......R_...;O. .mfc140jpn.dll......+`...;O. .mfc140kor.dll.......a...;O. .mfc140rus.dll...X...b...;O. .mfc140u.dll..........;O.. .mfcm140.dll.....0`....;O.. .mfcm140u.dll.....48..CK.:{\|L.{..d"..5.W.T.x....mC.f.={4. NKi.."eR.C5.92.g.^..sQ..J4$.h'..x.ZD{..t.CE.y`.Z.={......~......o...;F.y%..q..~.^.+.....?:...?.7.+.9.X."..c.93..r..}e....s...^....7G7s....X......k....={..z.7==....8...:.7..Z...~../..z.R....]'......\.>........9.qm..Lpt=[[.~~fv.....#9n._...g.3I.k.z.b#...=.....)g`M..../>Gp\.,.8...,2vSK..}.I<$..0{L8.Gn.%..n.....+M\.{Zp.0.z.\.......<.k?W...y.K}...b.sjE..)....q\|.....P........Xj`....x.3..7m.u........ ...2.gd\S.^6..N....L....IG.3.gh.~3...W..L.......

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\cab5046A8AB272BF37297BB7928664C9503

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	Microsoft Cabinet archive data, many, 1505777 bytes, 51 files, at 0x44 +A "api_ms_win_core_console_l1_1_0.dll" +A "api_ms_win_core_datetime_l1_1_0.dll", flags 0x4, number 1, extra bytes 20 in head, 130 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1522785
Entropy (8bit):	7.995909715275866
Encrypted:	true
SSDEEP:	24576:ssN0Z7das2plqMzlvb9oruGL/N6YOOfTRgPVgXIpf/0TOGCQTPr+PaA72drPCaCl:ZI7das2plnzOua/NoOfO9gAkPrsaAErq
MD5:	6D712A35B36AB2B3DACB5174502BCE39
SHA1:	52A92EF8FFB1E096172BB5A86BD4672B0399BCE1
SHA-256:	99A29834AE7F3E1CC6D49458C4957F709F73455726AB28F21F746739C4966C22
SHA-512:	604E091715FC72522936830734A19B4348F7FAF246C6753885FC2B59AD770E609EE6734D0F257459527FAA0B7B71AF08F2A77488FD9CA61514509A5DEAA2CC6A
Malicious:	false
Reputation:	low
Preview:	MSCF............D...........3...................pB...................O........;O. .api_ms_win_core_console_l1_1_0.dll..M...O....;O. .api_ms_win_core_datetime_l1_1_0.dll..M..0.....;O. .api_ms_win_core_debug_l1_1_0.dll..M..H.....;O. .api_ms_win_core_errorhandling_l1_1_0.dll..[..`6....;O. .api_ms_win_core_file_l1_1_0.dll..M..x.....;O. .api_ms_win_core_file_l1_2_0.dll..M........;O. .api_ms_win_core_file_l2_1_0.dll..M...,....;O. .api_ms_win_core_handle_l1_1_0.dll..O...y....;O. .api_ms_win_core_heap_l1_1_0.dll..M........;O. .api_ms_win_core_interlocked_l1_1_0.dll..O........;O. .api_ms_win_core_libraryloader_l1_1_0.dll..W...d....;O. .api_ms_win_core_localization_l1_2_0.dll..O........;O. .api_ms_win_core_memory_l1_1_0.dll..M........;O. .api_ms_win_core_namedpipe_l1_1_0.dll..Q..(X....;O. .api_ms_win_core_processenvironment_l1_1_0.dll..U..@.....;O. .api_ms_win_core_processthreads_l1_1_0.dll..O..P.....;O. .api_ms_win_core_processthreads_l1_1_1.dll..K..hM....;O. .api_ms_win_core_

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\vcRuntimeAdditional_x64

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X64 Additional Runtime - 14.24.28127., Template: x64;1033, Revision Number: {1FCB6B93-B382-48B7-9485-A319D74F4F84}, Create Time/Date: Sat Sep 28 04:34:06 2019, Last Saved Time/Date: Sat Sep 28 04:34:06 2019, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	6.370952181269759
Encrypted:	false
SSDEEP:	3072:3viOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJd:3vipBaTDo1j//SZh
MD5:	1E871A0EB07A607D139A51C51FD42905
SHA1:	390AE27A35BDDFC7771D276BFDF2E0333F89D1A6
SHA-256:	057B0C94F2E0296A8999E7D55EFBFB4F4BC3114234607FE40FA5322E20D30489
SHA-512:	FF55CA28EAF9D5A46719374A52111920F8A1EBF1D4E0B038B0DF243458D958803BF51FBCF0F5193BA2C4183D0FAB48154CD16C5FBC9B263FF2666EF2028046B1
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\vcRuntimeMinimum_x64

Download File

Process:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.24.28127., Template: x64;1033, Revision Number: {5302C21D-28E2-4694-AA81-CE2C11CA6D8B}, Create Time/Date: Sat Sep 28 04:31:14 2019, Last Saved Time/Date: Sat Sep 28 04:31:14 2019, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
Category:	dropped
Size (bytes):	192512
Entropy (8bit):	6.272664277384492
Encrypted:	false
SSDEEP:	3072:fviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJd8:fvipBaTDo1j//SZh8
MD5:	8AFD17A99D45A0E06F0A3A26CC156972
SHA1:	9087FD5435706A68768F9B8CFB73AFC6C3933935
SHA-256:	7E25CDA9F7D9298DF4C2070D2215C35159A7753DA01440416F37BB361811E173
SHA-512:	BA29CC9EDAB7EEE980D1AA8ECC73E1015AA053C118D9C3595D1736C010300D36C396537AF78A399E347C656C2F5776D20EB81E037614585650E78CE3D66B5792
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe

Download File

Process:	C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	647904
Entropy (8bit):	7.216534710571963
Encrypted:	false
SSDEEP:	12288:BnMwHskY7gjcjhVIEhqgM7bWvcsi6aVHPIyacHwXK4Qzh+jMlWCEhG:VMysZgjS1hqgSC/izvffHwiz0wyG
MD5:	94970FC3A8ED7B9DE44F4117419CE829
SHA1:	AA1292F049C4173E2AB60B59B62F267FD884D21A
SHA-256:	DE1ACBB1DF68A39A5B966303AC1B609DDE2688B28EBF3EBA8D2ADEEB3D90BF5E
SHA-512:	B17BD215B83BFA46512B73C3D9F430806CA3BEA13BEBDE971E8EDD972614E54A7BA3D6FC3439078CDFDAA7EEB1F3F9054BF03ED5C45B622B691B968D4EC0566F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'.u.'.u.'.u.......u.....[.u.....?.u...v.4.u...q.4.u...p...u.....".u....6.u.'.t.v.u...p.l.u....&.u.'..%.u...w.&.u.Rich'.u.........................PE..L......Z.....................v......m.............@..........................p.......r....@..............................................;...............$...0...=.. t..T...................tt......@n..@...................$........................text.............................. ..`.rdata..............................@..@.data...@...........................@....wixburn8...........................@..@.tls................................@....gfids..............................@..@.rsrc....;.......<..................@..@.reloc...=...0...>..................@..B........................................................................................................................................................

C:\Windows\Temp\~DF003125CA79801861.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0122170E34194D07.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10222504097967976
Encrypted:	false
SSDEEP:	12:50i8n0itFzDHFb7A9hhh9salT5rEIpDr01:mF0mli9sYTHC
MD5:	25B517010A5A30A8CF380298E3AEB947
SHA1:	6D022D72BE594594FB3D473CF93312EF2768BE04
SHA-256:	DDD6E364DD1BC12CF294F393191534A7BAD197C0FDDB7F9995F123FCEEF7F98D
SHA-512:	EA6BEC60229852E1E2FC862C5C82A227C403FE3CC936B5420BC8047FDC1031747B1299A4068BC042D9FE64711F3740FA0968E8B540499DC66C159508C07DE83A
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0201767296D34379.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.221433218073777
Encrypted:	false
SSDEEP:	48:yeRulq4vFXioT5RPdrF26RLjxL3OCDf2SmRSZASIVRZsc5i:FRuVT3l0aLVL3OC72VR/JRZsc
MD5:	BFA5BE1FF65F477418D299BEC578BD9A
SHA1:	68701EF67E4D0B1CAE866783B99BF0B09A2DDD55
SHA-256:	0E3B01E443F9F587D9437563DAD6E1CF14739298020FCC997FD18C7BEF6FDEEE
SHA-512:	E0EE7E79CEF5799172C815E0721F5336A27A1CD6F5A51C13E6F3B2453D70D7958148C33749CCFB07A0B9ACD8BE3DE0C37BD6587D49DA8AA0DFE37A1FA2290E79
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0C5A67D8846FDA91.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF21B07CAC25D40D4B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5195560925397626
Encrypted:	false
SSDEEP:	48:88PhpuRc06WXinjT5xzbdUxl26jcj7SmRSZASIUZ0Nx:Thp1pjTHdnoy7VR/IZ
MD5:	EE42FFBAC37FAF1A9E04324AF1DABD70
SHA1:	B61D292CE41635323ADDC53A7757A9521BF5C2DD
SHA-256:	09E43EEFB14A6E2466FE81C3ABA7823C1B2A7DFDA3D7203F0FB5CB6A6322AD85
SHA-512:	D227D714755C708654B6F67570BE6537E7CDB6F0DD63C9648321DAB95ADF95FFB8C7FE4105EF9445E208D9DE50320FA0BFBFFAC2F10EACF92FD940A76A4E96C5
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF24318C64CAB6AE03.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5247422966155266
Encrypted:	false
SSDEEP:	48:J8PhpuRc06WXi7jT5xPdrF26RLjxL3OCDf2SmRSZASIVRZsc5i:Ehp11jTHl0aLVL3OC72VR/JRZsc
MD5:	095C3A5270770715DBC325537A79519D
SHA1:	4BB21AA4A37988844C607D8C7FA831A07B97D424
SHA-256:	101409F6DD5FDF01B675B5381F67F216D079E098B5101434F46AB48353EB1E2A
SHA-512:	35E1726696394F11327416ACA86F1B421B874144C5E2725A3BBCC9E204CEB9E6A0CE7B587BCE9E0322065D339CB7A196E04A5BD42231105BA52FDAB02DCA7275
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3282BDA4098B88A0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.221433218073777
Encrypted:	false
SSDEEP:	48:yeRulq4vFXioT5RPdrF26RLjxL3OCDf2SmRSZASIVRZsc5i:FRuVT3l0aLVL3OC72VR/JRZsc
MD5:	BFA5BE1FF65F477418D299BEC578BD9A
SHA1:	68701EF67E4D0B1CAE866783B99BF0B09A2DDD55
SHA-256:	0E3B01E443F9F587D9437563DAD6E1CF14739298020FCC997FD18C7BEF6FDEEE
SHA-512:	E0EE7E79CEF5799172C815E0721F5336A27A1CD6F5A51C13E6F3B2453D70D7958148C33749CCFB07A0B9ACD8BE3DE0C37BD6587D49DA8AA0DFE37A1FA2290E79
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3730083EC0EDD02F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10360060396516056
Encrypted:	false
SSDEEP:	6:xPLG7iVCnLG7iVrKOzPLHKObtffSzAs00eM9TEkLeERU32glIVky6l80t/:50i8n0itFzDHFJfrt4RRUmgp801
MD5:	59F99DA8B18785B45DF1F6CAEABC7598
SHA1:	69D92E6A654FAF819DA09C04F7F001C61FD5549F
SHA-256:	9F688F5AE631E02C6E3E6F78452F900D7AF6333AD0B4B19E9F4C16C8222D92FC
SHA-512:	347E080B5F24DD7E920996176B7E36CEE72DE0302CA0477FBB0882DDF018702912F8143C5D6FE86AE0BCF0E08AED7BCE29DF03379F4BE37354800B36D27C9AF0
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF38EF24FE57896F6B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3A71E3447206F7E3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF420BF3D4DAD4CB18.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF43C8DA185D7F3727.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2176806213581626
Encrypted:	false
SSDEEP:	48:ukRu7q4vFXisT5RzbdUxl26jcj7SmRSZASIUZ0Nx:zRgZT3dnoy7VR/IZ
MD5:	0F6F5F1B2A8EF3C75A671C80BFE5785B
SHA1:	1F5AAF32CA682B5976741AC85634B9002460E591
SHA-256:	22B25BBBE22D064168D47270E3058BEBE160EA2084AB1CAD644D88548CF6EEB3
SHA-512:	29E774C95B10DF697592063CE3C362039F0120A1D6C5C5CB044FE9222D514983BA2FDEEF327EA1DD20E59E0BEEB14E071B1848B8D5D655F91FA89734FCCBCE9F
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4633E650A552A41A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5195560925397626
Encrypted:	false
SSDEEP:	48:88PhpuRc06WXinjT5xzbdUxl26jcj7SmRSZASIUZ0Nx:Thp1pjTHdnoy7VR/IZ
MD5:	EE42FFBAC37FAF1A9E04324AF1DABD70
SHA1:	B61D292CE41635323ADDC53A7757A9521BF5C2DD
SHA-256:	09E43EEFB14A6E2466FE81C3ABA7823C1B2A7DFDA3D7203F0FB5CB6A6322AD85
SHA-512:	D227D714755C708654B6F67570BE6537E7CDB6F0DD63C9648321DAB95ADF95FFB8C7FE4105EF9445E208D9DE50320FA0BFBFFAC2F10EACF92FD940A76A4E96C5
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5FC6267473E01771.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6E6B22D63F84A7FB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.221433218073777
Encrypted:	false
SSDEEP:	48:yeRulq4vFXioT5RPdrF26RLjxL3OCDf2SmRSZASIVRZsc5i:FRuVT3l0aLVL3OC72VR/JRZsc
MD5:	BFA5BE1FF65F477418D299BEC578BD9A
SHA1:	68701EF67E4D0B1CAE866783B99BF0B09A2DDD55
SHA-256:	0E3B01E443F9F587D9437563DAD6E1CF14739298020FCC997FD18C7BEF6FDEEE
SHA-512:	E0EE7E79CEF5799172C815E0721F5336A27A1CD6F5A51C13E6F3B2453D70D7958148C33749CCFB07A0B9ACD8BE3DE0C37BD6587D49DA8AA0DFE37A1FA2290E79
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF85BF376B9587917B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2176806213581626
Encrypted:	false
SSDEEP:	48:ukRu7q4vFXisT5RzbdUxl26jcj7SmRSZASIUZ0Nx:zRgZT3dnoy7VR/IZ
MD5:	0F6F5F1B2A8EF3C75A671C80BFE5785B
SHA1:	1F5AAF32CA682B5976741AC85634B9002460E591
SHA-256:	22B25BBBE22D064168D47270E3058BEBE160EA2084AB1CAD644D88548CF6EEB3
SHA-512:	29E774C95B10DF697592063CE3C362039F0120A1D6C5C5CB044FE9222D514983BA2FDEEF327EA1DD20E59E0BEEB14E071B1848B8D5D655F91FA89734FCCBCE9F
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8F0404517929DC51.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF903ED78646017631.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2176806213581626
Encrypted:	false
SSDEEP:	48:ukRu7q4vFXisT5RzbdUxl26jcj7SmRSZASIUZ0Nx:zRgZT3dnoy7VR/IZ
MD5:	0F6F5F1B2A8EF3C75A671C80BFE5785B
SHA1:	1F5AAF32CA682B5976741AC85634B9002460E591
SHA-256:	22B25BBBE22D064168D47270E3058BEBE160EA2084AB1CAD644D88548CF6EEB3
SHA-512:	29E774C95B10DF697592063CE3C362039F0120A1D6C5C5CB044FE9222D514983BA2FDEEF327EA1DD20E59E0BEEB14E071B1848B8D5D655F91FA89734FCCBCE9F
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB0FF1DC62ED73468.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5247422966155266
Encrypted:	false
SSDEEP:	48:J8PhpuRc06WXi7jT5xPdrF26RLjxL3OCDf2SmRSZASIVRZsc5i:Ehp11jTHl0aLVL3OC72VR/JRZsc
MD5:	095C3A5270770715DBC325537A79519D
SHA1:	4BB21AA4A37988844C607D8C7FA831A07B97D424
SHA-256:	101409F6DD5FDF01B675B5381F67F216D079E098B5101434F46AB48353EB1E2A
SHA-512:	35E1726696394F11327416ACA86F1B421B874144C5E2725A3BBCC9E204CEB9E6A0CE7B587BCE9E0322065D339CB7A196E04A5BD42231105BA52FDAB02DCA7275
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB3D23FCEF91FAE63.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.126590905487
Encrypted:	false
SSDEEP:	48:4CZsc5fVmS9SmRSZIDf8GrdrF26RLjxLL:1ZscDmkVRl78G50aLVLL
MD5:	E765B3109A6B30107C9BDD64B3153B7D
SHA1:	1E89B5F4825577A8EABA95DCEF224CC4B3FD34B7
SHA-256:	CA0856D69BA8479712EF6180F273F708CAE8CB1EA6EB6FD8B56C458BCB6B2267
SHA-512:	6A63CDACF049F95D8607FC129B5EB0459FEC2CD931C8DB29109ED37411B2F045AF77471D003E8DB869F906F7B91A823112908B125323D83C62FBA9C1DEAC8105
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB81CCD36517B1E9A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBE53C4299B02849C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC882F4703D093197.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.12439913548665962
Encrypted:	false
SSDEEP:	24:YXixiZaBXXYsjipVvipVsS0W1V8gNlGFeG+JGdMClfXixl2MClmVj3mru:vxiZ0XdS9SmRSZNGcGdUxl26su
MD5:	FC96507254C547655B4F37AE2EE42C7D
SHA1:	61C8B766484472AD6D812130CBE01785D1B26429
SHA-256:	4FBFFEF240566F6EC4AF36F9B49E6D8416059B92231F0E2A1CB0CFE99283B85D
SHA-512:	EE4D1562A7408E910EAD5FC3365C78CB1BA0D979BC9C160AFF0123BEF146044E8FD0D4939BF53B1DF9A2ED4C9A203881A56141126BC30A6E5063B1962D0F5991
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF2863EA49E235E47.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

⊘No static file info

File Icon


Icon Hash:	b29a8a8e86868381

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 26, 2024 19:38:19.962683916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:19.962718010 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:19.962996960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:19.963067055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:19.963078976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.236598015 CET	60207	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.236635923 CET	443	60207	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.236764908 CET	60207	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.236927986 CET	60207	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.236941099 CET	443	60207	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.311804056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.312139034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.312151909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.313298941 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.313999891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.314743042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.314840078 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.314856052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.356609106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.368128061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.368139029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.416079998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.576093912 CET	443	60207	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.576756001 CET	60207	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.576765060 CET	443	60207	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.577683926 CET	443	60207	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.577915907 CET	60207	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.578346968 CET	60207	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.578449965 CET	443	60207	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.623626947 CET	60207	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.623655081 CET	443	60207	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.640785933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.666388035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.666393042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.666454077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.666461945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.666498899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.666584969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.666584969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.666601896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.666662931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.666662931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.666676044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.666687965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.666857958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.670408010 CET	60207	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.694449902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.694464922 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.694688082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.694688082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.694701910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.694792032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.737847090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.822046041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.822051048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.822113991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.822208881 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.822258949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.822259903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.822276115 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.822284937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.822365046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.822495937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.854640961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.854656935 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.854849100 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.854849100 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.854863882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.854895115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.855041027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.884948015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.884963036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.885127068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.885127068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.885181904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.885194063 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.885313988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.885488033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.973002911 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.973015070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.973191977 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.973273993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.973284006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.973292112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.973453045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.994824886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.994836092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.995033026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.995033026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.995045900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:20.995053053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.995053053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:20.995182991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.020076990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.020088911 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.020315886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.020315886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.020327091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.020335913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.020546913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.039798021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.039810896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.039964914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.040013075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.040013075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.040024042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.040081978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.040319920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.063853979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.063889980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.064048052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.064048052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.064062119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.064068079 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.064141035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.064141989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.064233065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.085278034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.085290909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.085495949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.085602045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.085609913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.085800886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.103965998 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.103979111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.104212046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.104223013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.104300022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.104391098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.124161005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.124172926 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.124386072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.124386072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.124397039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.124404907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.124536037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.155267000 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.155292988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.155508041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.155508041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.155519009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.155527115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.155756950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.167901039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.167913914 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.168049097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.168049097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.168096066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.168096066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.168104887 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.168180943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.168273926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.182622910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.182635069 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.182885885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.182895899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.182904005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.183059931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.195794106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.195806026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.196002960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.196099997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.196108103 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.196281910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.209608078 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.209619999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.209822893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.209822893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.209836006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.209844112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.209925890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.210016966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.222234011 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.222251892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.222419024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.222524881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.222534895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.222693920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.235266924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.235285997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.235415936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.235462904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.235464096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.235472918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.235543013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.235543013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.235618114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.248681068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.248716116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.248944998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.248944998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.248955965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.249114990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.260782957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.260801077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.260992050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.260992050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.261004925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.261004925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.261010885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.261074066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.261149883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.272991896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.273010015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.273180962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.273286104 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.273298979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.273499966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.282888889 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.282907963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.283065081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.283179045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.283190012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.283365011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.292870045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.292882919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.293090105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.293148994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.293148994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.293159962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.293323040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.303637028 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.303662062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.303816080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.303881884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.303891897 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.303900003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.304050922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.313369036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.313397884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.313600063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.313610077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.313646078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.313793898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.321443081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.321469069 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.321640015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.321749926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.321760893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.321950912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.328861952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.328887939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.329070091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.329092979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.329180002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.329318047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.336539984 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.336554050 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.336719036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.336848021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.336857080 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.337017059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.344424009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.344449997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.344593048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.344593048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.344722986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.344732046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.344894886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.351774931 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.351804018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.351979017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.351989031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.352061033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.352200985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.358481884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.358493090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.358751059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.358761072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.358813047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.358916044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.365556002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.365571022 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.365704060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.365704060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.365751028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.365756989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.365799904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.365799904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.365897894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.372004986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.372016907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.372152090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.372229099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.372229099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.372236013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.372371912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.378746986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.378760099 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.378985882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.378995895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.379101038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.379175901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.385843039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.385854006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.386034966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.386034966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.386096954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.386106968 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.386113882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.386113882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.386276960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.392364025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.392378092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.392524004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.392571926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.392571926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.392580032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.392651081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.392788887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.398226976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.398240089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.398463964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.398471117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.398511887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.398595095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.404469967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.404483080 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.404653072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.404742002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.404747963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.404911995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.410216093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.410228014 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.410418987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.410494089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.410504103 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.410677910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.415924072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.415936947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.416100979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.416222095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.416233063 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.416392088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.419358969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.419523001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.419523001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.419575930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.419581890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.425127029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.425138950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.425331116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.425339937 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.425399065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.425446987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.430480957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.430495024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.430669069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.430669069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.430677891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.430718899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.430718899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.430764914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.430809021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.436115980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.436127901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.436280012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.436280012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.436289072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.436336994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.436336994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.436400890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.436400890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.441030025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.441044092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.441212893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.441212893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.441222906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.441335917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.446389914 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.446404934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.446563005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.446563005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.446571112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.446611881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.446665049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.446665049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.446685076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.452023029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.452034950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.452277899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.452287912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.452372074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.457094908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.457130909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.457264900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.457288027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.457406044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.461669922 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.461682081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.461972952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.461981058 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.466675997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.466712952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.466842890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.466842890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.466852903 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.466901064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.466939926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.466990948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.467037916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.471983910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.471997023 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.472172976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.472243071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.472249031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.472287893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.476748943 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.476783991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.476931095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.476938963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.477087021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.479521990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.479598045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.479697943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.479764938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.479770899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.483923912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.483933926 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.484117985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.484126091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.484210968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.488071918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.488104105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.488293886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.488301992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.488344908 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.488396883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.492295980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.492326021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.492439985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.492448092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.492506981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.492506981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.492638111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.496215105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.496225119 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.496366978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.496443987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.496449947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.496474028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.500055075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.500066042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.500227928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.500236034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.500291109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.500291109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.500303030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.500374079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.504700899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.504710913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.504857063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.504857063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.504904985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.504959106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.504965067 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.505011082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.505011082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.508534908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.508547068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.508697987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.508708000 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.508773088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.508774042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.508848906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.511507034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.511603117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.511687994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.511687994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.511750937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.511759996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.511838913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.514986992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.514997959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.515155077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.515163898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.515202999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.515202999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.515254021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.515300035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.519233942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.519243002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.519421101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.519421101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.519443035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.519443035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.519443035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.519465923 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.519530058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.523380995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.523415089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.523565054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.523565054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.523574114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.523614883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.523660898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.523777008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.526612043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.526622057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.526815891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.526911020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.526916981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.530333042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.530364990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.530486107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.530495882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.530538082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.530538082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.530600071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.530648947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.533617973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.533642054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.533898115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.533905983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.536885977 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.536896944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.537110090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.537110090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.537118912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.537161112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.540762901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.540793896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.540908098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.540915966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.540925980 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.540925980 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.540997028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.540997028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.541044950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.543978930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.543988943 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.544106007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.544153929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.544153929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.544202089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.544207096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.544250965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.544300079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.547015905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.547027111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.547148943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.547157049 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.547224998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.547224998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.547341108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.550204039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.550214052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.550345898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.550345898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.550393105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.550442934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.550442934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.550447941 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.550491095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.553762913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.553775072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.553920984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.553927898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.553967953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.554049969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.556833029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.556843042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.556969881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.557143927 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.557148933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.560333014 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.560344934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.560486078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.560492992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.560533047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.560533047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.560581923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.560631037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.563107014 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.563117027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.563241959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.563332081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.563335896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.563380957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.566031933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.566049099 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.566179991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.566179991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.566188097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.566277027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.566277027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.566325903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.569487095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.569497108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.569677114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.569684029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.569725990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.569725990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.569773912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.572173119 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.572189093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.572357893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.572366953 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.572446108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.574897051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.574908018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.575058937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.575058937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.575067043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.575093985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.575191021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.577661037 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.577673912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.577789068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.577878952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.577883005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.577928066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.580997944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.581010103 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.581144094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.581144094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.581166029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.581192017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.581288099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.583729029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.583754063 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.583899021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.583946943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.583946943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.583951950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.583996058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.583996058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.586256981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.586270094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.586421013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.586421013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.586441994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.586536884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.589482069 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.589494944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.589665890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.589685917 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.589721918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.589771032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.592195034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.592216015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.592327118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.592334986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.592426062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.592474937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.594783068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.594801903 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.594938040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.594984055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.594984055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.594990015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.595032930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.595082045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.597068071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.597079992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.597234964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.597234964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.597240925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.597271919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.597321033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.597321033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.597369909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.600147963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.600158930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.600291967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.600358009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.600363016 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.600460052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.602624893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.602646112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.602749109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.602749109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.602756977 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.602845907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.602845907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.602943897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.605101109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.605114937 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.605254889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.605293036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.605293036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.605298042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.605400085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.607990980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.608005047 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.608118057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.608124018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.608196020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.608196020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.608294010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.610369921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.610388994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.610497952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.610497952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.610595942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.610595942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.610595942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.610603094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.610692024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.612468004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.612483025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.612600088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.612606049 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.612694025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.612783909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.615232944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.615247011 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.615374088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.615374088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.615421057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.615519047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.615519047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.615524054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.617511034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.617527962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.617660046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.617666006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.617708921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.617708921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.617757082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.617805958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.620196104 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.620208025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.620352030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.620352030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.620507002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.620513916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.622205019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.622219086 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.622407913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.622412920 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.622453928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.622453928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.624820948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.624835014 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.624979973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.624986887 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.625026941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.625026941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.625076056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.625124931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.627003908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.627017021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.627151012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.627151012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.627197981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.627247095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.627250910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.627295971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.629570961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.629590988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.629724979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.629724979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.629733086 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.629771948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.629821062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.629869938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.632116079 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.632128954 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.632272959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.632272959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.632281065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.632320881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.632320881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.632427931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.633944035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.633954048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.634113073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.634196043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.634201050 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.636045933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.636056900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.636229992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.636229992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.636235952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.636341095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.638569117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.638585091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.638684034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.638690948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.638875961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.641272068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.641282082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.641438007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.641485929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.641485929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.641490936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.641535044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.643163919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.643189907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.643374920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.643382072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.643426895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.643426895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.645358086 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.645369053 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.645497084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.645505905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.645649910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.647183895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.647196054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.647392035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.647392035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.647399902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.647439957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.647489071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.649633884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.649652958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.649831057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.649837971 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.649913073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.651376963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.651387930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.651513100 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.651519060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.651578903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.651680946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.653357029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.653373003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.653515100 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.653515100 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.653563023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.653565884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.653629065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.653629065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.653734922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.655409098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.655419111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.655555964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.655615091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.655615091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.655700922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.655704975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.657891035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.657902956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.658015013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.658024073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.658092022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.658092022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.658207893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.659943104 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.659955025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.660131931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.660139084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.660181046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.660181046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.661520958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.661560059 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.661730051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.661737919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.661820889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.664133072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.664159060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.664349079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.664356947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.664396048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.664459944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.666062117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.666076899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.666286945 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.666294098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.666372061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.668061972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.668071985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.668219090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.668226004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.668314934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.668364048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.669449091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.669462919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.669595957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.669595957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.669644117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.669692993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.669697046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.669742107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.669742107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.671844006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.671858072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.671988010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.671988010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.671994925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.672076941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.672076941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.672142982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.673820019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.673865080 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.673981905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.674129009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.674139023 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.675611973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.675622940 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.675791025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.675791979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.675802946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.675812006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.675892115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.675892115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.675951958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.678137064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.678186893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.678345919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.678345919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.678371906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.678380966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.678380966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.678459883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.678477049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.679994106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.680013895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.680151939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.680160046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.680262089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.680322886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.681883097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.681900978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.682053089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.682060957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.682214022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.683784008 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.683796883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.683974028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.683974028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.684123993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.684134007 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.685312033 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.685324907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.685475111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.685475111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.685487032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.685496092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.685571909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.685571909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.685631990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.687386990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.687401056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.687545061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.687645912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.687645912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.687657118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.687664032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.689860106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.689881086 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.690052986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.690063953 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.690121889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.690179110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.691397905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.691415071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.691571951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.691582918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.691653967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.691669941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.692763090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.692806005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.692905903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.692905903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.692918062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.692995071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.693006992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.693006992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.693087101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.694617987 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.694629908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.694866896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.694876909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.694947958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.696829081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.696851015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.697022915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.697022915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.697035074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.697043896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.697043896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.697140932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.698690891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.698708057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.698858976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.698858976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.698868990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.698920012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.698920012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.698945045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.699023962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.699752092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.699769020 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.699913025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.699913025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.700028896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.700035095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.700129032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.701607943 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.701642036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.701771975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.701777935 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.701869011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.701924086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.703295946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.703309059 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.703449011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.703449965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.703504086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.703504086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.703509092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.703545094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.703593969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.705374002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.705390930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.705594063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.705600023 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.705708981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.707190990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.707204103 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.707349062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.707355976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.707426071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.707530022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.708487988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.708503008 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.708662987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.708662987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.708684921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.708690882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.708690882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.708751917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.710134029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.710165024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.710313082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.710314035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.710319996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.710428953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.712006092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.712022066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.712219954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.712219954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.712228060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.712285995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.712323904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.713618994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.713635921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.713771105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.713771105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.713778019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.713830948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.713917017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.714909077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.714942932 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.715058088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.715135098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.715136051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.715140104 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.715183973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.716696978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.716715097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.716867924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.716876984 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.716941118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.716941118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.717004061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.718447924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.718465090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.718592882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.718661070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.718661070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.718667984 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.718672991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.718673944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.718761921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.720417976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.720432043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.720558882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.720570087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.720619917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.720619917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.720654964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.720726013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.720726013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.721817017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.721834898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.722018957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.722026110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.722105026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.722966909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.722985029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.723118067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.723124027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.723207951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.723257065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.724701881 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.724718094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.724859953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.724908113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.724908113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.724912882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.725006104 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.725826025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.725843906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.725977898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.725977898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.725984097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.726108074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.726108074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.727616072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.727632046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.727812052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.727822065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.727901936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.729378939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.729398966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.729504108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.729512930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.729604959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.729660988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.731079102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.731092930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.731240988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.731240988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.731286049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.731286049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.731292963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.731385946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.732763052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.732780933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.733011961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.733019114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.733104944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.733931065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.733948946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.734052896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.734052896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.734060049 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.734148979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.734148979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.734196901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.734246969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.735702038 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.735714912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.735831976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.735888004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.735961914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.735961914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.735968113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.736871004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.736887932 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.737063885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.737063885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.737072945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.737118006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.737164021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.737164021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.737186909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.738375902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.738394022 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.738661051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.738668919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.739614010 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.739629030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.739772081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.739772081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.739778042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.739819050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.739867926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.739917040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.739917994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.741293907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.741311073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.741497993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.741497993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.741506100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.741535902 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.741668940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.742822886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.742837906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.742983103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.743086100 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.743086100 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.743093014 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.744539022 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.744560003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.744743109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.744743109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.744743109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.744754076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.744761944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.744811058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.744858980 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.745697975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.745712996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.745897055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.745897055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.745903969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.745944023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.745944023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.745990038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.747172117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.747189999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.747354984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.747363091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.747441053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.748313904 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.748330116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.748469114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.748469114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.748476028 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.748568058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.748568058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.748646975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.750032902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.750046968 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.750237942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.750237942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.750246048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.750339985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.751352072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.751368999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.751538038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.751538038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.751549006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.751563072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.751635075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.751635075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.751709938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.753030062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.753050089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.753161907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.753161907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.753256083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.753266096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.753273964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.753273964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.753381968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.754076958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.754095078 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.754215002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.754215002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.754223108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.754262924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.754262924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.754383087 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.755616903 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.755633116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.755762100 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.755851984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.755857944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.755901098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.756839991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.756858110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.757005930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.757013083 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.757086992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.757086992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.757801056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.757816076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.757985115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.758152962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.758157015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.759531021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.759550095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.759675026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.759675026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.759681940 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.759722948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.759722948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.759772062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.759820938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.761677980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.761696100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.761854887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.761854887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.761881113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.761929989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.761929989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.761935949 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.761979103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.762558937 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.762573957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.762703896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.762710094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.762752056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.762752056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.762850046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.762911081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.763528109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.763545036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.763679981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.763755083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.763755083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.763766050 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.763792992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.765079021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.765096903 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.765279055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.765289068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.765383005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.767152071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.767164946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.767332077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.767340899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.767366886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.767366886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.767416000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.767465115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.768556118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.768582106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.768723011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.768728971 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.768812895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.768862009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.770342112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.770370960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.770555973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.770561934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.770646095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.771850109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.771868944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.771998882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.771998882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.772006035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.772047043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.772047043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.772094965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.772193909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.773504019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.773518085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.773637056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.773637056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.773734093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.773734093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.773734093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.773739100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.773782015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.775120020 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.775137901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.775274992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.775280952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.775366068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.775366068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.777195930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.777214050 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.777524948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.777524948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.777538061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.777546883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.777821064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.777837038 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.777945042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.777952909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.777992010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.777992010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.778040886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.778089046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.778137922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.778415918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.778433084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.778551102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.778551102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.778559923 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.778599977 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.778697014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.778702021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.778747082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.778836012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.778892040 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.778906107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.779031992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.779031992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.779079914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.779081106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.779084921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.779129982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.779227018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.779473066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.779489994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.779655933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.779704094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.779704094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.779709101 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.779829025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.781102896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.781120062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.781313896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.781322956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.781399965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.781399965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.781456947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.782000065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.782016993 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.782191038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.782191038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.782198906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.782238960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.782336950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.782386065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.782967091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.782983065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.783113956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.783113956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.783162117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.783166885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.783210993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.783260107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.783373117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.784358978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.784375906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.784518003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.784518003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.784568071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.784568071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.784574986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.784667015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.784838915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.785763979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.785778046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.785974979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.785974979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.785985947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.786021948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.786119938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.786689043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.786701918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.786845922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.786845922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.786914110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.786919117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.786942005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.786942005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.787051916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.787839890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.787853956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.787988901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.788037062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.788037062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.788042068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.788085938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.788183928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.789319038 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.789338112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.789484978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.789532900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.789532900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.789540052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.789581060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.789691925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.790508032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.790528059 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.790679932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.790728092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.790731907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.790776968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.790874958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.791244984 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.791260958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.791395903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.791395903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.791443110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.791446924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.791491985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.791491985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.791641951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.792486906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.792500019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.792747021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.792753935 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.792917013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.793943882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.793975115 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.794102907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.794102907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.794183969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.794195890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.794202089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.794202089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.794450998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.795115948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.795134068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.795257092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.795257092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.795329094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.795336962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.795356035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.795450926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.795516014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.796602964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.796616077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.796802998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.796809912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.796894073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.796958923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.797461033 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.797473907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.797662020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.797662020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.797668934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.797708988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.797806978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.798907995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.798923969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.799052954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.799143076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.799149036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.799233913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.799324989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.800043106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.800060034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.800250053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.800250053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.800256968 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.800296068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.800394058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.801153898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.801173925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.801354885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.801371098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.801378012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.801515102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.801515102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.802098989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.802113056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.802290916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.802290916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.802303076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.802311897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.802393913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.802468061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.803162098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.803175926 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.803318977 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.803328991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.803420067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.803498030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.804598093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.804615974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.804747105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.804747105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.804795027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.804795027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.804800034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.804843903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.804941893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.805660963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.805674076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.805813074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.805890083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.805890083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.805896044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.806111097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.807074070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.807085991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.807229996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.807229996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.807277918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.807281971 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.807327032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.807327032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.807439089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.808043003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.808072090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.808204889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.808295012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.808300018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.808542013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.808871031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.808886051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.809062958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.809062958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.809062958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.809077024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.809083939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.809083939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.809231997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.809855938 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.809883118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.810076952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.810076952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.810085058 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.810219049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.810836077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.810848951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.810986996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.810986996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.811033964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.811038017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.811083078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.811131954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.811245918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.812222958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.812242985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.812354088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.812534094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.812541008 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.812689066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.813334942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.813349962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.813548088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.813556910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.813596010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.813689947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.814366102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.814383984 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.814523935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.814523935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.814570904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.814570904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.814575911 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.814667940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.814717054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.815267086 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.815279961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.815524101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.815530062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.815574884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.815655947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.816494942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.816512108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.816643953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.816643953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.816746950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.816746950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.816746950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.816759109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.816889048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.817590952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.817608118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.817785978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.817796946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.817920923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.817991972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.818579912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.818593979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.818773985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.818782091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.818851948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.818851948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.818929911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.819519043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.819535017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.819659948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.819659948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.819708109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.819713116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.819804907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.819890976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.820457935 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.820475101 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.820583105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.820761919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.820768118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.820904970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.821798086 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.821816921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.821945906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.821945906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.822062016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.822067976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.822295904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.822561026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.822575092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.822751999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.822751999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.822758913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.822848082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.822896957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.823514938 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.823528051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.823652983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.823652983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.823699951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.823704004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.823817015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.823864937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.824445009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.824459076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.824574947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.824676037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.824681044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.824723005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.824805021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.825572014 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.825587034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.825756073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.825756073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.825768948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.825803041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.825803995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.825922966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.826733112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.826747894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.826925039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.826925039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.826971054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.826977015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.826996088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.827044964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.827142954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.827594995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.827609062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.827744007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.827744007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.827791929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.827791929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.827796936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.827903032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.827985048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.828593969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.828608036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.828744888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.828794003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.828794003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.828799963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.828891039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.828952074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.829741001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.829756021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.829927921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.829933882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.830030918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.830096006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.830811024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.830825090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.831020117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.831026077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.831110001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.831161976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.831568003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.831583977 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.831722021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.831722021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.831769943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.831774950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.831867933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.831917048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.833303928 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.833318949 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.833450079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.833539963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.833551884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.833558083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.833764076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.834129095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.834146976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.834270954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.834270954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.834368944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.834368944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.834374905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.834415913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.834513903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.834744930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.834758997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.834959030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.834965944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.835006952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.835006952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.835114002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.835592031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.835608959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.835738897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.835738897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.835787058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.835792065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.835835934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.835835934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.835988998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.836709976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.836724997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.836844921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.836844921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.836904049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.836910009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.836990118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.837079048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.837744951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.837759972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.837975025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.837984085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.838012934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.838105917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.838505983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.838521957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.838702917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.838702917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.838711023 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.838799953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.838849068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.839548111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.839560986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.839664936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.839741945 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.839746952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.839847088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.839898109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.841120005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.841136932 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.841330051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.841330051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.841337919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.841377020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.841475010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.841696024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.841712952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.841835976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.841927052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.841927052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.841931105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.842057943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.842962027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.842977047 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.843202114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.843202114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.843213081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.843300104 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.843406916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.843751907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.843769073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.843976974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.843976974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.843976974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.843990088 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.843997955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.844124079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.844715118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.844729900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.844902992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.844932079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.844932079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.844943047 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.845046997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.845046997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.845163107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.845935106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.845952988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.846075058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.846151114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.846158028 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.846199989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.846558094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.846577883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.846698046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.846698999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.846704960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.846745968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.846795082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.846795082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.846843958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.847378969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.847394943 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.847594976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.847600937 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.847642899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.847642899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.849222898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.849241972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.849376917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.849376917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.849384069 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.849473953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.849570990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.849848032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.849864960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.849999905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.849999905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.850049019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.850054026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.850097895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.850097895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.850146055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.850387096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.850624084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.850627899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.850634098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.850780010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.851483107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.851500988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.851625919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.851625919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.851672888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.851679087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.851722956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.851722956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.851833105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.852138042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.852153063 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.852313995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.852363110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.852363110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.852363110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.852370024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.852560043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.853172064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.853184938 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.853378057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.853387117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.853441954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.853441954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.853522062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.854659081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.854722023 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.854810953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.854901075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.854901075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.854908943 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.855093002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.855108976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.855212927 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.855212927 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.855220079 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.855329990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.855329990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.856431961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.856447935 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.856569052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.856614113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.856669903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.856669903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.856676102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.856786013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.857573986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.857589006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.857728958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.857728958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.857809067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.857809067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.857815981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.857821941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.857877970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.857925892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.857947111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.858073950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.858073950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.858081102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.858170033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.858218908 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.858958006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.858971119 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.859087944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.859087944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.859184027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.859184027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.859189034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.859234095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.859234095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.860013008 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.860024929 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.860146999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.860152960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.860290051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.860290051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.860845089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.860861063 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.861015081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.861114979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.861119986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.861258030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.861823082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.861840010 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.861973047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.861973047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.862020969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.862025976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.862118959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.862180948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.862273932 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.862292051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.862416029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.862416029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.862512112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.862512112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.862517118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.862560987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.862700939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.863679886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.863694906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.863833904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.863833904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.863879919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.863884926 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.863929033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.863977909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.864075899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.864581108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.864594936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.864728928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.864820004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.864824057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.864911079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.864965916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.865178108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.865195990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.865326881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.865391970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.865391970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.865398884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.865535021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.865813971 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.865827084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.865964890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.865964890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.866080999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.866085052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.866224051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.866831064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.866847038 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.866931915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.867043972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.867043972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.867052078 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.867160082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.867738962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.867753983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.867928028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.867933989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.868057013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.868598938 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.868612051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.868746996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.868794918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.868794918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.868794918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.868803024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.868870020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.868891954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.869200945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.869215965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.869370937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.869370937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.869379044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.869417906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.869515896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.870568991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.870587111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.870775938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.870784044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.870865107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.871514082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.871536970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.871673107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.871681929 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.871720076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.871720076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.871767998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.871865988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.872364998 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.872385025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.872490883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.872570992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.872577906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.872725964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.872944117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.872962952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.873075962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.873075962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.873172998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.873172998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.873181105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.873223066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.873223066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.873848915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.873867035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.874013901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.874022007 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.874166965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.874814034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.874830961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.874958992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.875142097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.875148058 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.875494003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.875511885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.875675917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.875675917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.875682116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.875829935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.876137972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.876156092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.876260996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.876338005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.876343966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.876386881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.877238989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.877258062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.877423048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.877423048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.877434969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.877444029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.877542973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.878211021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.878225088 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.878420115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.878431082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.878520012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.878535032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.878551006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.878768921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.878770113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.878777981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.878825903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.879347086 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.879364014 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.879472017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.879472017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.879478931 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.879569054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.879569054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.879650116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.879705906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.880435944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.880450964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.880628109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.880745888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.880757093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.881078005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.881100893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.881225109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.881225109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.881237984 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.881298065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.881298065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.881346941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.881346941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.882038116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.882057905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.882175922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.882175922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.882224083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.882224083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.882230043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.882272959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.882322073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.883061886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.883083105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.883268118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.883268118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.883275986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.883316040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.883364916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.883658886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.883677006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.883827925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.883827925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.883836985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.883874893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.883924007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.883924007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.884538889 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.884557962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.884671926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.884748936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.884748936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.884754896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.884846926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.885473013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.885493040 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.885621071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.885621071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.885631084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.885668993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.885718107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.885718107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.885766983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.886390924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.886409044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.886545897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.886545897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.886615038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.886615038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.886620998 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.886663914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.886663914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.887053013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.887074947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.887208939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.887217045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.887324095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.887615919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.887634039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.887778997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.887826920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.887826920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.887833118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.887924910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.888552904 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.888581038 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.888757944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.888766050 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.888858080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.889136076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.889153957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.889275074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.889275074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.889283895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.889322042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.889322042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.889441967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.889527082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.889545918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.889652014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.889652014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.889754057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.889759064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.889802933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.891599894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.891621113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.891808987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.891817093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.891856909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.891856909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.892263889 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.892282009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.892484903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.892493010 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.892575979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.893132925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.893153906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.893265963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.893275023 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.893313885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.893313885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.893362045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.893410921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.893508911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.893554926 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.893584967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.893681049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.893681049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.893733025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.893779039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.893779039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.893785954 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.893826962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.894105911 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.894126892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.894239902 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.894239902 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.894248962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.894288063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.894288063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.894335985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.894385099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.894953966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.894973040 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.895138025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.895138025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.895147085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.895184040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.895282984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.895610094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.895631075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.895792961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.895792961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.895804882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.895813942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.895813942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.895813942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.895910025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.896063089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.896081924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.896193981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.896203041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.896281004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.896384001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.897157907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.897176981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.897284985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.897372961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.897378922 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.897424936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.898186922 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.898206949 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.898336887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.898336887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.898348093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.898432970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.898432970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.898480892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.898931980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.898950100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.899090052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.899090052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.899137974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.899187088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.899187088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.899195910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.899283886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.899583101 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.899602890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.899713993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.899720907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.899791002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.899791002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.899888039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.900285959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.900304079 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.900412083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.900480032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.900485992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.900635958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.901038885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.901057005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.901155949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.901299000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.901304960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.902003050 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.902021885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.902185917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.902195930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.902235031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.902235985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.902283907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.902410030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.902427912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.902559996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.902568102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.902609110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.902609110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.902657032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.902707100 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.903120995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.903139114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.903275013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.903322935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.903322935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.903328896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.903373003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.903420925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.904016018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.904036999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.904225111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.904225111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.904233932 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.904273033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.904273033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.904637098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.904654980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.904798985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.904809952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.904886961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.905210018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.905230045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.905381918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.905381918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.905390978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.905430079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.905430079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.905528069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.906116962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.906133890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.906265974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.906265974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.906275034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.906362057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.906363010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.906411886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.906778097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.906796932 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.906928062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.906976938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.906976938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.906984091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.907025099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.907073975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.907555103 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.907576084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.907682896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.907682896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.907694101 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.907779932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.907779932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.907828093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.907828093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.908433914 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.908454895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.908644915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.908653021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.908693075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.908693075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.908972979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.908993006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.909100056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.909100056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.909109116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.909195900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.909195900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.909245014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.909245014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.910084009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.910103083 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.910231113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.910320997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.910320997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.910327911 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.910636902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.910657883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.910841942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.910841942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.910851002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.910938025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.911418915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.911437988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.911542892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.911551952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.911591053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.911659956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.911659956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.911941051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.911958933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.912064075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.912064075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.912159920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.912159920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.912159920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.912166119 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.912257910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.912597895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.912619114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.912725925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.912734032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.912817001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.912908077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.913513899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.913532019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.913662910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.913711071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.913711071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.913711071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.913718939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.913817883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.914122105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.914143085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.914247990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.914256096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.914338112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.914338112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.914436102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.914644003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.914663076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.914781094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.914781094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.914829016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.914829016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.914836884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.914876938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.914876938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.915227890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.915247917 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.915364981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.915373087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.915431976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.915546894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.916389942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.916408062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.916510105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.916557074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.916557074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.916608095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.916608095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.916616917 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.916656017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.916754961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.916771889 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.916899920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.916899920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.916908026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.916946888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.916946888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.917068005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.917653084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.917702913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.917887926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.917887926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.917896032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.918095112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.918389082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.918407917 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.918539047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.918539047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.918585062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.918591022 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.918633938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.918683052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.918787003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.919294119 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.919313908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.919447899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.919447899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.919543982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.919543982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.919550896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.919641972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.919691086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.919919968 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.919939041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.920097113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.920104980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.920201063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.920252085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.920473099 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.920489073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.920670986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.920670986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.920685053 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.920761108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.920761108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.920821905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.921014071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.921030998 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.921150923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.921150923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.921247959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.921252012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.921305895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.921410084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.922053099 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.922070026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.922204018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.922204018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.922251940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.922251940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.922259092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.922301054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.922434092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.922656059 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.922676086 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.922863007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.922863007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.922863007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.922877073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.922935963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.923008919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.923146963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.923166990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.923295975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.923295975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.923343897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.923350096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.923441887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.923491955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.923675060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.923693895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.923827887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.923906088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.923906088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.923913002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.924048901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.924792051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.924812078 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.924988031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.924988031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.925004959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.925004959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.925014973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.925116062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.925163984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.925373077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.925390959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.925518990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.925610065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.925610065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.925617933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.925740004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.925904989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.925924063 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.926052094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.926052094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.926148891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.926148891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.926148891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.926157951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.926351070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.926398039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.926414967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.926546097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.926546097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.926594019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.926598072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.926692009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.926791906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.927737951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.927755117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.927843094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.927975893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.927983046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.928042889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.928452969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.928473949 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.928637981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.928646088 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.928687096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.928687096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.928735971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.929030895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.929048061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.929172039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.929172039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.929179907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.929313898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.929519892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.929538012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.929652929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.929701090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.929701090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.929749012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.929754019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.929847956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.930305004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.930325031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.930408955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.930416107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.930495024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.930510998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.930510998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.930608034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.930613995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.930656910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.930656910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.930706024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.931435108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.931452036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.931628942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.931638002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.931677103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.931677103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.931874037 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.931894064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.932018995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.932018995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.932027102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.932066917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.932116985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.932116985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.932164907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.933195114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.933212996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.933347940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.933382988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.933391094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.933475018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.933576107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.933626890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.933734894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.933743000 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.933783054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.933783054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.933831930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.933831930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.933880091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.934406996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.934422970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.934555054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.934643984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.934644938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.934652090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.934971094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.934990883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.935086966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.935086966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.935096025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.935134888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.935241938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.936331034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.936348915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.936451912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.936500072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.936554909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.936561108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.936604023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.937025070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.937047005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.937166929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.937166929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.937175035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.937215090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.937263966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.937263966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.937361002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.938057899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.938076019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.938182116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.938229084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.938229084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.938327074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.938334942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.938409090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.938431025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.938533068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.938533068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.938543081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.938628912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.938628912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.938678026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.938678026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.939536095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.939554930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.939677954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.939807892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.939814091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.940084934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.940105915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.940234900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.940234900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.940243959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.940282106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.940331936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.940331936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.940428972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.941200018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.941217899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.941366911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.941415071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.941415071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.941425085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.941447973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.941462994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.941484928 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.941566944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.941566944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.941572905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.941658974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.941658974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.942151070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.942169905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.942276001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.942276001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.942284107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.942393064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.942393064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.943779945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.943798065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.943901062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.943948984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.944056988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.944061995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.944550991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.944578886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.944720984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.944720984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.944730997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.944768906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.944866896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.944953918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.945020914 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.945084095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.945132017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.945132971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.945180893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.945185900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.945278883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.945416927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.945437908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.945538998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.945538998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.945548058 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.945636988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.945636988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.945686102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.946018934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.946037054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.946176052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.946176052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.946224928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.946224928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.946233034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.946273088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.946322918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.946774006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.946794987 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.946930885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.946930885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.946940899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.946978092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.947076082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.947288036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.947305918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.947449923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.947449923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.947499037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.947505951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.947597027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.947885036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.947905064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.948009968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.948009968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.948019028 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.948112965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.948160887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.948862076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.948910952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.949107885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.949115992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.949177027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.949624062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.949644089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.949764967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.949764967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.949773073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.949811935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.949909925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.950453997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.950473070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.950609922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.950738907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.950745106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.951447964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.951467991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.951675892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.951683998 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.951726913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.952157974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.952174902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.952325106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.952325106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.952333927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.952373981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.952471018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.953468084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.953489065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.953653097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.953700066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.953700066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.953710079 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.953748941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.953772068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.953835011 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.953911066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.953918934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.953958988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.954015017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.954160929 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.954180002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.954327106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.954334974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.954375029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.954375029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.954473019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.955297947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.955317974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.955445051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.955445051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.955492973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.955497026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.955590963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.956840038 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.956861973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.957055092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.957055092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.957082033 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.957093000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.957142115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.958327055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.958345890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.958528042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.958528042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.958539009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.958600998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.958622932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.958909035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.958930969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.959084988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.959084988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.959094048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.959132910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.959182024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.959182024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.960282087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.960300922 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.960411072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.960419893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.960501909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.960592985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.961464882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.961484909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.961699963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.961699963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.961699963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.961716890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.961728096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.962064981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.962088108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.962207079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.962207079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.962217093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.962308884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.962308884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.963273048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.963304996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.963453054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.963500977 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.963500977 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.963506937 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.963550091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.964620113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.964637995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.964781046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.964788914 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.964921951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.966259956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.966276884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.966392040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.966439009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.966439009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.966487885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.966492891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.966586113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.967475891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.967495918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.967627048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.967627048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.967634916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.967675924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.967675924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.967724085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.967772961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.967976093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.968034029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.968185902 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.968193054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.968276024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.969309092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.969327927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.969460011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.969470024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.969508886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.969508886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.969557047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.969605923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.970658064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.970676899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.970812082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.970860004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.970860004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.970860958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.970870972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.970909119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.971005917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.971661091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.971760988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.971800089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.971807003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.971851110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.971851110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.971899033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.971949100 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.972450972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.972469091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.972618103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.972618103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.972677946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.972677946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.972683907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.972726107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.972726107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.974523067 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.974544048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.974648952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.974657059 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.974814892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.975076914 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.975094080 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.975219011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.975219011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.975266933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.975266933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.975272894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.975315094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.975413084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.976289988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.976309061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.976453066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.976461887 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.976557016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.976557016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.976804018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.976821899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.976948977 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.976948977 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.976995945 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.976995945 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.977003098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.977045059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.977093935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.977828026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.977849007 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.977955103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.977962971 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.978051901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.978100061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.979362965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.979381084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.979521990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.979522943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.979569912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.979619026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.979624987 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.979667902 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.979667902 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.980544090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.980570078 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.980756998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.980756998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.980765104 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.980858088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.980858088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.981151104 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.981168032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.981302977 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.981311083 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.981350899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.981350899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.981400013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.981447935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.982400894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.982419968 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.982589960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.982597113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.982681036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.983566046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.983587980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.983695030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.983704090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.983742952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.983742952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.983792067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.983792067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.983840942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.984735966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.984755039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.984899044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.984899044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.984940052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.984947920 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.985089064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.985354900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.985377073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.985548019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.985558033 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.985620022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.985620022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.985677958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.986686945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.986706018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.986829042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.986829042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.986838102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.986923933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.986923933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.987021923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.987770081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.987788916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.987932920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.988037109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.988037109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.988046885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.988970995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.988992929 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.989167929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.989196062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.989219904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.989219904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.989378929 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.989397049 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.989520073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.989520073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.989528894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.989567041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.989614964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.989664078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.990740061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.990758896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.990910053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.990957975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.990957975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.990966082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.991055012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.991921902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.991941929 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.992068052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.992068052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.992079020 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.992115974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.992115974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.992223024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.992240906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.992312908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.992444038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.992444038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.992451906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.992491961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.992541075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.993546009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.993566990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.993691921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.993691921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.993700027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.993740082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.993740082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.993916035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.994987965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.995006084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.995174885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.995264053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.995269060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.995991945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.996011972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.996187925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.996196032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.996236086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.996236086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.996284962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.996557951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.996582031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.996695995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.996695995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.996705055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.996742964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.996742964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.996792078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.996840954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.997242928 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.997262001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.997373104 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.997447968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.997452974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.997497082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.997565031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.999667883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.999690056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.999802113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.999811888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:21.999880075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.999880075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:21.999996901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.000660896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.000679970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.000802994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.000850916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.000850916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.000858068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.000900984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.000900984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.000998020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.001063108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.001081944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.001257896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.001257896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.001266003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.001306057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.001354933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.001454115 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.001468897 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.001583099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.001583099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.001590967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.001679897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.001679897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.001679897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.001729012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.002876043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.002895117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.003000021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.003000021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.003098965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.003098965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.003098965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.003108025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.003145933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.003947973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.003968954 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.004091978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.004101992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.004169941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.004169941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.004266977 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.004429102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.004446983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.004573107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.004663944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.004671097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.004755020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.004914999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.004935026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.005093098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.005100012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.005183935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.007122040 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.007139921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.007277966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.007325888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.007325888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.007335901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.007374048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.007422924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.007422924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.008984089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.009004116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.009172916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.009182930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.009213924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.009262085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.009268999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.009288073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.009427071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.009437084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.009444952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.009444952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.009525061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.009525061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.009541988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.010471106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.010490894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.010617971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.010617971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.010715008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.010715008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.010724068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.010763884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.011111021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.011130095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.011267900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.011267900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.011276007 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.011316061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.011364937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.011414051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.011414051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.012217045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.012236118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.012360096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.012437105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.012443066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.012485981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.012720108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.012739897 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.012880087 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.012888908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.012928009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.012928009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.013025045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.014602900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.014621973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.014753103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.014753103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.014890909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.014890909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.014900923 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.016186953 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.016206980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.016376019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.016386032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.016480923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.017036915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.017054081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.017184973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.017184973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.017194986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.017255068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.017281055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.017281055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.017330885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.017448902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.017467022 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.017573118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.017621040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.017621040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.017671108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.017671108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.017677069 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.017767906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.018132925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.018151999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.018275023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.018275023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.018282890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.018323898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.018323898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.018372059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.018420935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.018546104 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.018563986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.018703938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.018703938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.018800974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.018800974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.018807888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.018910885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.020798922 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.020819902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.020993948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.021006107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.021105051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.021105051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.021213055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.021245003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.021384001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.021384001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.021395922 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.021418095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.021418095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.021466017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.021512985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.022154093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.022175074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.022305965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.022305965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.022316933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.022353888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.022353888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.022402048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.022450924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.022759914 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.022778988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.022917032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.022980928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.022988081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.023030043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.023818970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.023839951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.023996115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.024005890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.024044037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.024044037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.024092913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.024283886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.024302959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.024425030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.024425030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.024434090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.024472952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.024472952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.024521112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.024570942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.025798082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.025818110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.025985003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.025991917 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.026031971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.026031971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.026365042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.026384115 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.026544094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.026544094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.026551962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.026592016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.026639938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.026737928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.027568102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.027587891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.027726889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.027726889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.027775049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.027823925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.027823925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.027832031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.027873039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.027888060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.027913094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.028012037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.028012037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.028019905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.028115988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.028115988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.028163910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.029319048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.029337883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.029443026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.029443026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.029539108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.029540062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.029540062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.029546976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.029587984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.029937029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.029956102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.030066967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.030076027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.030114889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.030114889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.030234098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.030904055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.030920982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.031105995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.031114101 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.031168938 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.031197071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.031207085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.031289101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.031296015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.031378984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.031378984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.031476021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.032969952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.032989025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.033119917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.033220053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.033232927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.033240080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.033286095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.033312082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.033458948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.033467054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.033596039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.034205914 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.034225941 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.034332037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.034342051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.034379005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.034379005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.034427881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.034524918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.034567118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.034586906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.034694910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.034694910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.034790993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.034790993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.034790993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.034800053 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.034841061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.036659002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.036680937 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.036813974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.036813974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.036823034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.036860943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.036910057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.036910057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.036958933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.037087917 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.037106991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.037219048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.037372112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.037377119 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.038253069 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.038274050 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.038399935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.038399935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.038409948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.038448095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.038496971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.038544893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.038604021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.038621902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.038724899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.038774014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.038774014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.038780928 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.038821936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.038871050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.038871050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.040551901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.040579081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.040690899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.040700912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.040779114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.040827036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.041089058 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.041107893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.041234016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.041234016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.041349888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.041349888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.041357040 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.041551113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.041572094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.041687965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.041695118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.041743040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.041857004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.041979074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.041996956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.042110920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.042207956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.042213917 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.042263031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.043560982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.043593884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.043704033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.043704033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.043711901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.043751955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.043802023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.043802023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.043849945 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.044012070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.044043064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.044146061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.044249058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.044255018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.044833899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.044857025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.045037031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.045049906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.045061111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.045061111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.045061111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.045140028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.045393944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.045413017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.045563936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.045564890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.045578957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.045592070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.045592070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.045686960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.045686960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.046380997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.046400070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.046538115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.046642065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.046650887 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.046706915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.046854019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.046875000 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.047033072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.047043085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.047103882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.047103882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.047127962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.047225952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.048232079 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.048249960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.048397064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.048444986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.048444986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.048449993 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.048494101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.048592091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.048794985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.048830986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.048995972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.049042940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.049042940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.049051046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.049267054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.049901962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.049918890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.050163984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.050163984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.050163984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.050175905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.050390005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.050460100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.050478935 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.050678968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.050678968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.050688028 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.050749063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.050827026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.051094055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.051125050 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.051347971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.051356077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.051529884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.051582098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.051600933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.051724911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.051724911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.051773071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.051779985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.051821947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.051821947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.051919937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.052838087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.052874088 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.052985907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.053034067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.053034067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.053040981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.053081989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.053179979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.053250074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.053376913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.053395987 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.053570986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.053570986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.053580046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.053617954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.053715944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.053765059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.054356098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.054374933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.054493904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.054542065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.054542065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.054548025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.054640055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.054653883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.054713964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.054721117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.054792881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.054840088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.054896116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.055367947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.055386066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.055521011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.055521011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.055568933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.055568933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.055574894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.055617094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.055733919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.055774927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.055787086 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.055989027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.055989027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.055996895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.056036949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.056143999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.057041883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.057056904 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.057235956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.057235956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.057235956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.057235956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.057255030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.057312012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.057393074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.057812929 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.057825089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.057992935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.057992935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.058079004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.058079004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.058093071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.058104992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.058238029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.059252977 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.059279919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.059407949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.059407949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.059456110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.059463024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.059504032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.059552908 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.059602022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.059855938 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.059868097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.059993029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.060040951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.060040951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.060048103 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.060137987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.060187101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.060844898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.060857058 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.060981035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.061028957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.061028957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.061036110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.061077118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.061125994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.061224937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.061242104 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.061254025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.061409950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.061409950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.061444044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.061449051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.061492920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.061542034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.061655998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.062144995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.062155962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.062306881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.062355042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.062355042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.062361002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.062403917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.062500954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.062576056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.062587976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.062710047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.062760115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.062760115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.062769890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.062808037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.062808037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.062905073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.063363075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.063374043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.063503027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.063580990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.063587904 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.063671112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.063738108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.063924074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.063935995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.064062119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.064110994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.064110994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.064117908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.064161062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.064208031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.064306974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.064966917 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.064979076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.065128088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.065128088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.065176964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.065182924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.065224886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.065224886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.065375090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.065660954 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.065673113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.065792084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.065792084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.065840006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.065840006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.065845013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.065888882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.065985918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.066565990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.066577911 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.066734076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.066831112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.066838026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.066953897 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.066973925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.066981077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.067090988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.067208052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.067874908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.067887068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.068027973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.068075895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.068075895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.068080902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.068125010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.068173885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.068366051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.068380117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.068535089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.068542957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.068629026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.068715096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.069509029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.069519997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.069674015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.069782019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.069787979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.069983959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.069996119 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.070121050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.070121050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.070128918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.070168972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.070218086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.070218086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.070266962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.070923090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.070950985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.071094990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.071238041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.071244001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.071531057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.071544886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.071666956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.071674109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.071758032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.071805954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.072319031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.072330952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.072511911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.072520018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.072560072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.072560072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.072956085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.072968960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.073097944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.073097944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.073107004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.073200941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.073200941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.073831081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.073843002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.073982954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.074084997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.074093103 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.074132919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.074322939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.074333906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.074450016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.074450016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.074457884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.074547052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.074547052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.074596882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.074644089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.075200081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.075213909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.075345993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.075449944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.075449944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.075458050 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.075772047 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.075784922 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.075891972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.075891972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.075900078 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.075989008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.076086044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.076812983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.076828957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.077009916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.077018976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.077100039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.077642918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.077661991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.077790022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.077790022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.077799082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.077887058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.077934980 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.078300953 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.078311920 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.078466892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.078515053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.078515053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.078521967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.078563929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.078613043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.078792095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.078851938 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.078942060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.078942060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.078953028 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.079020023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.079020023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.079066992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.079565048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.079576969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.079741001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.079741001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.079791069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.079791069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.079797029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.079837084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.079935074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.080513954 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.080528021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.080676079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.080676079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.080684900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.080724955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.080821991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.080847025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.080858946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.080976009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.080976009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.081073046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.081073046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.081073999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.081080914 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.081120968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.081563950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.081578016 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.081729889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.081729889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.081738949 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.081777096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.081777096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.081875086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.082166910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.082179070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.082326889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.082405090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.082411051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.082453012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.082866907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.082880974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.083015919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.083024979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.083065033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.083065033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.083112955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.083209991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.083657980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.083668947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.083837032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.083884954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.083884954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.083892107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.083934069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.084152937 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.084167004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.084276915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.084276915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.084285021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.084381104 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.084429026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.085179090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.085190058 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.085366964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.085447073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.085453987 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.085683107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.085695982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.085834980 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.085834980 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.085855961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.085877895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.085877895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.085922003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.085969925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.086936951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.086961985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.087071896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.087163925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.087172031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.087240934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.087637901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.087651014 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.087786913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.087786913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.087795019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.087835073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.087884903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.087934017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.088308096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.088319063 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.088515997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.088515997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.088524103 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.088613033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.088893890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.088907957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.089113951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.089113951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.089122057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.089216948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.089373112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.089381933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.089529991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.089539051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.089590073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.089590073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.089627028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.089665890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.089677095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.089685917 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.089792967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.089842081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.089890003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.090213060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.090224981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.090362072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.090362072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.090409994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.090415001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.090507984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.090555906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.091187954 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.091200113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.091336966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.091336966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.091384888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.091389894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.091523886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.091861963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.091873884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.092025042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.092025042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.092032909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.092073917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.092122078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.092170954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.092667103 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.092679024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.092818975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.092868090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.092868090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.092876911 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.092916012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.093013048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.093259096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.093271017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.093415976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.093416929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.093533039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.093538046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.093703985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.094163895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.094192982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.094326019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.094326019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.094374895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.094381094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.094424009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.094424009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.094589949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.094911098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.094922066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.095067024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.095118046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.095118046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.095118046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.095140934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.095165014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.095288038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.095554113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.095566034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.095711946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.095711946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.095752001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.095757961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.095802069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.095849991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.095899105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.095957994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.096019983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.096120119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.096120119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.096142054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.096168041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.096216917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.096266031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.096970081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.096982002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.097121954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.097170115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.097170115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.097177029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.097218990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.097316027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.097598076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.097609997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.097770929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.097820044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.097820044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.097827911 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.097966909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.097981930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.098041058 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.098135948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.098135948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.098184109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.098190069 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.098282099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.098331928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.098758936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.098771095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.098916054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.098963976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.098963976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.098969936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.099061012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.099136114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.099893093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.099905014 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.100047112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.100047112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.100094080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.100099087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.100143909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.100240946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.100240946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.100698948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.100712061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.100840092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.100840092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.100955963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.100965023 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.101007938 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.101125956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.101135015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.101243019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.101321936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.101490974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.101502895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.101660967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.101660967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.101681948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.101689100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.101758003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.101758003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.101778984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.102696896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.102714062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.102833033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.102842093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.102919102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.102919102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.102988005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.103518009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.103530884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.103661060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.103661060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.103708029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.103758097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.103758097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.103764057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.103806019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.104012012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.104024887 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.104141951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.104142904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.104152918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.104238033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.104296923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.104420900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.104433060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.104545116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.104635954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.104635954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.104644060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.104732990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.105876923 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.105890989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.106028080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.106028080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.106036901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.106075048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.106123924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.106123924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.106172085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.106401920 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.106421947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.106547117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.106547117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.106656075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.106656075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.106661081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.107274055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.107363939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.107430935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.107439041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.107477903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.107559919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.107739925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.107752085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.107872963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.107924938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.107924938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.107932091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.108021021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.109499931 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.109532118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.109677076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.109684944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.109771013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.110033989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.110044003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.110162973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.110169888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.110265017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.110316038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.111207962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.111217976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.111422062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.111429930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.111474037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.111474037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.111862898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.111876965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.112123966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.112132072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.112171888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.112590075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.112598896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.112780094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.112787962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.112864971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.113301992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.113315105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.113471031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.113478899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.113548040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.113548040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.113548040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.113610029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.113706112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.113841057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.113841057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.113851070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.113936901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.113944054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.113986969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.114034891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.114362001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.114372969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.114490032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.114497900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.114581108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.114581108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.114677906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.115134001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.115159988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.115277052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.115277052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.115372896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.115377903 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.115425110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.115545988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.115559101 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.115673065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.115679979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.115721941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.115721941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.115770102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.115819931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.115819931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.115998983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.116010904 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.116153955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.116153955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.116202116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.116250992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.116255045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.116300106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.116902113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.116915941 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.117078066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.117078066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.117088079 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.117125988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.117175102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.117537975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.117687941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.117687941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.117697001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.117737055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.117882967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.117963076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.117975950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.118155956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.118155956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.118165016 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.118204117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.118252993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.119286060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.119299889 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.119430065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.119437933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.119477987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.119477987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.119537115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.119537115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.119625092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.119889975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.119901896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.120017052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.120117903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.120124102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.120167971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.121303082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.121332884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.121462107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.121462107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.121473074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.121494055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.121494055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.121542931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.121630907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.121772051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.121783972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.121927023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.121974945 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.121974945 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.121984005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.122071981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.122693062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.122806072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.122952938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.122961044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.122992039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.122992039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.123605013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.123616934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.123759031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.123759031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.123768091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.123817921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.123856068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.123856068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.123904943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.125020981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.125034094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.125152111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.125273943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.125287056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.125315905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.126527071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.126542091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.126657963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.126677990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.126748085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.126748085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.126765013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.126853943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.127902031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.127912998 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.128087044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.128180027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.128180027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.128189087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.128415108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.128428936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.128608942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.128608942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.128621101 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.128655910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.128752947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.130254984 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.130266905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.130402088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.130402088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.130409956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.130450010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.130548000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.131314039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.131325960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.131509066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.131515026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.131611109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.132173061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.132186890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.132313013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.132313013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.132320881 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.132361889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.132361889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.132458925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.132458925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.132873058 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.132884979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.133053064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.133053064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.133070946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.133070946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.133081913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.133117914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.133117914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.134099960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.134116888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.134262085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.134268999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.134299040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.134299040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.134347916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.134455919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.135303974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.135318041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.135432959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.135432959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.135530949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.135530949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.135541916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.135628939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.136470079 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.136483908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.136615992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.136624098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.136693001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.136742115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.137140989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.137166023 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.137265921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.137315035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.137315035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.137363911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.137371063 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.137420893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.138684034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.138698101 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.138885975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.138894081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.138978004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.139780045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.139791965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.139983892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.139983892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.139991999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.140032053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.140079975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.141006947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.141071081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.141268969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.141297102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.141459942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.143106937 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.143119097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.143275023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.143275023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.143354893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.143354893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.143378973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.143404961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.143584013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.143646955 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.143659115 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.143793106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.143793106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.143922091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.143929958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.144066095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.144277096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.144287109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.144443989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.144443989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.144490957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.144498110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.144624949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.144665003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.145390034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.145402908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.145598888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.145598888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.145606995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.145648003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.145756006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.145977974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.145992041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.146146059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.146146059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.146156073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.146241903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.146241903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.146339893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.146528006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.146539927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.146678925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.146678925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.146725893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.146725893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.146730900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.146775007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.146872997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.147646904 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.147659063 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.147795916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.147797108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.147845030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.147850990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.147892952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.147942066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.148055077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.148770094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.148782015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.148914099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.148993015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.148993015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.148998976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.149121046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.150166035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.150192976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.150305033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.150353909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.150353909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.150362015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.150403023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.150451899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.150500059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.151293993 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.151305914 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.151411057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.151477098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.151482105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.151644945 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.152048111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.152060032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.152204037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.152204037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.152251005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.152256966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.152348995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.152398109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.153774023 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.153799057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.153984070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.153994083 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.154033899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.154033899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.154128075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.154164076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.154175997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.154309988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.154309988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.154370070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.154375076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.154455900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.154556036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.155359983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.155369997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.155505896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.155505896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.155553102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.155553102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.155558109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.155658007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.155700922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.156913996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.156924963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.157119989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.157119989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.157150030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.157157898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.157227039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.157299042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.157461882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.157536030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.157612085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.157715082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.157720089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.157831907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.158580065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.158591986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.158751965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.158847094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.158855915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.159029007 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.159044027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.159054995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.159064054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.159173012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.159173012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.159269094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.159269094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.159318924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.159318924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.160953999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.160965919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.161084890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.161231995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.161231995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.161238909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.161381960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.162393093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.162405014 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.162559986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.162559986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.162627935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.162636995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.162724972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.162805080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.163178921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.163191080 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.163319111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.163319111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.163367033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.163373947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.163465977 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.163538933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.163578987 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.163592100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.163707972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.163785934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.163790941 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.163835049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.163934946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.165652037 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.165677071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.165802956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.165802956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.165851116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.165851116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.165858030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.165956974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.166006088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.166605949 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.166618109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.166733027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.166855097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.166861057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.166997910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.167342901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.167355061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.167596102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.167603970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.167738914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.168426991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.168437004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.168646097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.168647051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.168647051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.168663025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.168673992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.168792009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.169011116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.169023991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.169234037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.169241905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.169281960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.169375896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.170062065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.170073986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.170222044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.170222044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.170232058 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.170284033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.170319080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.170423031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.170648098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.170660019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.170794010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.170897961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.170906067 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.171026945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.171053886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.171061039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.171221972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.171221972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.171351910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.173583984 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.173595905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.173836946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.173846960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.173954964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.174840927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.174851894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.175019979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.175019979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.175029993 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.175067902 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.175067902 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.175199986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.175331116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.175343037 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.175513029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.175513029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.175522089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.175560951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.175609112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.175657988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.176026106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.176050901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.176202059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.176292896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.176297903 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.176435947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.177009106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.177021027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.177203894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.177203894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.177212000 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.177299976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.177349091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.178231001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.178244114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.178401947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.178401947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.178412914 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.178503036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.178550005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.178662062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.178673983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.178841114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.178841114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.178849936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.178888083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.178937912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.179035902 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.179083109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.179120064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.179218054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.179265022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.179265022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.179271936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.179313898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.179363012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.179461002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.181103945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.181118011 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.181364059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.181364059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.181372881 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.181557894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.182470083 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.182482004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.182626009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.182626009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.182672977 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.182681084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.182723045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.182723045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.182857037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.183469057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.183480978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.183690071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.183691025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.183700085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.183898926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.183990955 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.184015036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.184201002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.184209108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.184312105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.184349060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.185062885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.185075045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.185230017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.185230017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.185246944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.185255051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.185295105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.185344934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.185353994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.185446024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.185518980 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.185525894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.185563087 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.185563087 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.185621977 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.185658932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.185708046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.187047005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.187060118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.187226057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.187226057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.187235117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.187274933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.187323093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.187421083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.188179970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.188191891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.188344955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.188344955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.188443899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.188443899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.188443899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.188452005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.188642025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.188869953 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.188913107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.189047098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.189047098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.189055920 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.189094067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.189240932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.189966917 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.189975977 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.190203905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.190212965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.190269947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.190372944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.190397978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.190409899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.190541029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.190541983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.190588951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.190594912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.190686941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.190762043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.191705942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.191716909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.191867113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.191915035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.191915035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.191921949 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.191965103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.192061901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.192413092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.192425013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.192569971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.192616940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.192616940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.192625046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.192666054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.192666054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.192801952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.193495035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.193504095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.193661928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.193661928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.193670988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.193758011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.193758011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.193806887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.194087029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.194096088 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.194298983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.194305897 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.194350004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.194441080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.195338964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.195348978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.195547104 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.195547104 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.195554972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.195648909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.195698023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.196505070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.196516037 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.196652889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.196700096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.196700096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.196712971 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.196748018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.196796894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.196846008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.196981907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.197007895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.197170973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.197218895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.197218895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.197218895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.197228909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.197391987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.197477102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.197489023 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.197639942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.197742939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.197750092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.197977066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.198791027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.198801041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.198942900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.198992014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.198992014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.199016094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.199040890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.199146032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.199249029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.199261904 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.199408054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.199408054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.199455023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.199460030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.199503899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.199503899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.199614048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.200525045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.200536966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.200658083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.200758934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.200767994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.200850964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.200855017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.200887918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.200942039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.200942039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.200951099 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.201037884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.201037884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.201087952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.201087952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.201136112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.202790022 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.202802896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.202955961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.203003883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.203003883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.203003883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.203011036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.203150988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.203526974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.203540087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.203671932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.203671932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.203768969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.203768969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.203778028 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.203816891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.203917027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.204170942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.204183102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.204346895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.204395056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.204395056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.204395056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.204404116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.204581976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.204591036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.204605103 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.204751968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.204751968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.204765081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.204797983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.204847097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.204945087 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.206378937 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.206391096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.206674099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.206681967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.206805944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.207118034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.207128048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.207324982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.207331896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.207372904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.207422018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.207470894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.207923889 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.207933903 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.208105087 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.208105087 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.208117008 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.208153963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.208203077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.208300114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.208523989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.208540916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.208689928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.208689928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.208738089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.208743095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.208836079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.208910942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.209383965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.209402084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.209533930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.209533930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.209583044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.209588051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.209690094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.209780931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.209944010 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.209961891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.210145950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.210145950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.210155964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.210194111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.210290909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.210967064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.210984945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.211122036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.211122036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.211169958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.211177111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.211218119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.211218119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.211366892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.211448908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.211467028 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.211704969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.211713076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.211848021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.212335110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.212352991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.212512016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.212512016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.212519884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.212559938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.212677956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.212693930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.212697983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.212704897 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.212822914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.212824106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.212919950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.212919950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.212969065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.212969065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.214340925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.214355946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.214512110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.214512110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.214560986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.214566946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.214657068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.214798927 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.214907885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.214931011 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.215111017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.215111017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.215118885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.215132952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.215138912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.215230942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.215280056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.215284109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.215369940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.215447903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.216378927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.216392040 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.216643095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.216643095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.216655016 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.216845036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.216989040 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.217006922 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.217154026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.217154026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.217215061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.217225075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.217231989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.217232943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.217360020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.217667103 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.217679024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.217897892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.217899084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.217909098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.217917919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.218166113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.218432903 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.218446016 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.218626976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.218697071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.218703985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.218839884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.218930960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.219293118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.219314098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.219516039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.219516039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.219522953 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.219594955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.219681025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.220149994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.220164061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.220298052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.220401049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.220406055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.220423937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.220609903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.221035957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.221055984 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.221210003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.221256971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.221256971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.221262932 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.221304893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.221426964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.221534967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.221554041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.221688986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.221688986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.221764088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.221769094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.221786022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.221884012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.221932888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.222160101 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.222172976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.222378016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.222378016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.222383976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.222450018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.222523928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.222989082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.223001003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.223205090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.223211050 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.223257065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.223257065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.223354101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.223745108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.223756075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.223988056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.223988056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.223994017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.224037886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.224145889 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.224174023 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.224199057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.224209070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.224288940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.224288940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.224358082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.224385977 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.224435091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.224483967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.224904060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.224922895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.225070000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.225199938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.225207090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.225342035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.225933075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.226015091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.226105928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.226105928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.226187944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.226193905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.226408958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.226942062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.226959944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.227144003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.227194071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.227194071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.227202892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.227356911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.227739096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.227756977 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.227864981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.227942944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.227948904 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.228019953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.228068113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.229268074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.229286909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.229490995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.229490995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.229500055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.229537964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.229635954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.229756117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.229774952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.229887009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.229970932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.229976892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.230019093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.230125904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.230261087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.230278969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.230460882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.230469942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.230500937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.230500937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.230607033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.230726004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.230743885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.230920076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.230926991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.230968952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.230968952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.231065989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.231959105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.231996059 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.232103109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.232103109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.232218981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.232223988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.232350111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.232362032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.232372046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.232558012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.232558012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.232606888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.232717037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.233185053 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.233202934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.233339071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.233339071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.233407974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.233419895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.233478069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.233490944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.233583927 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.233817101 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.233836889 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.233962059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.233962059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.234059095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.234059095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.234064102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.234157085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.234246969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.234730005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.234747887 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.234898090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.234905958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.234987974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.235066891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.235234976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.235253096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.235404968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.235404968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.235415936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.235502005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.235573053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.236058950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.236077070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.236275911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.236275911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.236285925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.236337900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.236470938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.236479044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.236547947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.236633062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.236633062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.237277985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.237296104 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.237564087 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.237572908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.237662077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.237704992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.237713099 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.237797022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.237886906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.237888098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.237936020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.238928080 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.238945961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.239124060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.239150047 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.239212990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.239290953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.239595890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.239614010 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.239747047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.239747047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.239794970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.239794970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.239801884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.239902973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.239994049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.240027905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.240046024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.240253925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.240262032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.240436077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.240705013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.240722895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.240852118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.240928888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.240933895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.241123915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.241763115 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.241780996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.241919041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.241966009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.241966009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.241971970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.242016077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.242139101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.242330074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.242367029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.242491007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.242491007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.242502928 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.242607117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.242665052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.243274927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.243293047 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.243403912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.243504047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.243513107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.243551970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.243645906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.244005919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.244025946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.244259119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.244268894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.244466066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.244544983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.244566917 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.244688034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.244764090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.244770050 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.244812965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.244920969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.245207071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.245238066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.245349884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.245398045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.245398045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.245404005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.245445967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.245495081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.245543957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.245945930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.245964050 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.246090889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.246090889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.246189117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.246189117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.246189117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.246196985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.246324062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.246603012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.246622086 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.246741056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.246818066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.246818066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.246823072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.246987104 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.247546911 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.247653961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.247741938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.247790098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.247796059 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.247898102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.248187065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.248205900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.248327017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.248327017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.248423100 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.248430014 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.248481989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.248589993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.248869896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.248888016 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.249016047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.249119997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.249119997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.249125957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.249366999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.249372005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.249392033 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.249439955 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.249511003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.249557972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.249557972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.249566078 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.249607086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.249655962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.249753952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.250052929 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.250072002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.250211954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.250211954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.250260115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.250260115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.250268936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.250308990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.250418901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.250606060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.250623941 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.250771046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.250818968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.250818968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.250827074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.250916004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.251004934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.251452923 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.251471996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.251616001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.251665115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.251665115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.251672983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.251701117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.251811028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.252021074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.252038956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.252176046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.252176046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.252223015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.252228022 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.252320051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.252368927 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.253045082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.253082037 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.253184080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.253278971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.253285885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.253328085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.253487110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.253799915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.253818035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.253935099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.254034042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.254034042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.254040956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.254189014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.254734993 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.254766941 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.254905939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.254905939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.255022049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.255028009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.255229950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.255460978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.255476952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.255624056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.255685091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.255690098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.255740881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.255904913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.256288052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.256306887 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.256439924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.256439924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.256488085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.256491899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.256643057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.256643057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.257112026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.257132053 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.257234097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.257312059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.257319927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.257414103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.257478952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.257906914 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.257925987 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.258064985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.258116007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.258122921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.258219957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.258296967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.258471012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.258490086 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.258636951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.258636951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.258646011 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.258733988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.258733988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.258781910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.259054899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.259215117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.259311914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.259320021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.259454966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.259900093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.259917974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.260054111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.260054111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.260102034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.260102034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.260107040 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.260149956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.260260105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.260807037 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.260824919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.260963917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.261010885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.261010885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.261018038 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.261059999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.261157990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.261528015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.261538029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.261678934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.261727095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.261727095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.261734962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.261775017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.261950970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.262132883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.262145042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.262289047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.262367964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.262367964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.262377024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.262574911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.262775898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.262788057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.262917995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.262917995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.262965918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.262970924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.263056040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.263108015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.263539076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.263550997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.263679981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.263679981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.263809919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.263816118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.264019012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.264054060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.264074087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.264199972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.264199972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.264247894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.264256001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.264297009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.264405966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.264445066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.264843941 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.264854908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.265050888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.265142918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.265153885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.265352011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.266958952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.266971111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.267113924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.267113924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.267160892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.267168045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.267210007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.267210007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.267333984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.268369913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.268381119 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.268556118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.268556118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.268568039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.268687963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.268748999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.270065069 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.270076990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.270283937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.270284891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.270292044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.270332098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.270430088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.271286011 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.271315098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.271428108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.271428108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.271476030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.271480083 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.271574020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.271675110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.272600889 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.272614002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.272754908 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.272754908 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.272803068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.272809029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.272901058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.272974968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.273808002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.273819923 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.273994923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.274091005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.274096966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.274223089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.274662971 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.274673939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.274811983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.274924994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.274931908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.275072098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.275496006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.275597095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.275686026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.275712967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.275861979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.277179956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.277193069 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.277350903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.277350903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.277367115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.277373075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.277463913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.277513981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.277522087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.277527094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.277565956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.277656078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.277656078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.277715921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.277720928 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.277801991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.277901888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.277951002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.277962923 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.278096914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.278157949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.278157949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.278163910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.278194904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.278369904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.278460979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.278470993 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.278618097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.278696060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.278702021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.278800011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.278903008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.279325008 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.279335976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.279539108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.279539108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.279546976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.279704094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.280196905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.280214071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.280411005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.280420065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.280462980 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.280555010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.280616045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.280633926 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.280776024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.280776024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.280811071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.280817986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.280859947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.280909061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.281023026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.281054020 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.281065941 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.281192064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.281192064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.281239986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.281246901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.281289101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.281337976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.281435966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.281461954 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.281474113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.281594992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.281594992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.281642914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.281647921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.281692028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.281740904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.281789064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.281903982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.281914949 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.282063007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.282063007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.282110929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.282110929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.282116890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.282160044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.282258034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.282329082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.282341003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.282464981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.282556057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.282560110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.282604933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.282685995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.282764912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.282847881 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.282953024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.282953024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.282962084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.283044100 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.283353090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.283364058 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.283610106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.283620119 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.283658981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.283747911 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.283756971 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.283935070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.283945084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.283983946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.283983946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.284032106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.284199953 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.284210920 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.284337997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.284344912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.284415960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.284415960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.284463882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.284789085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.284805059 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.284944057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.284945011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.285064936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.285070896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.285432100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.285449982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.285598040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.285605907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.285681009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.285725117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.285830021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.285845995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.286015034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.286015987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.286024094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.286062002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.286112070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.286206007 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.286326885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.286335945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.286403894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.286494970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.286494970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.286592960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.286628962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.286755085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.286756039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.286804914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.286804914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.286900997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.286906004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.286951065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.287199020 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.287209988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.287353992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.287362099 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.287401915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.287401915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.287451029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.287549019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.287559032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.287566900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.287730932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.287739038 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.287779093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.287863016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.287869930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.287965059 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.287977934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.287978888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.288134098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.288134098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.288142920 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.288182020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.288279057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.288455963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.288467884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.288614988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.288693905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.288702011 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.288795948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.289031982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.289046049 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.289160967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.289160967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.289170980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.289258003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.289258003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.289307117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.289345026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.289355993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.289356947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.289364100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.289472103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.289520025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.289568901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.289568901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.289618969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.290478945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.290491104 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.290618896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.290707111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.290713072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.290761948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.291662931 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.291676044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.291825056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.291831970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.291903019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.291954994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.292934895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.292947054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.293101072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.293221951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.293221951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.293236017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.294411898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.294425964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.294605017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.294605017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.294615030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.294624090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.294624090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.294691086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.296319962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.296329975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.296442032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.296442032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.296449900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.296538115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.296538115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.296586990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.296586990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.296916962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.296928883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.297116995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.297116995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.297125101 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.297214031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.297907114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.297920942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.298105001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.298105001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.298125982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.298201084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.298429012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.298561096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.298568964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.298664093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.299988985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.299998045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.300199032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.300199032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.300206900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.300246954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.300296068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.300657988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.300668955 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.300810099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.300810099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.300822020 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.300858021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.300906897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.300906897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.300955057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.301520109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.301528931 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.301693916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.301742077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.301742077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.301750898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.301790953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.303065062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.303076982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.303188086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.303195953 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.303266048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.303369999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.304446936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.304456949 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.304645061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.304645061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.304656029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.304692030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.304740906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.304898024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.304924965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.305085897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.305094957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.305176020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.306005955 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.306018114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.306153059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.306153059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.306163073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.306201935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.306298018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.307394028 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.307406902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.307607889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.307616949 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.307674885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.309870958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.309884071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.310065985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.310065985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.310076952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.310168982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.311327934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.311338902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.311484098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.311484098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.311496973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.311553955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.311651945 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.311813116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.311822891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.311950922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.312001944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.312001944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.312009096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.312050104 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.312098980 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.312342882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.312356949 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.312469959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.312477112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.312547922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.312547922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.312645912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.313385010 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.313397884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.313524008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.313524961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.313570976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.313620090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.313620090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.313626051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.313669920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.313982010 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.314116955 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.314146996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.314155102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.314198971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.314276934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.314326048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.314918041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.314928055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.315149069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.315156937 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.315239906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.315604925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.315613985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.315759897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.315767050 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.315836906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.315836906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.315886974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.317337036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.317367077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.317516088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.317590952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.317590952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.317601919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.317610979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.317661047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.317775011 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.317805052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.317984104 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.317984104 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.317996025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.318030119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.318078995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.318955898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.318969965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.319113970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.319113970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.319123983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.319211006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.319211006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.319494963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.319510937 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.319647074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.319647074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.319694042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.319694042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.319700956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.319742918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.319792032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.321563959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.321578979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.321690083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.321700096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.321801901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.321896076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.322014093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.322026014 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.322122097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.322233915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.322242975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.322324038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.322983980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.322999954 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.323220968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.323229074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.323288918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.324316025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.324327946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.324522972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.324534893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.324613094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.326288939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.326304913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.326486111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.326486111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.326498985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.326570988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.326570988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.326761961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.326778889 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.326905966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.326905966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.326919079 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.326951027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.326951027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.326998949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.327048063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.327877045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.327889919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.328069925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.328078032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.328187943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.328967094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.328989983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.329138041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.329147100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.329189062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.329189062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.329236984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.329287052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.331444025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.331458092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.331620932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.331620932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.331631899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.331669092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.331754923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.331964970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.332102060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.332102060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.332113028 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.332197905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.332321882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.333149910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.333170891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.333363056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.333363056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.333375931 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.333477020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.333631039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.333645105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.333808899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.333817005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.333920956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.334528923 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.334563971 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.334742069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.334742069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.334754944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.334880114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.335258961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.335272074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.335416079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.335427046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.335494041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.335541964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.336308956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.336323023 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.336468935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.336560011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.336560011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.336587906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.337029934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.337044001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.337157965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.337166071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.337258101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.337258101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.337347031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.338968992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.338982105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.339149952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.339160919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.339251041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.339442015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.339502096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.339576006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.339576006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.339586020 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.339693069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.340977907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.340989113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.341150045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.341150045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.341160059 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.341202021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.341342926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.341521025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.341536999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.341669083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.341669083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.341717958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.341717958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.341727018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.341824055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.342298031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.342314005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.342448950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.342448950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.342457056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.342495918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.342545033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.342545033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.342593908 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.343410015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.343422890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.343554020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.343554020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.343651056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.343658924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.343712091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.344249964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.344270945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.344398975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.344398975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.344407082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.344448090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.344448090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.344496012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.344544888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.344687939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.344705105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.344827890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.344827890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.344877958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.344927073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.344927073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.344935894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.344974041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.345119953 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.345133066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.345269918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.345269918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.345278025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.345316887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.345415115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.347280025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.347392082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.347414970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.347414970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.347464085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.347583055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.347593069 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.348402977 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.348414898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.348572969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.348572969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.348581076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.348649025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.348718882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.349215984 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.349236012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.349378109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.349378109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.349414110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.349421978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.349462986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.349560022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.349877119 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.349889994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.350054026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.350061893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.350105047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.350105047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.350153923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.350577116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.350639105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.350730896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.350821018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.350830078 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.350964069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.351634026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.351658106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.351788044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.351788044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.351833105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.351833105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.351843119 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.351931095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.351978064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.352215052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.352395058 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.352446079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.352453947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.352536917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.352623940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.353017092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.353028059 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.353122950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.353151083 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.353214025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.353302956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.354868889 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.354957104 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.355021954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.355021954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.355068922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.355078936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.355166912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.355392933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.355405092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.355540037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.355540037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.355549097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.355587959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.355637074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.355685949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.356308937 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.356322050 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.356476068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.356476068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.356484890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.356523991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.356523991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.356587887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.356791973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.356803894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.356930971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.356940985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.357008934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.357151031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.358093977 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.358160019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.358232021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.358232021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.358329058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.358329058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.358335972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.358377934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.358474970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.358633041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.358645916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.358789921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.358880043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.358886003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.358997107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.359915972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.359929085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.360076904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.360126019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.360126019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.360136032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.360174894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.360271931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.360429049 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.360449076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.360572100 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.360572100 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.360668898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.360668898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.360677004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.360717058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.360815048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.361063957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.361192942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.361247063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.361254930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.361337900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.361387014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.361583948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.361597061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.361793041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.361800909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.361882925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.363137960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.363151073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.363301992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.363301992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.363312006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.363349915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.363447905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.363574028 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.363585949 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.363755941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.363847017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.363852978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.365151882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.365180969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.365434885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.365446091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.365576982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.365636110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.365648031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.365772009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.365849018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.365856886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.365897894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.365993023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.366688967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.366702080 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.366863966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.366863966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.366877079 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.366911888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.366959095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.367058039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.367185116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.367206097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.367317915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.367317915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.367414951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.367414951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.367422104 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.367511988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.367578983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.368242025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.368305922 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.368449926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.368449926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.368460894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.368546009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.368846893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.368865013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.368983030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.368983030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.368990898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.369029999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.369029999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.369162083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.370388031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.370404959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.370543003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.370543003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.370590925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.370599031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.370687962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.370750904 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.370769024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.370881081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.370881081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.370891094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.370976925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.370976925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.371025085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.371073961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.372608900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.372674942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.372778893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.372788906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.372881889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.372960091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.373245955 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.373259068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.373467922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.373467922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.373476028 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.373516083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.373701096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.374048948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.374070883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.374186039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.374186039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.374254942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.374262094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.374279976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.374329090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.374427080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.374741077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.374752998 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.374897957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.374897957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.374944925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.374963045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.374994040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.374994040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.375195026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.375864029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.375941992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.375993967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.376107931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.376107931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.376117945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.376905918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.376919031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.377108097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.377108097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.377108097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.377120018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.377222061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.377573013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.377585888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.377732038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.377741098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.377810001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.377857924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.378402948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.378417015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.378551960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.378551960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.378599882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.378599882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.378607988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.378648043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.378695965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.378918886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.378940105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.379057884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.379065990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.379134893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.379136086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.379220009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.379694939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.379709005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.379851103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.379851103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.379899979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.379905939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.379947901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.379947901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.380045891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.380268097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.380281925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.380449057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.380449057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.380456924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.380552053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.380871058 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.380889893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.381007910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.381007910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.381016016 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.381104946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.381104946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.381104946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.381154060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.381818056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.381886005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.381957054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.382004976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.382005930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.382054090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.382061958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.382102966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.382363081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.382380962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.382555008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.382555008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.382565022 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.382603884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.382652044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.383212090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.383224010 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.383387089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.383395910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.383543015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.383833885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.383851051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.383985043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.383985043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.384032965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.384082079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.384082079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.384088039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.384130001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.384996891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.385016918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.385128975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.385138035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.385212898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.385212898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.385335922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.385561943 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.385579109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.385726929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.385726929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.385740042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.385775089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.385823011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.385823011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.386639118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.386656046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.386818886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.386841059 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.386868000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.386868000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.386915922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.387129068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.387141943 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.387237072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.387247086 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.387337923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.387386084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.387386084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.387917042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.387984037 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.388041019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.388041019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.388151884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.388151884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.388175011 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.388238907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.388298035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.388439894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.388469934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.388469934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.388480902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.388572931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.388675928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.389694929 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.389714003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.389868021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.389951944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.389951944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.389961004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.390564919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.390583992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.390719891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.390719891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.390729904 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.390794992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.390856028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.391407013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.391424894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.391525030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.391602039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.391611099 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.391693115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.391839027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.391854048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.392045975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.392045975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.392055988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.392148018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.392431974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.392447948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.392590046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.392599106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.392678022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.392678022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.392695904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.392750025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.392908096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.392923117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.393049002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.393049002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.393094063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.393191099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.393203020 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.393235922 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.393371105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.393371105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.393379927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.393466949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.393516064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.393615961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.394206047 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.394220114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.394359112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.394359112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.394407034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.394407034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.394413948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.394454956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.394504070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.395836115 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.395854950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.395983934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.395992041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.396032095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.396080971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.396203995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.396966934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.396985054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.397089958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.397139072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.397139072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.397193909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.397202969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.397275925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.397675037 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.397691965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.397831917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.397831917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.397845030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.397927046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.397975922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.398346901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.398363113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.398493052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.398493052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.398540974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.398639917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.398648977 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.399032116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.399050951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.399156094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.399156094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.399163961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.399260998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.399307966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.399938107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.399954081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.400079012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.400126934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.400126934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.400177002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.400177002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.400185108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.400224924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.400453091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.400625944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.400649071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.400691986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.400794029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.400842905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.400950909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.400968075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.401079893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.401170969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.401170969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.401179075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.401268005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.402097940 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.402116060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.402262926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.402271986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.402312040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.402312040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.402312040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.402417898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.402801037 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.402813911 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.402992010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.403001070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.403095961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.403295994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.403310061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.403445959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.403445959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.403454065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.403495073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.403543949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.403543949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.403641939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.403788090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.403800964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.403939962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.403939962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.403989077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.403997898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.404037952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.404134989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.404184103 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.404366970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.404408932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.404408932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.404417992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.404510975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.404560089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.405134916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.405147076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.405266047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.405267000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.405316114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.405412912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.405412912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.405421019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.405698061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.405714989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.405826092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.405826092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.405836105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.405921936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.405921936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.406018972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.406727076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.406744957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.407007933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.407015085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.407295942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.407314062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.407438040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.407438993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.407449007 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.407485962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.407485962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.407533884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.407582998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.407983065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.407998085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.408126116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.408204079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.408204079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.408212900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.408301115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.408432007 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.408447981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.408555031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.408565998 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.408710957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.409466982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.409482956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.409634113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.409707069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.409707069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.409707069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.409720898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.409738064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.410060883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.410079956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.410331011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.410339117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.410890102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.410906076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.411017895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.411017895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.411030054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.411109924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.411109924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.411111116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.411159039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.411333084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.411454916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.411454916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.411467075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.411550045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.411556005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.411598921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.411686897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.412308931 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.412322044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.412429094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.412508011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.412516117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.412662983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.412915945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.412930965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.413065910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.413142920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.413150072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.413300037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.413733959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.413746119 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.413937092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.413944960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.413985014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.414035082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.414495945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.414515972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.414716959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.414716959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.414726019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.414766073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.414813995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.415515900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.415529013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.415654898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.415667057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.415733099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.415733099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.415827990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.415860891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.415879965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.416003942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.416003942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.416120052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.416120052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.416126013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.416949034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.416965008 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.417100906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.417114973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.417174101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.417222023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.417432070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.417448997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.417633057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.417669058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.417678118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.417716026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.418425083 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.418441057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.418631077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.418631077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.418642044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.418678999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.418678999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.418807030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.418822050 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.418967962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.418977022 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.419015884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.419015884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.419015884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.419115067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.419722080 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.419739962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.419852972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.419852972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.419949055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.419998884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.420006990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.420608044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.420627117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.420749903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.420749903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.420758963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.420799017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.420846939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.420847893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.420896053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.421221972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.421237946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.421348095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.421401024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.421408892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.421515942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.421972036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.421989918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.422179937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.422188997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.422282934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.423041105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.423057079 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.423233032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.423240900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.423280954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.423280954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.423330069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.423806906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.423825026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.423934937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.423934937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.423943043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.424032927 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.424032927 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.424129963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.424412012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.424427032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.424611092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.424659014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.424659014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.424666882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.424782991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.424832106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.424961090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.424968958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.425009966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.425009966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.425057888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.425806999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.425826073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.425961971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.425961971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.425972939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.426011086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.426011086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.426059008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.426109076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.426438093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.426455021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.426639080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.426647902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.426728964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.426956892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.426971912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.427081108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.427081108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.427088976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.427176952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.427176952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.427226067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.427274942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.428278923 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.428293943 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.428431988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.428497076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.428503036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.428548098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.428548098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.428838968 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.428858042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.429044008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.429044008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.429044008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.429044008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.429059029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.429074049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.429121017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.429780006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.429797888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.429914951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.429915905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.429925919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.430012941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.430012941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.430030107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.430077076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.430195093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.430211067 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.430330992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.430330992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.430378914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.430378914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.430391073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.430427074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.430475950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.431621075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.431638002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.431773901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.431773901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.431785107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.431870937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.431870937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.431920052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.432014942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.432030916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.432164907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.432164907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.432210922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.432260990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.432269096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.432358980 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.432421923 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.432440042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.432553053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.432560921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.432631016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.432631016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.432760954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.434370995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.434386015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.434607029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.434614897 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.434655905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.434655905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.435655117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.435672045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.435838938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.435838938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.435852051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.435863972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.435863972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.435863972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.435976028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.436992884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.437011003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.437118053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.437129021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.437165022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.437165022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.437212944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.437212944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.437262058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.438488960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.438504934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.438711882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.438719988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.438761950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.440377951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.440397978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.440522909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.440522909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.440531015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.440570116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.440570116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.440619946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.440686941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.441034079 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.441047907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.441210985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.441302061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.441307068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.441871881 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.441889048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.442030907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.442039967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.442079067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.442079067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.442126989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.442174911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.443269014 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.443281889 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.443448067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.443499088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.443499088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.443504095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.443547010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.444174051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.444188118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.444319010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.444319010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.444327116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.444366932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.444366932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.444473028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.445415974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.445435047 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.445543051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.445645094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.445652008 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.445703983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.446564913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.446584940 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.446741104 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.446741104 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.446752071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.446810007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.446860075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.447276115 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.447288036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.447478056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.447487116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.447525978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.447575092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.447952032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.447963953 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.448141098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.448152065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.448189974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.448189974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.448239088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.448498964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.448508978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.448647976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.448647976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.448657990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.448745012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.448745012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.448796034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.449429035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.449440956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.449572086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.449572086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.449700117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.449707031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.449764967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.450364113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.450376034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.450522900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.450530052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.450567961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.450567961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.450617075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.450664997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.451165915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.451175928 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.451313019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.451313019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.451360941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.451365948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.451409101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.451410055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.451458931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.451953888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.451966047 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.452106953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.452106953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.452116013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.452153921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.452251911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.452760935 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.452774048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.452925920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.452935934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.452975035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.452975035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.453021049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.453071117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.453310013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.453320026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.453432083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.453432083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.453528881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.453528881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.453540087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.453625917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.454049110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.454062939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.454262972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.454271078 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.454340935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.454340935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.454612017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.454621077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.454797983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.454808950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.454915047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.455046892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.455056906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.455239058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.455239058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.455249071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.455337048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.455609083 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.455620050 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.455759048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.455759048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.455770016 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.455856085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.455928087 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.456110954 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.456120014 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.456254005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.456254005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.456300974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.456351042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.456351042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.456360102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.456398964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.456747055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.456759930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.456929922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.456942081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.456990957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.456990957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.457026958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.457321882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.457333088 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.457475901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.457475901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.457484961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.457524061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.457571983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.457619905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.457621098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.457632065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.457761049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.457761049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.457770109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.457858086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.457907915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.457907915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.457916975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.457957029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.458123922 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.458184958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.458255053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.458261967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.458302021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.458372116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.458372116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.458544970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.458556890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.458735943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.458735943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.458743095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.458784103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.458832979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.459041119 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.459048986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.459167004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.459176064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.459321022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.459368944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.459557056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.459566116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.459723949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.459723949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.459772110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.459778070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.459820986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.459868908 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.460047960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.460058928 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.460205078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.460205078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.460212946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.460303068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.460303068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.460303068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.460350990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.460403919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.460412979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.460570097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.460570097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.460673094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.460680962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.460725069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.460751057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.460762024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.460887909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.460896969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.460937023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.460937023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.460984945 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.461034060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.461082935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.461364031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.461373091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.461518049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.461621046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.461627960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.461673021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.462397099 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.462409019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.462532997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.462542057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.462596893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.462596893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.462726116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.464054108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.464070082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.464248896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.464258909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.464351892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.464385986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.464401007 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.464508057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.464515924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.464598894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.464598894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.464695930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.466311932 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.466327906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.466432095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.466574907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.466583967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.467021942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.467036009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.467200041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.467200041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.467207909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.467247009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.467344046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.467865944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.467879057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.467999935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.468096972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.468096972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.468106985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.468143940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.468317032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.468336105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.468538046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.468539000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.468547106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.468635082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.469490051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.469501972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.469641924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.469641924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.469655037 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.469696999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.469696999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.469728947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.469825983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.470890045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.470901966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.471046925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.471046925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.471151114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.471151114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.471162081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.472091913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.472104073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.472218990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.472227097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.472321033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.472388983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.472630024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.472640991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.472776890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.472776890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.472824097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.472830057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.472875118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.472875118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.472922087 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.473552942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.473563910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.473686934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.473695993 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.473763943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.473763943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.473870039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.476236105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.476246119 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.476416111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.476505995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.476511002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.477556944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.477566957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.477704048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.477713108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.477793932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.477793932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.478481054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.478490114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.478614092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.478614092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.478710890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.478710890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.478719950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.478807926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.479485035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.479496002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.479614019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.479614019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.479621887 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.479661942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.479769945 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.480037928 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.480046988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.480173111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.480173111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.480221033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.480271101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.480271101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.480278969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.480319023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.481117964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.481129885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.481229067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.481236935 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.481331110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.481331110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.481434107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.481595993 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.481605053 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.481771946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.481820107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.481820107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.481826067 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.481868029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.482814074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.482825041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.482968092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.482968092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.482976913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.483016968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.483064890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.483064890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.483163118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.483349085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.483360052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.483488083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.483488083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.483536005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.483584881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.483584881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.483589888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.483633041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.485611916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.485625029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.485738039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.485749960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.485838890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.485838890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.485924959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.485925913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.485934019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.485966921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.486088991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.486088991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.486135960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.486140013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.486232996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.487926960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.487937927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.488078117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.488078117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.488086939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.488125086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.488173962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.488173962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.488223076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.488414049 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.488424063 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.488559961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.488693953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.488703966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.489415884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.489428997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.489612103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.489622116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.489660978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.489660978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.489660978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.489708900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.489864111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.489872932 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.489979982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.489990950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.490144014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.490852118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.490860939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.490966082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.491132021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.491137981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.492435932 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.492446899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.492595911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.492595911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.492604971 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.492623091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.492722034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.494040012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.494050980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.494187117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.494210958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.494210958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.494260073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.494268894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.494309902 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.494309902 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.494543076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.494554043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.494708061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.494716883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.494796991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.494846106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.495666027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.495676994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.495863914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.495863914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.495872974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.495960951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.497518063 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.497529984 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.497673988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.497683048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.497730017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.497853041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.499213934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.499223948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.499350071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.499397993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.499398947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.499495029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.499504089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.499543905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.499568939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.499579906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.499686003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.499686003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.499695063 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.499783993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.499783993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.499831915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.499831915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.501096010 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.501115084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.501312017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.501321077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.501359940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.501921892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.501935959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.502093077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.502105951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.502144098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.502302885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.502561092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.502572060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.502717018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.502717018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.502764940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.502861023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.502868891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.502990007 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.503067017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.503122091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.503130913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.503196001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.503196001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.503293037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.505598068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.505609035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.505744934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.505744934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.505779982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.505779982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.505789042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.505829096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.505927086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.506078959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.506091118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.506264925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.506273031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.506311893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.506361008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.507577896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.507589102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.507734060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.507734060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.507745028 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.507782936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.507782936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.507832050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.507905006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.507996082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.508124113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.508148909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.508197069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.508202076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.508265018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.508368969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.509907961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.509922981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.510092974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.510092974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.510107040 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.510117054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.510164976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.510164976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.510318995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.510334015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.510495901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.510495901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.510507107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.510514975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.510606050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.511234999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.511246920 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.511425018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.511432886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.511581898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.511657953 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.511667967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.511881113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.511888981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.511970997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.513410091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.513422966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.513531923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.513541937 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.513601065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.513601065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.513629913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.513727903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.513729095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.513946056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.513957977 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.514103889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.514103889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.514206886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.514206886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.514213085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.516330957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.516345978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.516484022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.516484022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.516494036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.516531944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.516580105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.516678095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.517133951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.517153978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.517314911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.517314911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.517324924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.517363071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.517412901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.517532110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.517544985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.517704964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.517713070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.517859936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.518218994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.518230915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.518368006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.518368006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.518416882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.518416882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.518429995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.518513918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.518577099 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.518609047 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.518707037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.518707037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.518718004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.518822908 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.518822908 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.518831015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.518836021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.518929005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.518939018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.519043922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.519043922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.519051075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.519198895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.519752026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.519762039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.519890070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.519938946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.519938946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.519947052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.520006895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.520035982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.520133018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.520404100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.520414114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.520539045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.520629883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.520638943 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.520678043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.520771980 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.522255898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.522273064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.522411108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.522411108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.522506952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.522511959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.522599936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.522633076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.522660971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.522666931 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.522736073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.522736073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.522831917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.522881031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.524477005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.524491072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.524632931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.524632931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.524681091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.524686098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.524729967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.524779081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.524822950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.524827957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.524832964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.524957895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.524957895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.524965048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.525054932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.525058985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.525105000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.525105000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.525202036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.526135921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.526156902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.526335955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.526340961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.526427031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.526492119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.526804924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.526819944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.526999950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.527000904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.527077913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.527077913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.527077913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.527090073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.527246952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.527579069 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.527596951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.527825117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.527825117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.527837038 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.527846098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.528012991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.528259993 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.528276920 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.528449059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.528477907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.528484106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.528527021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.528527021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.528629065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.528964043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.528983116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.529123068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.529227972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.529251099 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.529257059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.529457092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.529460907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.529469013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.529555082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.529670000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.529670000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.529681921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.529690027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.529787064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.529859066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.531481981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.531497955 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.531661034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.531719923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.531719923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.531744957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.531752110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.531752110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.531893969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.532212973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.532229900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.532394886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.532394886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.532402992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.532442093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.532490969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.532644033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.532836914 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.532969952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.533047915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.533113003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.533113003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.533121109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.533252001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.533411980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.533425093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.533571959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.533571959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.533636093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.533641100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.533718109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.533759117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.534569025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.534584999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.534766912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.534857988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.534863949 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.535007000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.535147905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.535161018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.535300016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.535357952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.535357952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.535362959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.535501003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.536223888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.536237001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.536372900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.536372900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.536439896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.536444902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.536468983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.536566973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.536636114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.536828041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.536842108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.537067890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.537074089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.537132978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.537228107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.539307117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.539324045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.539534092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.539534092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.539540052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.539580107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.539726019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.539941072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.539958954 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.540123940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.540188074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.540193081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.540254116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.540375948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.541018009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.541030884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.541177988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.541177988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.541254044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.541258097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.541302919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.541410923 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.541441917 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.541455030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.541460991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.541558981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.541558981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.541608095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.541608095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.541656971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.541754961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.542109013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.542125940 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.542248964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.542248964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.542316914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.542323112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.542403936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.542507887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.542572975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.542587042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.542716980 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.542716980 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.542814970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.542814970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.542814970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.542821884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.542949915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.543359041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.543488026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.543544054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.543544054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.543607950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.543612957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.543762922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.544070959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.544084072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.544284105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.544290066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.544400930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.545228958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.545249939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.545428991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.545449972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.545542002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.545795918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.545813084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.546025038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.546031952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.546088934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.546088934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.546849012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.546864986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.547039986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.547039986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.547060013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.547082901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.547082901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.547146082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.547400951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.547418118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.547663927 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.547671080 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.547729969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.548399925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.548418999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.548639059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.548645973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.548705101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.548705101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.548957109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.548969030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.549133062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.549133062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.549139023 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.549160957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.549230099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.549230099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.549288988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.549627066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.549640894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.549784899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.549899101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.549899101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.549905062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.550232887 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.550246954 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.550373077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.550379038 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.550483942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.550630093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.551477909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.551495075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.551655054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.551655054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.551726103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.551737070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.551737070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.551742077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.551808119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.551911116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.551928043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.552037954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.552037954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.552043915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.552108049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.552134991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.552184105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.552284002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.552913904 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.552926064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.553040028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.553149939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.553154945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.553225040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.553225040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.553661108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.553673983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.553826094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.553826094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.553833008 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.553894997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.553962946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.553982019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.554055929 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.554105043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.554105043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.554174900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.554250956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.554255962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.554490089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.554505110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.554625034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.554630995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.554692984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.554693937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.554755926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.554816008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.555561066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.555577993 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.555723906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.555723906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.555787086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.555849075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.555854082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.555947065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.555960894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.556067944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.556067944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.556075096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.556135893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.556164026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.556214094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.556214094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.557092905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.557110071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.557368040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.557374001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.557431936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.558226109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.558242083 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.558408022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.558408022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.558432102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.558443069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.558443069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.558443069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.558562994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.558803082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.558820009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.559014082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.559020996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.559103966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.559412956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.559431076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.559571981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.559571981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.559578896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.559638977 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.559695959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.559706926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.559983015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.560000896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.560157061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.560157061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.560221910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.560221910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.560228109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.560237885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.560281992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.560743093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.560758114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.560925007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.560925007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.560931921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.560992002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.561052084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.561053038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.561453104 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.561526060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.561599970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.561599970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.561605930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.561723948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.561762094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.562179089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.562196016 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.562386036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.562391996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.562454939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.562454939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.562530994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.563220024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.563234091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.563432932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.563438892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.563524008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.563602924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.564502001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.564517975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.564719915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.564726114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.564786911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.564862967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.565390110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.565407038 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.565608978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.565608978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.565615892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.565680027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.565690041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.565850973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.566152096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.566168070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.566306114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.566306114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.566369057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.566374063 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.566440105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.566494942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.566831112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.566848993 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.566994905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.567053080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.567053080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.567056894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.567194939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.567481041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.567496061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.567671061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.567671061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.567733049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.567738056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.567796946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.567904949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.568634987 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.568653107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.568815947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.568815947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.568844080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.568844080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.568844080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.568849087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.568975925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.569292068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.569308996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.569535971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.569535971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.569542885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.569552898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.569816113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.569844961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.570036888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.570044041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.570103884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.570103884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.570111036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.570271015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.570652962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.570668936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.570817947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.570888042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.570888042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.570894957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.570904016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.570904016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.570947886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.571192980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.571211100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.571316957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.571316957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.571324110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.571413994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.571413994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.571511984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.571773052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.571789980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.571902037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.571902037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.571999073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.571999073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.572004080 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.572047949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.572047949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.572716951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.572736025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.572850943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.572855949 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.572942019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.573029041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.573517084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.573530912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.573715925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.573715925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.573723078 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.573761940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.573806047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.574142933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.574162006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.574292898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.574292898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.574300051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.574342966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.574364901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.574364901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.574462891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.574589014 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.574608088 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.574723005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.574723005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.574791908 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.574791908 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.574799061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.574820042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.574918032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.575323105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.575341940 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.575536013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.575541973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.575602055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.575602055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.575980902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.575997114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.576137066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.576137066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.576143980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.576204062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.576260090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.577100992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.577116013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.577244997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.577327967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.577333927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.577344894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.577558994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.577577114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.577713013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.577713013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.577719927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.577780008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.577790976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.577790976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.577856064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.578012943 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.578141928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.578147888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.578253031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.578258991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.578325033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.578428030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.578677893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.578694105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.578902960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.578908920 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.579006910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.579065084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.579281092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.579293966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.579426050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.579426050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.579463959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.579469919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.579592943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.579611063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.579981089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.579993010 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.580117941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.580197096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.580197096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.580203056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.580338955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.580555916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.580573082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.580741882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.580748081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.580858946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.580950022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.581249952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.581259012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.581406116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.581406116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.581454039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.581459045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.581551075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.581643105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.582562923 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.582572937 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.582717896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.582796097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.582796097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.582802057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.583003998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.583173990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.583187103 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.583354950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.583354950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.583379030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.583384037 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.583450079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.583450079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.583523989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.583666086 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.583676100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.583822966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.583870888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.583870888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.583874941 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.583920002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.584057093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.584614038 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.584623098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.584798098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.584804058 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.584846020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.584846020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.584944010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.585297108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.585385084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.585460901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.585509062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.585509062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.585514069 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.585557938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.585872889 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.585881948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.586045980 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.586046934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.586052895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.586149931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.586451054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.586460114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.586606026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.586606026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.586653948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.586653948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.586658001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.586751938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.587280989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.587296009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.587424040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.587430954 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.587502003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.587502003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.587599993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.588253975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.588263035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.588412046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.588490963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.588495970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.588583946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.588926077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.588942051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.589075089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.589081049 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.589153051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.589201927 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.589653969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.589663982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.589817047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.589867115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.589867115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.589873075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.589937925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.589991093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.590524912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.590537071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.590675116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.590675116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.590682030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.590738058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.590797901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.590797901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.590869904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.591516018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.591583014 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.591661930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.591661930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.591759920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.591759920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.591764927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.592190981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.592206001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.592324972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.592324972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.592329025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.592374086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.592422962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.592422962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.592472076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.592618942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.592636108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.592767000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.592767000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.592816114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.592912912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.592916965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.593425035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.593444109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.593574047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.593580008 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.593621969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.593621969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.593719006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.593854904 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.593867064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.594002008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.594002008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.594070911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.594075918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.594099998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.594099998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.594149113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.594558001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.594572067 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.594680071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.594686031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.594755888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.594755888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.594854116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.595135927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.595153093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.595360994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.595360994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.595367908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.595427990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.595438957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.596283913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.596301079 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.596434116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.596434116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.596441031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.596482038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.596530914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.596530914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.596633911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.597613096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.597631931 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.597757101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.597757101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.597845078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.597845078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.597845078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.597855091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.597906113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.598074913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.598093033 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.598228931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.598228931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.598239899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.598277092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.598325968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.598423004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.598469019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.598490000 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.598592043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.598592043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.598695040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.598699093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.598743916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.599833012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.599850893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.600034952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.600044012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.600080967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.600126982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.600135088 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.600204945 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.600214958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.600254059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.600254059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.600301027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.600349903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.601058960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.601073027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.601269960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.601269960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.601269960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.601279974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.601288080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.601433992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.602325916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.602344990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.602489948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.602489948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.602549076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.602549076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.602560043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.602567911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.602751017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.604370117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.604386091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.604521036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.604521036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.604569912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.604569912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.604578018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.604631901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.604715109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.605776072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.605791092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.605962992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.605962992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.605972052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.606010914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.606010914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.606143951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.607057095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.607086897 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.607219934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.607219934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.607247114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.607254982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.607295036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.607295036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.607404947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.608486891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.608504057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.608628035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.608675957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.608675957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.608685017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.608725071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.608725071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.608848095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.609632015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.609649897 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.609836102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.609836102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.609843969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.609872103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.609970093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.610804081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.610821962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.610943079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.610991001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.610991955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.611001968 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.611042023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.611042023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.611162901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.611321926 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.611335039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.611500978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.611506939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.611548901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.611548901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.611655951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.612356901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.612373114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.612515926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.612515926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.612569094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.612576962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.612612009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.612660885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.612759113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.613571882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.613591909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.613712072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.613712072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.613827944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.613835096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.613935947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.613984108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.613991976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.614074945 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.614166021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.615149975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.615169048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.615298033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.615298033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.615375996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.615396023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.615396023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.615406036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.615494013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.615715027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.615732908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.615844011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.615844011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.615853071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.615942001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.615942001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.615942001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.616064072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.616792917 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.616807938 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.616923094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.616923094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.616981983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.617019892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.617019892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.617028952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.617069006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.617183924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.617201090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.617311954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.617319107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.617361069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.617361069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.617408991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.617408991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.617458105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.618334055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.618346930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.618494987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.618587971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.618587971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.618597031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.618707895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.618799925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.618846893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.618846893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.618856907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.618896008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.618993044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.618993044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.619947910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.619963884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.620095015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.620172024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.620177984 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.620219946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.620536089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.620553970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.620794058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.620794058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.620807886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.620874882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.621189117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.621205091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.621316910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.621325970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.621365070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.621365070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.621413946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.621413946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.621463060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.621771097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.621783972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.621941090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.621941090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.622056961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.622066021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.622617960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.622634888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.622823954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.622832060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.622929096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.623332977 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.623346090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.623462915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.623462915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.623472929 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.623509884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.623562098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.623609066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.623851061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.623867035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.624033928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.624033928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.624042988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.624080896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.624180079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.624571085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.624589920 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.624788046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.624798059 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.624840021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.624840021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.625220060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.625236034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.625389099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.625412941 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.625449896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.625498056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.625814915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.625876904 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.625972033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.625979900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.626127958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.626646996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.626660109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.626849890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.626859903 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.626933098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.627011061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.627218962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.627228022 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.627427101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.627434969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.627479076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.627569914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.627654076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.627664089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.627790928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.627840042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.627840042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.627850056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.627887964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.627937078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.628034115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.628130913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.628140926 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.628271103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.628271103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.628370047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.628370047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.628370047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.628380060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.628596067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.628680944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.628690004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.628844023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.628921986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.628948927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.629129887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.629267931 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.629280090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.629420042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.629559040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.629568100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.629700899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.629865885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.629878044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.630002022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.630002022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.630049944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.630059004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.630099058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.630099058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.630234957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.630259037 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.630269051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.630403042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.630451918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.630451918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.630460978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.630500078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.630500078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.630624056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.630624056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.630633116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.630768061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.630768061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.630778074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.630863905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.630872011 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.630987883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.631041050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.631109953 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.631119013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.631325960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.631333113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.631398916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.631469965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.632514954 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.632524967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.632740974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.632750988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.632822037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.632900000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.633122921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.633136034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.633301973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.633424044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.633430958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.633666992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.633826017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.633837938 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.633965969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.633965969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.634063005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.634069920 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.634111881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.634198904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.634457111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.634469032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.634666920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.634674072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.634716988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.634716988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.634823084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.635519028 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.635540009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.635668993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.635718107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.635725975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.635766983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.635766983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.635843992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.635862112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.635864019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.635870934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.636018991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.636070967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.636719942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.636743069 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.636867046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.636867046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.636914015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.636961937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.636966944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.637059927 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.638113976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.638128042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.638308048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.638317108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.638356924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.638356924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.638422012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.639447927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.639458895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.639569998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.639580011 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.639647007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.639744997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.640038967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.640050888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.640206099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.640206099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.640213966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.640316010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.642818928 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.642833948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.642995119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.643004894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.643073082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.643129110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.644498110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.644510031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.644651890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.644701004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.644701004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.644710064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.644748926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.644798994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.645483017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.645495892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.645639896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.645649910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.645668983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.645744085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.645752907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.645822048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.645822048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.645828962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.645869970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.645977974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.647118092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.647128105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.647342920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.647349119 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.647391081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.647538900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.647635937 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.647645950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.647840023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.647847891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.647941113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.647991896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.648282051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.648291111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.648488045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.648488045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.648499012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.648535013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.648694992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.648947954 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.648958921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.649097919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.649163008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.649163008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.649172068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.649377108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.649388075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.649410009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.649415970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.649513960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.649513960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.649561882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.649658918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.650454998 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.650465012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.650607109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.650607109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.650655985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.650655985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.650665045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.650702953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.650851965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.652005911 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.652015924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.652153015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.652199984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.652199984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.652205944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.652249098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.652347088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.654279947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.654289961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.654345989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.654416084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.654469013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.654469013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.654479027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.654566050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.654566050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.654582024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.655224085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.655236959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.655421972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.655421972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.655446053 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.655467033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.655513048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.655658007 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.655667067 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.655807018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.655807018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.655817986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.655853987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.655903101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.655903101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.655951023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.656656981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.656666040 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.656807899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.656807899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.656856060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.656856060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.656856060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.656864882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.656963110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.657054901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.657063961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.657183886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.657190084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.657232046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.657232046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.657340050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.658406973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.658416986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.658552885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.658668041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.658689022 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.658849001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.659713984 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.659723997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.659889936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.659889936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.659899950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.659936905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.659985065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.660083055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.660388947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.660398960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.660599947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.660608053 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.660680056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.660758018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.661782980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.661792040 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.661849976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.661930084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.661930084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.661978006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.661978006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.661984921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.662025928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.662075996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.663755894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.663768053 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.663913965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.663913965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.663923979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.663964987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.664002895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.664002895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.664052963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.664097071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.664216995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.664216995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.664226055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.664333105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.664333105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.664339066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.664381981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.664431095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.666851044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.666862011 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.667000055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.667000055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.667023897 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.667059898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.667097092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.667193890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.667388916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.667531967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.667540073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.667635918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.667644024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.667690039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.667690039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.667848110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.668435097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.668453932 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.668651104 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.668661118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.668699026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.668833017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.668864965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.668874025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.669083118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.669083118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.669090986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.669181108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.669234991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.671288013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.671298027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.671499014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.671508074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.671590090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.671667099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.671866894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.671876907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.672004938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.672082901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.672082901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.672092915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.672211885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.673425913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.673435926 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.673659086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.673659086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.673669100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.673695087 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.673810959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.673827887 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.673839092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.673971891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.673971891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.674021006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.674029112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.674149036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.674200058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.675453901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.675463915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.675617933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.675723076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.675730944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.675865889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.676076889 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.676086903 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.676243067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.676243067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.676251888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.676290035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.676340103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.676436901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.677129030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.677138090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.677349091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.677349091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.677361965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.677453041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.677464008 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.677478075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.677488089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.677647114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.677647114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.677743912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.677743912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.679203987 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.679213047 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.679388046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.679397106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.679480076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.679557085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.679716110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.679725885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.679934025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.679934025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.679941893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.680114031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.680588007 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.680598021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.680768013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.680768013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.680782080 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.680814981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.680943966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.680943966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.681085110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.681097031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.681233883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.681235075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.681283951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.681293964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.681333065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.681333065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.681468010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.682580948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.682590961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.682780981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.682780981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.682791948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.682836056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.682836056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.683038950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.684112072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.684133053 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.684264898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.684381008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.684387922 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.684523106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.685312033 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.685323954 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.685461998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.685461998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.685508966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.685518980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.685606956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.685681105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.685789108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.685798883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.685926914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.686006069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.686006069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.686014891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.686225891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.686399937 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.686409950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.686538935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.686538935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.686588049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.686595917 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.686686039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.686714888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.686734915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.686743975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.686850071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.686850071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.686949015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.686949015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.686956882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.686964035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.687083960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.687083960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.687189102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.687505960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.687515020 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.687707901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.687715054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.687756062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.687836885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.688499928 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.688509941 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.688721895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.688730955 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.688771009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.688865900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.690272093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.690282106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.690414906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.690414906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.690462112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.690469980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.690510988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.690510988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.690629959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.690640926 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.690725088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.690736055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.690773010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.690773010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.690870047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.690870047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.690918922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.692202091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.692210913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.692349911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.692349911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.692397118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.692401886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.692447901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.692447901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.692544937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.692573071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.692604065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.692713976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.692713976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.692812920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.692812920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.692812920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.692823887 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.692998886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.693541050 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.693550110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.693689108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.693737984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.693737984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.693747044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.693787098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.693883896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.694067001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.694076061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.694221020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.694269896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.694274902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.694376945 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.694454908 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.694984913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.694994926 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.695132017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.695132017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.695180893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.695180893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.695188999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.695230007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.695333958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.695341110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.695349932 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.695471048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.695471048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.695566893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.695568085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.695616007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.695616007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.697326899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.697336912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.697484970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.697532892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.697541952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.697582006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.697582006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.697679043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.697815895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.697825909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.697966099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.697966099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.698014021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.698019028 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.698111057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.698159933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.698977947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.698987961 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.699095964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.699173927 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.699181080 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.699265003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.699316978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.699767113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.699779034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.699903011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.699903011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.699951887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.699959993 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.700000048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.700050116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.700145960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.700603008 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.700613022 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.700747967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.700795889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.700795889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.700802088 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.700844049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.700942993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.700992107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.701009035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.701065063 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.701150894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.701150894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.701199055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.701204062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.701246977 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.701344967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.702059984 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.702069998 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.702203989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.702203989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.702251911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.702260971 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.702301979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.702301979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.702429056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.702431917 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.702438116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.702568054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.702568054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.702579021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.702663898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.702671051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.702800989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.705246925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.705257893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.705379009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.705481052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.705491066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.705528975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.705581903 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.705595016 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.705622911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.705632925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.705765963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.705765963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.705815077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.705815077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.705862999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.706507921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.706517935 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.706715107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.706723928 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.706805944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.706870079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.707226038 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.707242966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.707365036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.707365036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.707463026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.707463026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.707473040 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.707561016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.707623959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.708703995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.708724976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.708884001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.708909035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.708909035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.708919048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.708957911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.709080935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.709445000 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.709459066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.709602118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.709602118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.709717989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.709728003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.709804058 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.709821939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.709861040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.709870100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.709952116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.710042953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.710042953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.710092068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.710283995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.710299969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.710433006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.710433006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.710481882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.710481882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.710490942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.710578918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.710628033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.711464882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.711481094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.711616039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.711694002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.711694002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.711702108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.711837053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.711860895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.711878061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.712044954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.712050915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.712093115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.712161064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.712213039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.713033915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.713047981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.713253975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.713262081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.713305950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.713417053 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.713433027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.713449001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.713455915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.713552952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.713602066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.713602066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.713649988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.713650942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.713699102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.714411020 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.714426994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.714566946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.714566946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.714616060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.714622974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.714663982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.714713097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.714761972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.714843035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.715022087 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.715029001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.715137959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.715142012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.715292931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.715678930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.715692043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.715828896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.715828896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.715877056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.715884924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.715975046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.715976954 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.716048002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.716056108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.716128111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.716128111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.716223955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.716274023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.716274023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.717375994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.717390060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.717582941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.717590094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.717631102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.717806101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.717924118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.717938900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.718117952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.718130112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.718250990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.718318939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.718801975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.718821049 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.718990088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.718990088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.719003916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.719036102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.719037056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.719156981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.719288111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.719364882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.719480991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.719480991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.719489098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.719530106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.719635963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.720141888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.720159054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.720314026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.720314026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.720361948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.720370054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.720411062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.720459938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.720560074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.720685959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.720702887 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.720860004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.720860004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.720870018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.720907927 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.721005917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.721366882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.721379042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.721509933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.721509933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.721606016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.721612930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.721664906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.721833944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.722131968 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.722146034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.722289085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.722289085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.722338915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.722338915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.722347975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.722387075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.722522974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.722619057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.722635984 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.722862005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.722871065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.722909927 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.723004103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.723006964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.723014116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.723083019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.723172903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.723172903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.723181963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.723221064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.723318100 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.725087881 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.725106001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.725243092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.725243092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.725289106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.725289106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.725298882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.725337982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.725475073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.725651026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.725665092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.725826025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.725826979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.725836992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.725872993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.725970984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.725971937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.726141930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.726155996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.726346016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.726346016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.726353884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.726425886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.726540089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.726548910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.726644039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.726721048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.727281094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.727293968 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.727503061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.727513075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.727554083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.727657080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.727835894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.727852106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.728019953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.728019953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.728034019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.728040934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.728094101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.728094101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.728230953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.728631973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.728646994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.728878975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.728889942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.728929996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.729048967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.729999065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.730019093 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.730154991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.730204105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.730204105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.730211973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.730252981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.730350018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.731362104 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.731379986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.731518984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.731569052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.731569052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.731576920 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.731616974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.731739998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.732476950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.732491970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.732650995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.732651949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.732701063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.732708931 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.732722044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.732722044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.732883930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.732907057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.732924938 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.733072042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.733072042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.733170986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.733179092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.733313084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.733695030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.733711958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.733886003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.733886003 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.733897924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.733935118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.733983994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.734081030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.734603882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.734622955 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.734795094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.734803915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.734862089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.734965086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.735361099 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.735378027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.735511065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.735558987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.735559940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.735569000 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.735608101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.735704899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.735908031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.735924006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.736042976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.736042976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.736145973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.736150980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.736289978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.737095118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.737111092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.737255096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.737255096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.737333059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.737333059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.737346888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.737355947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.737469912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.737488031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.737525940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.737535954 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.737617016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.737665892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.737665892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.737715960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.737715960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.737763882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.737799883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.737812996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.737941027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.737941027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.738039017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.738039017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.738048077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.738087893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.738187075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.738477945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.738495111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.738617897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.738617897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.738666058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.738672972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.738748074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.738773108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.738851070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.738859892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.738929033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.739001989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.740046978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.740062952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.740230083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.740278959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.740278959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.740288019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.740326881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.740619898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.740639925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.740788937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.740788937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.740799904 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.740837097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.740885973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.740983009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.741225958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.741240978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.741373062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.741463900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.741472006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.741595030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.741722107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.741739988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.741919994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.741929054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.741969109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.742017031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.742724895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.742743015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.742894888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.742904902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.742943048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.742943048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.742943048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.743041039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.743367910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.743383884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.743544102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.743634939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.743643045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.743742943 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.743805885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.743935108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.743935108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.743942976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.744050980 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.744781971 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.744791985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.745002031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.745014906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.745079041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.745289087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.745306015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.745430946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.745430946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.745440960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.745534897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.745534897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.745944023 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.745959997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.746185064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.746196985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.746305943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.747052908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.747070074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.747184992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.747194052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.747232914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.747232914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.747282982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.747282982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.747330904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.747422934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.747438908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.747550964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.747550964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.747647047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.747647047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.747656107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.747694016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.747694016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.748092890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.748111010 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.748264074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.748264074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.748271942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.748311043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.748359919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.748409033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.748944998 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.748964071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.749095917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.749095917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.749142885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.749142885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.749149084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.749242067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.749538898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.749558926 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.749667883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.749676943 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.749759912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.749759912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.749773026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.749773026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.749820948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.750271082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.750334024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.750397921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.750499964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.750520945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.750855923 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.750871897 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.751008034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.751017094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.751097918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.751240969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.751413107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.751429081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.751553059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.751600981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.751600981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.751605988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.751648903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.751746893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.752207994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.752226114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.752345085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.752351999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.752393007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.752393007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.752441883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.752490997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.752491951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.752940893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.752959967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.753086090 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.753137112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.753137112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.753145933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.753185987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.753185987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.753233910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.753544092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.753561974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.753698111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.753698111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.753707886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.753746986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.753796101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.753844023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.753844023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.754103899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.754117012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.754295111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.754302979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.754343987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.754343987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.754393101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.755137920 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.755155087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.755283117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.755290031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.755332947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.755332947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.755381107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.755381107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.755477905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.756078959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.756091118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.756298065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.756305933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.756376028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.757031918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.757066965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.757204056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.757215977 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.757261992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.757339001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.758225918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.758243084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.758378983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.758378983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.758426905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.758435965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.758476019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.758476019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.758523941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.759351015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.759370089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.759573936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.759582043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.759622097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.759670019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.760018110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.760034084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.760144949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.760152102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.760236979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.760236979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.760334015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.760539055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.760552883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.760679007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.760679007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.760727882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.760727882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.760737896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.760776043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.760776043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.761087894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.761106968 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.761262894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.761270046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.761312008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.761312008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.761360884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.762061119 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.762073040 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.762226105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.762305021 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.762331009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.762331009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.762341976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.762447119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.762447119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.762543917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.762593031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.763026953 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.763042927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.763226032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.763232946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.763274908 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.763274908 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.763381958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.763788939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.763801098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.763967037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.763976097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.764059067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.764148951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.764411926 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.764425993 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.764591932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.764642000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.764642000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.764651060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.764689922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.764787912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.765659094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.765672922 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.765892029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.765966892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.765980005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.766112089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.766437054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.766452074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.766594887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.766594887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.766643047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.766650915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.766740084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.766901016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.767764091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.767781019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.767998934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.767998934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.768007040 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.768205881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.770070076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.770097017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.770209074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.770209074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.770318985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.770318985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.770345926 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.770356894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.770493984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.770575047 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.770605087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.770730019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.770807028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.770807028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.770817995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.770958900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.771075010 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.771089077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.771183014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.771275043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.771281958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.771322966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.771415949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.773163080 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.773194075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.773381948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.773499966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.773511887 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.773653030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.773832083 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.773849964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.773991108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.773991108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.774040937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.774049997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.774087906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.774199009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.774276018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.774791002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.774807930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.774940014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.774940014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.774986982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.774991989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.775085926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.775135040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.775371075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.775386095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.775537968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.775584936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.775584936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.775590897 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.775634050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.775744915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.776760101 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.776773930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.776982069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.776982069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.776992083 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.777029991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.777127028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.777645111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.777657986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.777865887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.777865887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.777875900 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.778007030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.778915882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.778934002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.779078007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.779078007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.779123068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.779144049 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.779221058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.779243946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.779262066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.779334068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.779340982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.779411077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.779411077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.779459953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.779459953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.779509068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.779557943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.780769110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.780785084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.780958891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.780966043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.781008005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.781055927 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.781192064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.781807899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.781826973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.781974077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.782021999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.782021999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.782031059 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.782071114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.782167912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.782349110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.782366037 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.782506943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.782506943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.782556057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.782563925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.782603979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.782701969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.782701969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.782798052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.782815933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.783065081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.783073902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.783324957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.783886909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.783904076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.784079075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.784086943 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.784126997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.784176111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.784246922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.784809113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.784821987 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.784980059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.784980059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.785026073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.785034895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.785130978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.785183907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.785468102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.785485029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.785653114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.785653114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.785665035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.785700083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.785748959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.785847902 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.786797047 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.786813974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.786974907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.786974907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.787000895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.787008047 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.787049055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.787097931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.787147999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.787513971 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.787529945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.787667990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.787668943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.787715912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.787724018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.787764072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.787862062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.787862062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.788321018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.788333893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.788474083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.788474083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.788521051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.788521051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.788526058 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.788575888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.788722992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.789000988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.789014101 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.789150000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.789199114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.789207935 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.789247036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.789247036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.789344072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.789478064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.789494038 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.789695978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.789695978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.789704084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.789742947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.789849997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.790230989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.790242910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.790397882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.790514946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.790524006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.790659904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.790798903 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.790815115 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.790944099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.790944099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.791040897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.791040897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.791040897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.791049004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.791219950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.791438103 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.791450977 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.791594028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.791594028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.791641951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.791649103 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.791738987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.791800976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.792269945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.792284966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.792399883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.792476892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.792484045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.792581081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.792671919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.793651104 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.793664932 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.793807030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.793900967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.793914080 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.794051886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.794352055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.794368029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.794544935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.794544935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.794553995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.794661999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.794709921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.794928074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.794944048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.795156956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.795156956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.795171022 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.795182943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.795377970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.795453072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.795468092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.795624971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.795624971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.795695066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.795717955 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.795743942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.795948029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.795963049 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.795979977 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.796103954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.796153069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.796153069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.796163082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.796201944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.796201944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.796324968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.796495914 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.796509981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.796638966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.796638966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.796734095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.796742916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.796782970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.796920061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.796938896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.796988010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.796998024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.797068119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.797068119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.797163963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.797163963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.797177076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.797189951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.797211885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.797211885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.797223091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.797352076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.797399998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.797399998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.797450066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.797712088 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.797725916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.797924995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.797924995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.797934055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.797971964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.798080921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.798166037 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.798182964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.798352957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.798360109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.798444033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.798508883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.799103975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.799120903 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.799314976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.799323082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.799362898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.799458981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.799612045 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.799662113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.799751997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.799848080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.799856901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.799896002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.800019026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.800043106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.800051928 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.800173044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.800173044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.800270081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.800271034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.800319910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.800319910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.801285028 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.801299095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.801481962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.801481962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.801547050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.801557064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.801636934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.801654100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.801693916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.801704884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.801772118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.801881075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.801881075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.801899910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.802462101 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.802476883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.802618027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.802618027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.802653074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.802653074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.802661896 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.802759886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.802838087 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.802995920 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.803013086 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.803169966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.803169966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.803186893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.803195953 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.803236008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.803287983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.803333044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.803670883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.803684950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.803813934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.803955078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.803961039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.804143906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.805206060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.805223942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.805387974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.805438995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.805438995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.805448055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.805535078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.805619955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.806446075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.806459904 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.806598902 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.806643963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.806868076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.806869030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.806876898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.807009935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.807641983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.807657957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.807849884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.807934999 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.807945967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.808078051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.810292959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.810311079 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.810487032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.810579062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.810590029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.810748100 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.812068939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.812086105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.812278032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.812278032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.812288046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.812325001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.812423944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.812484980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.812501907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.812628031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.812628031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.812675953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.812681913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.812725067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.812773943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.812900066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.813370943 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.813390017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.813524008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.813627958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.813637018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.813771009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.814285994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.814299107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.814410925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.814578056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.814588070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.814690113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.814694881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.814704895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.814709902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.814825058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.814902067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.814902067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.814999104 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.815423965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.815440893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.815578938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.815578938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.815627098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.815634966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.815675974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.815774918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.815774918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.815865993 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.815881014 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.816006899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.816055059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.816055059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.816061020 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.816103935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.816153049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.816251040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.816812992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.816833019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.816977024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.816977024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.817003965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.817008972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.817111015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.817189932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.818264008 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.818280935 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.818453074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.818460941 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.818593979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.818670988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.820741892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.820755959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.820935965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.820935965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.820947886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.820983887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.821032047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.821130037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.821257114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.821269035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.821455002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.821461916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.821544886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.821649075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.822041035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.822052956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.822221041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.822273970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.822283030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.822320938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.822417021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.822550058 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.822566986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.822702885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.822702885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.822750092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.822755098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.822798967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.822798967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.822910070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.823555946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.823571920 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.823781967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.823781967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.823790073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.823829889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.823926926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.824810982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.824827909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.824951887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.825001001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.825001001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.825011015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.825048923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.825048923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.825148106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.825438976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.825454950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.825576067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.825691938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.825696945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.825741053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.825834990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.827081919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.827100992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.827254057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.827254057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.827265024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.827353001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.827353001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.827399969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.828207016 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.828219891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.828435898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.828435898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.828444958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.828578949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.830163002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.830177069 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.830399036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.830399036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.830414057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.830470085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.830476046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.830502987 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.830557108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.830564976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.830646038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.830646038 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.830693960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.830743074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.830743074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.832022905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.832037926 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.832180023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.832180023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.832227945 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.832232952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.832277060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.832277060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.832375050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.834053040 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.834070921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.834209919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.834209919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.834300995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.834300995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.834311962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.834323883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.834455013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.834527016 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.834544897 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.834664106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.834664106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.834779978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.834789991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.834887981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.834949017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.834956884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.835129976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.835177898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.835768938 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.835783005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.835899115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.836000919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.836008072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.836050034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.836143970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.838346958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.838361025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.838519096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.838520050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.838546991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.838568926 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.838596106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.838644981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.838757992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.838763952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.838773966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.838901043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.838908911 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.838949919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.838949919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.838960886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.839121103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.839946985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.839963913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.840096951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.840173960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.840178967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.840223074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.840447903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.841092110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.841109991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.841254950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.841254950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.841301918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.841306925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.841351032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.841351032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.841449022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.842451096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.842463970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.842607021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.842607021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.842654943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.842654943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.842664003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.842751026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.842751026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.843555927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.843569994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.843724966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.843724966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.843738079 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.843821049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.843821049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.843868971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.844153881 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.844168901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.844310045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.844310045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.844357014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.844364882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.844405890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.844455004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.844501019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.844504118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.844512939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.844634056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.844634056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.844643116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.844731092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.844738007 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.844801903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.844906092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.846196890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.846208096 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.846401930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.846410036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.846470118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.846570969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.846894026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.846904039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.847052097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.847100019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.847100019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.847105026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.847148895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.847246885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.847362995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.847372055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.847507000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.847585917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.847585917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.847596884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.847604036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.847652912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.847783089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.847996950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.848006964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.848144054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.848144054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.848191977 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.848196983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.848289967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.848339081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.849946976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.849960089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.850138903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.850138903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.850197077 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.850207090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.850213051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.850213051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.850372076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.851620913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.851630926 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.851773024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.851773024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.851819992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.851828098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.851870060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.851917982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.852016926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.852049112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.852186918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.852186918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.852190971 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.852283955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.852289915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.852395058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.852395058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.852765083 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.852773905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.852904081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.852982998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.852982998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.852998018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.853055000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.853162050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.853610039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.853619099 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.853780985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.853890896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.853899002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.854084969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.854130030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.854139090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.854293108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.854293108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.854315996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.854325056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.854366064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.854465008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.854465008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.854536057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.854549885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.854748011 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.854757071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.854799986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.854891062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.855268002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.855277061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.855412006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.855412006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.855509043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.855509043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.855515957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.855762005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.856774092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.856784105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.856971979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.856971979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.856980085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.857069969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.857180119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.858134985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.858169079 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.858298063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.858362913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.858370066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.858453035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.858530998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.858891010 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.858908892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.859039068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.859039068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.859086990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.859086990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.859093904 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.859137058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.859234095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.859334946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.859344959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.859468937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.859468937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.859564066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.859564066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.859564066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.859571934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.859751940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.860418081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.860428095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.860558987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.860636950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.860646009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.860742092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.860831976 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.861016989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.861027956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.861157894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.861206055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.861206055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.861215115 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.861254930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.861303091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.861402035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.861439943 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.861449957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.861572981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.861572981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.861622095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.861622095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.861629009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.861676931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.861819983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.862193108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.862210989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.862328053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.862328053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.862457037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.862466097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.862588882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.863810062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.863827944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.863953114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.864000082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.864082098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.864087105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.864223957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.865240097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.865253925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.865398884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.865434885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.865443945 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.865453005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.865540981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.865540981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.865603924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.865746975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.866702080 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.866713047 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.866841078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.866841078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.866887093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.866887093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.866894960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.866935015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.866983891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.867203951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.867222071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.867398024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.867408037 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.867489100 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.867850065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.867866039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.868073940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.868083954 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.868153095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.868542910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.868561029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.868738890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.868738890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.868751049 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.868772030 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.868820906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.868905067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.869095087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.869112015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.869231939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.869231939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.869242907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.869373083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.871069908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.871085882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.871324062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.871331930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.871371031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.872250080 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.872266054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.872376919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.872385979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.872453928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.872503996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.872883081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.872901917 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.873013973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.873013973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.873111010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.873111010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.873111010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.873116970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.873159885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.874265909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.874283075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.874458075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.874481916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.874545097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.874650955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.875397921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.875415087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.875602007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.875602007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.875612974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.875650883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.875747919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.876008987 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.876027107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.876184940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.876197100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.876251936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.876251936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.876714945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.876734018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.876889944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.876899958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.876969099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.876969099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.877033949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.877254009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.877269983 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.877394915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.877394915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.877443075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.877449989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.877491951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.877491951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.877541065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.878106117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.878124952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.878238916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.878247023 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.878288984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.878288984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.878288984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.878336906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.878434896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.878731012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.878747940 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.878901958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.878950119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.878950119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.878957987 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.878998995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.879506111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.879606009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.879642963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.879652977 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.879692078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.879692078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.879812956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.880003929 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.880017996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.880137920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.880215883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.880215883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.880223989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.880372047 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.880938053 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.880954981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.881159067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.881217957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.881227016 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.881361008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.881572008 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.881586075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.881711006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.881711006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.881758928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.881763935 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.881808996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.881856918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.881956100 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.882524967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.882538080 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.882674932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.882674932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.882725000 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.882734060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.882802963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.882802963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.882869005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.882960081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.882977962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.883090973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.883193016 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.883203030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.883285046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.883400917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.884135008 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.884150028 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.884371042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.884371042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.884382010 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.884505987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.884723902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.884737015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.884922028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.884922028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.884931087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.885037899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.885087013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.886130095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.886148930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.886327028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.886327028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.886348963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.886409998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.886409998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.886522055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.887330055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.887347937 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.887509108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.887633085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.887639999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.887808084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.888462067 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.888478994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.888679981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.888689041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.888727903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.888822079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.888833046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.888844967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.888865948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.888978958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.888978958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.889027119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.889034986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.889134884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.889182091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.889539957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.889555931 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.889730930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.889730930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.889736891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.889827967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.889887094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.889961004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.889976978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.890122890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.890126944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.890172005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.890172005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.890269041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.893661022 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.893677950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.893871069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.893871069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.893882990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.893892050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.894001007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.894063950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.894081116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.894104958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.894114971 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.894237995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.894237995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.894339085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.894339085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.894459009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.894670963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.894704103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.894759893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.894769907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.894845963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.894952059 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.895143032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.895158052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.895365953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.895365953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.895376921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.895462036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.895471096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.895479918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.895550013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.895558119 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.895683050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.895788908 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.895821095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.895838022 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.896034956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.896039963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.896125078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.896217108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.896505117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.896517992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.896698952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.896704912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.896748066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.896748066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.896855116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.897030115 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.897046089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.897166967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.897166967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.897264957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.897264957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.897269011 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.897314072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.897417068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.897433996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.897465944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.897469044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.897557020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.897557020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.897655010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.897655010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.897705078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.897753954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.897953987 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.897970915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.898155928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.898155928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.898164034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.898258924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.898312092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.898495913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.898513079 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.898675919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.898684025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.898766994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.898858070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.899374962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.899390936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.899521112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.899569988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.899569988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.899578094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.899620056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.899717093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.900012970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.900029898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.900185108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.900193930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.900250912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.900352955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.900609970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.900623083 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.900860071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.900867939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.901002884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.901566982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.901585102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.901705027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.901705027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.901803017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.901803017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.901809931 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.901901007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.901977062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.902092934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.902110100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.902251005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.902251005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.902299881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.902307034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.902348995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.902396917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.902535915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.903235912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.903253078 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.903373957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.903512001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.903518915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.903655052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.903743982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.903762102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.903889894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.903889894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.903938055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.903945923 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.903986931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.903986931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.904084921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.904239893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.904462099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.904462099 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.904473066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.904479027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.904629946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.904665947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.905113935 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.905129910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.905280113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.905280113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.905328989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.905328989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.905335903 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.905376911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.905474901 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.906039953 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.906055927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.906177044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.906224966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.906224966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.906230927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.906274080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.906372070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.906420946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.906991005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.907007933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.907191992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.907191992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.907201052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.907239914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.907346010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.907519102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.907532930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.907672882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.907672882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.907721996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.907721996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.907730103 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.907769918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.907866955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.907931089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.907948017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.908088923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.908088923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.908137083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.908144951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.908185959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.908233881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.908334970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.908334970 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.908344030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.908467054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.908473969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.908569098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.908576012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.908682108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.908682108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.908926010 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.908943892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.909075975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.909075975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.909193039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.909198999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.909388065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.909554005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.909569979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.909687042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.909737110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.909737110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.909737110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.909748077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.909832954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.909882069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.910898924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.910916090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.911104918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.911114931 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.911153078 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.911310911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.911498070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.911514997 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.911636114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.911708117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.911711931 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.911814928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.911854029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.912345886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.912359953 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.912472010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.912636995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.912642002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.912776947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.912780046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.912784100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.912823915 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.912950039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.912950039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.912955046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.912997961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.913094997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.913683891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.913700104 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.913837910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.913837910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.913882971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.913891077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.913980007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.914081097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.914285898 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.914303064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.914484978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.914484978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.914494991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.914531946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.914629936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.915030956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.915046930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.915173054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.915263891 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.915271044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.915406942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.915414095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.915421009 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.915519953 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.915549994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.915627956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.915635109 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.915771008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.916026115 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.916042089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.916161060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.916161060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.916208029 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.916213036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.916306973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.916356087 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.916793108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.916811943 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.916966915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.917015076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.917015076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.917021990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.917162895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.917741060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.917758942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.917929888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.917929888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.917951107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.918026924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.918085098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.918380976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.918397903 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.918579102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.918586016 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.918672085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.918747902 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.918966055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.918978930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.919112921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.919112921 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.919162035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.919168949 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.919209957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.919209957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.919317961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.919420958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.919436932 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.919631958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.919639111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.919680119 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.919775009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.920484066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.920500040 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.920698881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.920698881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.920708895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.920906067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.920969963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.920989037 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.921166897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.921175957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.921257019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.921374083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.921547890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.921564102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.921737909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.921737909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.921744108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.921786070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.921834946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.921932936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.921947956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.921966076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.922152996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.922153950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.922158003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.922250986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.922308922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.923221111 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.923238039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.923368931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.923517942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.923521042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.923674107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.924238920 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.924254894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.924416065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.924416065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.924420118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.924513102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.924566984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.925829887 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.925847054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.925975084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.926023960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.926023960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.926028013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.926073074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.926171064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.926626921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.926644087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.926781893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.926781893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.926830053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.926832914 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.926879883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.926879883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.926989079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.927314043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.927329063 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.927509069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.927510023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.927514076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.927526951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.927557945 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.927557945 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.927562952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.927655935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.927659035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.927717924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.927717924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.927907944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.927921057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.928042889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.928042889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.928046942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.928091049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.928091049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.928210974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.929039955 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.929058075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.929161072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.929161072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.929258108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.929258108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.929263115 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.929306984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.929356098 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.929518938 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.929533005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.929653883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.929657936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.929703951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.929703951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.929703951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.929752111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.929800987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.930003881 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.930021048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.930115938 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.930227041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.930227041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.930229902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.930274963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.930588007 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.930603981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.930733919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.930733919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.930737972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.930782080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.930782080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.930830956 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.930880070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.931190968 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.931206942 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.931332111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.931332111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.931380033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.931477070 CET	55499	443	192.168.11.20	142.250.72.164
Mar 26, 2024 19:38:22.931478024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.931480885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.931497097 CET	443	55499	142.250.72.164	192.168.11.20
Mar 26, 2024 19:38:22.931632042 CET	61211	443	192.168.11.20	142.250.72.164
Mar 26, 2024 19:38:22.931646109 CET	443	61211	142.250.72.164	192.168.11.20
Mar 26, 2024 19:38:22.931735039 CET	55499	443	192.168.11.20	142.250.72.164
Mar 26, 2024 19:38:22.931819916 CET	61211	443	192.168.11.20	142.250.72.164
Mar 26, 2024 19:38:22.931845903 CET	55499	443	192.168.11.20	142.250.72.164
Mar 26, 2024 19:38:22.931857109 CET	443	55499	142.250.72.164	192.168.11.20
Mar 26, 2024 19:38:22.931924105 CET	61211	443	192.168.11.20	142.250.72.164
Mar 26, 2024 19:38:22.931930065 CET	443	61211	142.250.72.164	192.168.11.20
Mar 26, 2024 19:38:22.932848930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.932867050 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.933022022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.933032990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.933114052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.933114052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.934242010 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.934257030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.934385061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.934406996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.934478045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.934530973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.935971022 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.935982943 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.936103106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.936103106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.936199903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.936199903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.936206102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.936297894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.937109947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.937123060 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.937261105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.937268019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.937338114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.937386036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.937465906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.937477112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.937588930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.937689066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.937695026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.937736988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.937985897 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.937998056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.938117981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.938117981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.938123941 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.938165903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.938165903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.938286066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.940290928 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.940329075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.940445900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.940445900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.940493107 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.940541983 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.940546989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.940591097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.940639973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.940855980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.940866947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.940990925 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.940996885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.941039085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.941039085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.941087961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.941137075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.942033052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.942042112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.942164898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.942291021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.942296028 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.942349911 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.942379951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.942404985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.942498922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.942498922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.942502975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.942615032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.942667961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.943484068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.943501949 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.943655968 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.943770885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.943775892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.944070101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.944263935 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.944282055 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.944422960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.944422960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.944428921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.944472075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.944520950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.944571018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.945652008 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.945668936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.945816040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.945905924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.945916891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.945928097 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.946008921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.946026087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.946074009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.946078062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.946151972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.946263075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.946325064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.946325064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.947741032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.947758913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.947894096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.948024035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.948029995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.948193073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.948925972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.948941946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.949079990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.949079990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.949127913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.949139118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.949177027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.949177027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.949274063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.949521065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.949536085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.949702978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.949776888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.949776888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.949776888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.949789047 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.949922085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.950633049 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.950649023 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.950841904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.950841904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.950849056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.951046944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.951484919 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.951514959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.951718092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.951718092 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.951724052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.951798916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.951879025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.952265978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.952280998 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.952452898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.952548027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.952554941 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.952725887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.952898979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.952912092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.953134060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.953134060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.953146935 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.953155041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.953155041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.953304052 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.953695059 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.953706026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.953866959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.953866959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.953937054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.953937054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.953937054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.953944921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.954114914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.954205990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.954222918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.954375982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.954375982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.954437971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.954442978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.954502106 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.954576015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.955045938 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.955059052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.955199957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.955199957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.955248117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.955252886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.955355883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.955434084 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.955857992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.955876112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.956047058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.956047058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.956059933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.956068039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.956068039 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.956120014 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.956187963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.956193924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.956382990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.956434965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.956768036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.956779957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.956933975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.956933975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.957071066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.957071066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.957082987 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.957664013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.957680941 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.957820892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.957827091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.957878113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.957976103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.958379984 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.958395958 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.958580017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.958584070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.958709955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.958849907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.958867073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.959052086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.959058046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.959172010 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.960134029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.960165024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.960349083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.960359097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.960401058 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.960869074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.960882902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.961025953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.961025953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.961036921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.961072922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.961072922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.961153984 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.961226940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.961375952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.961390972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.961530924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.961530924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.961600065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.961627960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.961627960 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.961635113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.961677074 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.962009907 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.962028027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.962130070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.962130070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.962136030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.962220907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.962232113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.962232113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.962280035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.962675095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.962687016 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.962820053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.962963104 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.962974072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.962985992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.963370085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.963382959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.963574886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.963586092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.963665962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.963941097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.963953018 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.964119911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.964131117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.964170933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.964219093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.964495897 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.964514017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.964653015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.964653015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.964664936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.964729071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.964776993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.965101004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.965116978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.965235949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.965235949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.965284109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.965333939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.965333939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.965337992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.965430975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.965805054 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.965821981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.965950966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.965950966 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.965955973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.965998888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.966097116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.966510057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.966526031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.966692924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.966804028 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.966809034 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.966924906 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.967042923 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.967076063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.967076063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.967082024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.967142105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.967202902 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.967564106 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.967578888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.967705965 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.967801094 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.967812061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.967895985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.967952967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.968278885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.968297005 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.968434095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.968434095 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.968482971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.968487024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.968532085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.968532085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.968655109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.969012976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.969029903 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.969162941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.969162941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.969211102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.969211102 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.969216108 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.969259977 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.969408989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.969428062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.969458103 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.969567060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.969615936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.969615936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.969625950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.969665051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.969665051 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.969786882 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.970299959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.970316887 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.970449924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.970449924 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.970519066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.970524073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.970582962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.970644951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.970694065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.971024990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.971035957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.971177101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.971177101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.971225977 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.971230030 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.971275091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.971275091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.971385002 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.971412897 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.971430063 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.971554995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.971554995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.971602917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.971606970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.971652031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.971652031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.971750021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.972224951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.972242117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.972359896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.972359896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.972490072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.972493887 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.972632885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.973387957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.973416090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.973556042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.973604918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.973604918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.973609924 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.973702908 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.973815918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.975328922 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.975346088 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.975547075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.975558043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.975637913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.975766897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.976553917 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.976592064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.976716995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.976716995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.976802111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.976811886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.976819992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.976949930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.978741884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.978760004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.978913069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.978913069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.978988886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.978998899 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.979010105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.979010105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.979185104 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.979304075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.979315996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.979530096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.979536057 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.979594946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.979684114 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.980880976 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.980892897 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.981033087 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.981033087 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.981080055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.981080055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.981086969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.981187105 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.981291056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.981499910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.981511116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.981643915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.981643915 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.981690884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.981697083 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.981709003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.981754065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.981754065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.981759071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.981851101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.981857061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.981940985 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.982237101 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.982247114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.982357979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.982357979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.982366085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.982455015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.982455015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.982553959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.982868910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.982877970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.983035088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.983035088 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.983042955 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.983082056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.983130932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.983180046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.983520031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.983541965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.983658075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.983658075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.983664989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.983705997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.983705997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.983755112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.983755112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.984957933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.984968901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.985147953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.985148907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.985162020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.985162020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.985168934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.985210896 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.985308886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.986238003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.986272097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.986450911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.986450911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.986459017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.986474991 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.986522913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.986572981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.988048077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.988058090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.988194942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.988202095 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.988243103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.988243103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.988291979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.988389015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.988766909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.988779068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.988940954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.989052057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.989052057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.989058971 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.989121914 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.989134073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.989286900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.989286900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.989294052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.989335060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.989335060 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.989336014 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.989432096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.990238905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.990247965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.990365982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.990412951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.990463018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.990463018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.990463018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.990469933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.990511894 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.991592884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.991605043 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.991719961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.991724968 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.991822004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.991822004 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.991919041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.992156982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.992166996 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.992302895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.992379904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.992383957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.992429972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.993746042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.993786097 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.993928909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.993928909 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.993952036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.993977070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.993977070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.994024992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.995117903 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.995131969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.995266914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.995266914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.995273113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.995315075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.995364904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.995364904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.995413065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.996850967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.996865988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.997039080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.997039080 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.997082949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.997082949 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.997090101 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.997150898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.997150898 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.997355938 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.997375011 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.997489929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.997489929 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.997498989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.997594118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.997642040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.998518944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.998584032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.998724937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:22.998729944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:22.998802900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.000396013 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.000411987 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.000643969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.000653982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.000709057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.001147985 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.001183033 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.001302958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.001302958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.001317024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.001398087 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.001398087 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.001523972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.001579046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.001593113 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.001702070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.001702070 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.001777887 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.001851082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.001862049 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.001915932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.002155066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.002170086 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.002286911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.002286911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.002291918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.002335072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.002383947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.002383947 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.002433062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.003633022 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.003649950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.003859997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.003866911 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.003962994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.005179882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.005198956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.005357027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.005357027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.005367994 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.005382061 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.005454063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.005454063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.005527020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.006572962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.006588936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.006735086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.006813049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.006813049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.006824017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.006881952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.007709026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.007728100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.007877111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.007877111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.007884026 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.007925987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.007925987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.007925987 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.008023024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.009300947 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.009316921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.009450912 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.009531975 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.009541988 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.009645939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.009880066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.009895086 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.010009050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.010015965 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.010087967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.010087967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.010216951 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.010593891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.010607004 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.010736942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.010785103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.010785103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.010791063 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.010833979 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.010883093 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.010931969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.011058092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.011073112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.011192083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.011194944 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.011240005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.011240005 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.011288881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.011288881 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.011337996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.012734890 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.012753010 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.012877941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.012877941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.012976885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.012976885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.012984037 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.013056993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.013056993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.013290882 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.013310909 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.013473988 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.013479948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.013501883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.013501883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.013550997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.013600111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.013792038 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.013804913 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.013978958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.013978958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.013991117 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.013999939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.014000893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.014046907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.014096022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.014198065 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.014331102 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.014338017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.014338017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.014343023 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.014385939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.014493942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.014691114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.014707088 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.014832973 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.014910936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.014910936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.014921904 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.015053034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.018742085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.018778086 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.018954992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.018954992 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.018968105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.018980026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.019053936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.019133091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.021473885 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.021491051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.021666050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.021666050 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.021684885 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.021692038 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.021760941 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.021837950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.021898031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.022273064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.022286892 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.022438049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.022485971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.022485971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.022491932 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.022535086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.022633076 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.022810936 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.022824049 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.022943974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.022943974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.023041964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.023041964 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.023046017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.023176908 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.023178101 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.023183107 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.023276091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.023320913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.023320913 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.023418903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.023422003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.023468018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.023555040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.023616076 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.023633003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.023751974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.023840904 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.023844957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.023890018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.024035931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.024234056 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.024250031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.024374008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.024471998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.024477959 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.024555922 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.024648905 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.024884939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.024899006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.025053024 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.025115013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.025121927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.025163889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.025258064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.025315046 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.025331974 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.025480986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.025480986 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.025557041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.025557995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.025557995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.025569916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.025764942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.025886059 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.025897980 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.026072025 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.026077032 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.026165962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.026259899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.026655912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.026671886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.026806116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.026806116 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.026909113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.026915073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.027051926 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.027128935 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.027143002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.027298927 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.027298927 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.027396917 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.027404070 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.027533054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.027647972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.027663946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.027832031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.027832031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.027836084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.027909994 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.027973890 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.028388977 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.028405905 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.028522015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.028522015 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.028665066 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.028666019 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.028676987 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.028687954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.028806925 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.028872967 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.028894901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.028964043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.028964043 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.029019117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.029191017 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.029205084 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.029328108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.029334068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.029458046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.029555082 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.031213999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.031225920 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.031368971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.031482935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.031488895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.031507969 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.031950951 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.031964064 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.032154083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.032154083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.032165051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.032172918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.032172918 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.032248020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.032674074 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.032691956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.032861948 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.032871962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.032960892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.032960892 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.033734083 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.033752918 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.033931017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.033931017 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.033941984 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.034060955 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.034594059 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.034607887 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.034775972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.034775972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.034787893 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.034800053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.034800053 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.034873962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.034893990 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.035140991 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.035155058 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.035346031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.035352945 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.035393953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.035443068 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.035485029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.035501957 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.035684109 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.035689116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.035732031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.035780907 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.036314964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.036329031 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.036510944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.036510944 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.036519051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.036537886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.036623001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.038129091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.038141966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.038325071 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.038336039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.038408041 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.039614916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.039633036 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.039767981 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.039778948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.039849997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.039849997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.039849997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.039864063 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.039933920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.040709019 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.040725946 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.040898085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.040898085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.040908098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.041012049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.041764975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.041791916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.041937113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.041937113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.041945934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.042030096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.042030096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.042366982 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.042382956 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.042602062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.042602062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.042614937 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.042697906 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.043195963 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.043215990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.043382883 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.043395042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.043431044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.043431044 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.043479919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.043950081 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.044014931 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.044083118 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.044090986 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.044159889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.044159889 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.044238091 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.044401884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.044416904 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.044538021 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.044586897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.044586897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.044595003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.044635057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.044683933 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.044781923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.045048952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.045084953 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.045187950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.045264006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.045264006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.045275927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.045285940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.045285940 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.045499086 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.045826912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.045840979 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.046041012 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.046046972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.046138048 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.046226978 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.046405077 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.046421051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.046605110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.046605110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.046612024 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.046653032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.046751022 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.046909094 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.046922922 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.047046900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.047046900 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.047175884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.047180891 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.047318935 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.047861099 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.047877073 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.048032045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.048032045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.048094034 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.048099041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.048109055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.048109055 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.048280954 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.048715115 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.048727989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.048907042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.048907995 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.048995018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.048995018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.048995018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.049006939 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.049113035 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.049133062 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.049232006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.049242973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.049335957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.049335957 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.049356937 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.049454927 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.050121069 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.050134897 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.050268888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.050268888 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.050354958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.050354958 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.050362110 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.050404072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.050502062 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.051161051 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.051176071 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.051350117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.051350117 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.051364899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.051364899 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.051383972 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.051409006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.051506996 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.052381992 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.052397966 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.052532911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.052628040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.052628040 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.052634001 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.052772045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.053821087 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.053858042 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.053962946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.054018974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.054018974 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.054025888 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.054059982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.054059982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.054157972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.054603100 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.054621935 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.054781914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.054781914 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.054789066 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.054835081 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.054913998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.054928064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.055279970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.055298090 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.055537939 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.055551052 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.055757046 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.055840969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.055854082 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.056072950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.056082964 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.056092978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.056121111 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.056128025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.056221008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.056221008 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.056229115 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.056296110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.056296110 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.057938099 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.057951927 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.058135033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.058135033 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.058146000 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.058156013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.058156013 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.058202982 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.059336901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.059351921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.059592962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.059603930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.059663057 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.060966015 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.060981989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.061114073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.061114073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.061122894 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.061194897 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.061275959 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.061486006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.061502934 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.061628103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.061655045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.061655045 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.061703920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.061703920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.061709881 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.061753035 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.061914921 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.061933041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.062036037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.062036037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.062042952 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.062134027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.062134027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.062182903 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.062232018 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.062551975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.062561989 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.062738895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.062738895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.062746048 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.062787056 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.062835932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.062918901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.062937975 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.063050032 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.063055038 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.063102007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.063102007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.063199997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.063199997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.063836098 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.063852072 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.063972950 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.063980103 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.064058065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.064058065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.064135075 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.064359903 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.064376116 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.064506054 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.064554930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.064604998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.064604998 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.064611912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.064652920 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.065164089 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.065201998 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.065331936 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.065341949 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.065376997 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.065468073 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.065690041 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.065710068 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.065884113 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.065891981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.065960884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.065960884 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.066330910 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.066345930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.066555023 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.066565990 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.066631079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.066631079 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.067188025 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.067202091 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.067317963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.067328930 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.067406893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.067406893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.067528963 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.067869902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.067882061 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.068068027 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.068075895 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.068136930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.068136930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.068681002 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.068700075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.068814993 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.068825006 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.068900108 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.068990946 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.069262981 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.069329023 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.069395065 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.069454908 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.069454908 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.069490910 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.069495916 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.069834948 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.069852114 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.069978952 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.069986105 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.070029020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.070029020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.070029020 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.070076942 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.070125103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.070529938 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.070547104 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.070682049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.070682049 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.070729971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.070729971 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.070734978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.070777893 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.070827007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.071238995 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.071259022 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.071369886 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.071377039 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.071419001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.071419001 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.071468115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.071468115 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.071516037 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.071768999 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.071784973 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.071893930 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.072058916 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.072062969 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.073803902 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.073824883 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.073996067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.074003935 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.074044943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.074044943 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.074093103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.074786901 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.074800968 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.074948072 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.074959040 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.075089931 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.075356960 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.075375080 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.075479031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.075479031 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.075489044 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.075576067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.075576067 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.075623989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.075673103 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.075719118 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.075735092 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.075869083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.075869083 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.075917006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.075917006 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.075922012 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.075964928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.076014042 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.076538086 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.076555967 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.076662064 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.076668978 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.076817036 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.077076912 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.077091932 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.077228069 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.077296972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.077296972 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.077303886 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.077310085 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.077358007 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.077677011 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.077696085 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.077863932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.077863932 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.077872038 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.077935934 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.077991009 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.077991962 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.078166962 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.078180075 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.078300953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.078300953 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.078313112 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.078397989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.078397989 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.078445911 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.078495026 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.078603029 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.078614950 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.078727961 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.078805923 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.078811884 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.078910112 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.079323053 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.079339027 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.079469919 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.079479933 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.079546928 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.079595089 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.079988003 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.079998970 CET	443	53385	18.154.132.65	192.168.11.20
Mar 26, 2024 19:38:23.080118895 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.080197096 CET	53385	443	192.168.11.20	18.154.132.65
Mar 26, 2024 19:38:23.080197096 CET	53385	443	192.168.11.20	18.154.132.65

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 26, 2024 19:38:19.770756006 CET	192.168.11.20	1.1.1.1	0xce02	Standard query (0)	download01.logi.com	A (IP address)	IN (0x0001)	false
Mar 26, 2024 19:38:22.414592981 CET	192.168.11.20	1.1.1.1	0xdbf1	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 26, 2024 19:38:44.903135061 CET	192.168.11.20	1.1.1.1	0x289f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 26, 2024 19:39:00.980906010 CET	192.168.11.20	1.1.1.1	0x59b2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 26, 2024 19:38:19.961930990 CET	1.1.1.1	192.168.11.20	0xce02	No error (0)	download01.logi.com	d1q20hs7kavmn5.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2024 19:38:19.961930990 CET	1.1.1.1	192.168.11.20	0xce02	No error (0)	d1q20hs7kavmn5.cloudfront.net		18.154.132.65	A (IP address)	IN (0x0001)	false
Mar 26, 2024 19:38:19.961930990 CET	1.1.1.1	192.168.11.20	0xce02	No error (0)	d1q20hs7kavmn5.cloudfront.net		18.154.132.80	A (IP address)	IN (0x0001)	false
Mar 26, 2024 19:38:19.961930990 CET	1.1.1.1	192.168.11.20	0xce02	No error (0)	d1q20hs7kavmn5.cloudfront.net		18.154.132.26	A (IP address)	IN (0x0001)	false
Mar 26, 2024 19:38:19.961930990 CET	1.1.1.1	192.168.11.20	0xce02	No error (0)	d1q20hs7kavmn5.cloudfront.net		18.154.132.40	A (IP address)	IN (0x0001)	false
Mar 26, 2024 19:38:22.581564903 CET	1.1.1.1	192.168.11.20	0xdbf1	No error (0)	www.google.com		142.250.72.164	A (IP address)	IN (0x0001)	false
Mar 26, 2024 19:38:45.070193052 CET	1.1.1.1	192.168.11.20	0x289f	No error (0)	www.google.com		142.250.188.228	A (IP address)	IN (0x0001)	false
Mar 26, 2024 19:39:01.148219109 CET	1.1.1.1	192.168.11.20	0x59b2	No error (0)	www.google.com		172.217.14.68	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	53385	18.154.132.65	443	6088	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-26 18:38:20 UTC	730	OUT	GET /web/ftp/pub/techsupport/optionsplus/logioptionsplus_installer.exe HTTP/1.1 Host: download01.logi.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-26 18:38:20 UTC	649	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 30454528 Connection: close Last-Modified: Wed, 06 Mar 2024 07:45:44 GMT x-amz-server-side-encryption: AES256 x-amz-meta-cb-modifiedtime: Wed, 06 Mar 2024 03:24:35 GMT x-amz-version-id: oYliw3EmTpY0NTRwfRMhMBTB9tF.K.9c Accept-Ranges: bytes Server: AmazonS3 Date: Tue, 26 Mar 2024 14:00:56 GMT ETag: "43d5805571b019c67f965c749ad18aa1" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 db5074d02aa0b9851d4e5d66a6fc3826.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P3 X-Amz-Cf-Id: pISmmCGlSv8yq5HJq2pjJ3VPwRVb9fejPwlD40UK6tVgPSFedqEVwQ== Age: 16645
2024-03-26 18:38:20 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 23 06 dd ce 67 67 b3 9d 67 67 b3 9d 67 67 b3 9d 6e 1f 20 9d 5d 67 b3 9d 83 17 b2 9c 60 67 b3 9d 67 67 b2 9d fe 67 b3 9d c3 19 b6 9c 31 67 b3 9d c3 19 b7 9c 77 67 b3 9d c3 19 b0 9c 6f 67 b3 9d 83 17 b6 9c d6 67 b3 9d 83 17 b0 9c 6b 67 b3 9d 83 17 b7 9c 72 67 b3 9d 71 18 b6 9c 6e 67 b3 9d 71 18 4c 9d 66 67 b3 9d 67 67 24 9d 66 67 b3 9d 71 18 b1 9c 66 67 b3 9d 52 69 63 68 67 67 b3 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$#ggggggn ]g`gggg1gwgoggkgrgqngqLfggg$fgqfgRichgg
2024-03-26 18:38:20 UTC	16384	IN	Data Raw: 20 49 c7 40 e0 07 00 00 00 66 45 89 50 c8 48 3b ca 75 bd c3 cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 10 48 89 6c 24 18 48 89 4c 24 08 56 57 41 56 48 83 ec 50 49 8b e9 4d 8b f0 48 8b f2 48 8b f9 33 db 89 5c 24 40 8d 4b 70 e8 3b 0a 03 00 48 89 44 24 48 48 85 c0 74 44 8b 8c 24 b0 00 00 00 89 4c 24 38 0f b6 8c 24 a8 00 00 00 88 4c 24 30 0f b6 8c 24 a0 00 00 00 88 4c 24 28 48 8b 8c 24 90 00 00 00 48 89 4c 24 20 4c 8b cd 4d 8b c6 48 8b d6 48 8b c8 e8 84 5d 03 00 48 8b d8 48 89 1f c7 44 24 40 01 00 00 00 48 8d 4b 08 e8 3d 1e 00 00 48 8b 94 24 98 00 00 00 48 8d 4b 08 e8 dc 02 00 00 c6 43 28 07 48 8b d6 48 8b 0f e8 1d 70 03 00 48 8b c7 48 8b 5c 24 78 48 8b ac 24 80 00 00 00 48 83 c4 50 41 5e 5f 5e c3 cc cc cc cc 48 89 5c 24 10 48 89 6c 24 18 48 89 4c 24 08 Data Ascii: I@fEPH;uH\$Hl$HL$VWAVHPIMHH3\$@Kp;HD$HHtD$L$8$L$0$L$(H$HL$ LMHH]HHD$@HK=H$HKC(HHpHH\$xH$HPA^_^H\$Hl$HL$
2024-03-26 18:38:20 UTC	16384	IN	Data Raw: 00 48 89 5c 24 60 48 8b 94 24 18 02 00 00 48 83 fa 08 72 3a 48 8d 14 55 02 00 00 00 48 8b 8c 24 00 02 00 00 48 8b c1 48 81 fa 00 10 00 00 72 19 48 83 c2 27 48 8b 49 f8 48 2b c1 48 83 c0 f8 48 83 f8 1f 0f 87 cc 06 00 00 e8 7a ca 02 00 48 89 9c 24 10 02 00 00 48 c7 84 24 18 02 00 00 07 00 00 00 66 89 9c 24 00 02 00 00 48 8d 8c 24 a0 00 00 00 e8 b9 d5 ff ff 90 48 8b 7c 24 38 48 85 ff 0f 84 bd fe ff ff 48 8b 74 24 40 48 3b fe 0f 84 68 fe ff ff 48 8b 57 18 48 83 fa 08 72 35 48 8b 0f 48 8d 14 55 02 00 00 00 48 81 fa 00 10 00 00 72 1c 48 83 c2 27 4c 8b 41 f8 49 2b c8 48 8d 41 f8 48 83 f8 1f 0f 87 50 06 00 00 49 8b c8 e8 f5 c9 02 00 48 89 5f 10 48 c7 47 18 07 00 00 00 66 89 1f 48 83 c7 20 48 3b fe 75 a9 e9 07 fe ff ff 48 8d 84 24 00 02 00 00 48 89 84 24 c0 01 00 Data Ascii: H\$`H$Hr:HUH$HHrH'HIH+HHzH$H$f$H$H\|$8HHt$@H;hHWHr5HHUHrH'LAI+HAHPIH_HGfH H;uH$H$
2024-03-26 18:38:20 UTC	16384	IN	Data Raw: 00 48 8b 4f 10 ff c6 4a 89 44 01 08 3b b3 c4 00 00 00 0f 82 78 ff ff ff 48 8b 83 98 00 00 00 48 89 07 48 8b 8b 98 00 00 00 48 89 4f 28 48 8b 57 10 48 8b 02 48 3b c8 48 89 47 30 0f 95 c0 88 47 38 48 8b 4a 08 48 89 4f 40 48 8b 83 a0 00 00 00 48 3b c8 48 89 47 48 0f 95 c0 88 47 50 48 8b 83 a0 00 00 00 48 89 47 58 48 8b 83 a0 00 00 00 48 89 47 60 b0 01 48 8b 5c 24 30 48 8b 6c 24 38 48 8b 74 24 48 48 83 c4 20 5f c3 cc cc cc cc cc cc 40 53 56 41 55 41 56 48 83 ec 28 4c 8b 71 10 48 bb ff ff ff ff ff ff ff 7f 48 8b c3 4d 8b e9 49 2b c6 48 8b f1 48 3b c2 0f 82 57 01 00 00 48 89 6c 24 50 48 8b 69 18 48 89 7c 24 58 4c 89 64 24 60 4c 89 7c 24 20 4d 8d 3c 16 49 8b d7 48 83 ca 0f 48 3b d3 77 3a 48 8b cd 48 8b c3 48 d1 e9 48 2b c1 48 3b e8 77 29 48 8d 04 29 48 8b da 48 Data Ascii: HOJD;xHHHHO(HWHH;HG0G8HJHO@HH;HGHGPHHGXHHG`H\$0Hl$8Ht$HH _@SVAUAVH(LqHHMI+HH;WHl$PHiH\|$XLd$`L\|$ M<IHH;w:HHHH+H;w)H)HH
2024-03-26 18:38:20 UTC	16384	IN	Data Raw: 89 42 18 48 8b 4b 08 49 8b c0 4c 89 41 10 4c 89 43 08 48 8b 5c 24 38 48 83 c4 20 5f c3 cc cc cc 48 3b ca 0f 84 d6 00 00 00 48 89 6c 24 18 48 89 74 24 20 57 48 83 ec 20 48 89 5c 24 30 49 8b f8 4c 89 74 24 38 48 8b ea 45 33 f6 48 8b f1 66 90 48 85 f6 0f 84 8d 00 00 00 8b 56 08 83 ea 0a 74 6a 83 ea 01 74 65 83 ea 05 74 32 83 ea 02 74 19 83 fa 01 75 64 48 3b 7e 20 75 5e 83 7f 34 ff 75 03 89 57 34 49 8b fe eb 50 48 85 ff 74 0a 44 89 77 34 44 89 76 34 eb 41 48 8b fe eb 3c 48 85 ff 74 04 44 89 77 34 48 8b 5e 28 48 85 db 74 2a 90 48 8b 53 20 4c 8b c7 48 8b 4b 10 e8 60 ff ff ff 48 8b 5b 28 48 85 db 75 e7 eb 0e 48 8b 4e 20 45 33 c0 33 d2 e8 47 ff ff ff 48 8b 76 10 48 3b f5 0f 85 6a ff ff ff 48 8b 5c 24 30 4c 8b 74 24 38 48 8b 6c 24 40 48 8b 74 24 48 48 83 c4 20 5f Data Ascii: BHKILALCH\$8H _H;Hl$Ht$ WH H\$0ILt$8HE3HfHVtjtet2tudH;~ u^4uW4IPHtDw4Dv4AH<HtDw4H^(Ht*HS LHK`H[(HuHN E33GHvH;jH\$0Lt$8Hl$@Ht$HH _
2024-03-26 18:38:20 UTC	16384	IN	Data Raw: c9 00 00 00 4c 89 44 24 20 48 89 54 24 28 4d 85 db 79 1f 49 8b c3 48 f7 d8 74 17 49 8b c3 48 f7 d0 48 c1 e8 05 48 8d 04 85 04 00 00 00 4c 2b d0 eb 0b 49 8b c3 48 c1 e8 05 4d 8d 14 82 41 83 e3 1f 0f 10 44 24 20 0f 29 44 24 20 4c 8b 44 24 28 48 8b 54 24 20 4d 3b ca 75 05 49 3b cb 74 3f b8 01 00 00 00 d3 e0 41 85 01 8b 02 74 06 44 0f ab c0 eb 04 44 0f b3 c0 89 02 49 83 f8 1f 73 05 49 ff c0 eb 07 45 33 c0 48 83 c2 04 48 83 f9 1f 73 05 48 ff c1 eb bf 33 c9 49 83 c1 04 eb b7 48 2b 17 48 c1 fa 02 48 c1 e2 05 49 03 d0 48 8b cf e8 ac f5 ff ff eb 17 41 0f 10 01 0f 29 44 24 20 49 8b da 49 2b da 48 c1 fb 02 48 c1 e3 05 48 8b 07 48 89 44 24 20 48 c7 44 24 28 00 00 00 00 4c 8b c3 48 8b d6 48 8d 4c 24 20 e8 32 a4 ff ff 48 8b c6 48 8b 5c 24 40 48 8b 74 24 48 48 83 c4 30 Data Ascii: LD$ HT$(MyIHtIHHHL+IHMAD$ )D$ LD$(HT$ M;uI;t?AtDDIsIE3HHsH3IH+HHIHA)D$ II+HHHHD$ HD$(LHHL$ 2HH\$@Ht$HH0
2024-03-26 18:38:20 UTC	16384	IN	Data Raw: 48 89 4a 10 49 8b 08 80 79 19 00 75 04 48 89 51 08 48 8b 4a 08 49 89 48 08 49 8b 0a 48 3b 51 08 75 06 4c 89 41 08 eb 12 48 8b 4a 08 48 3b 11 75 05 4c 89 01 eb 04 4c 89 41 10 49 89 10 4c 89 42 08 48 8b 48 08 80 79 18 00 0f 84 11 fe ff ff 49 8b 43 08 c6 40 18 01 49 8b c1 c3 cc cc cc cc cc 48 8d 05 59 63 05 00 c3 cc cc cc cc cc cc cc cc 48 83 ec 28 48 8d 0d 0d a1 03 00 e8 04 e3 01 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 28 48 8d 0d 85 a1 03 00 e8 08 e3 01 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 40 57 48 83 ec 30 48 8b 7a 08 4d 8b c8 4c 8b 51 08 49 3b fa 0f 87 c3 00 00 00 4d 8b c2 4c 2b c7 4d 3b c8 0f 87 b4 00 00 00 48 85 ff 75 09 49 8b c1 48 83 c4 30 5f c3 48 89 5c 24 40 48 89 6c 24 48 48 89 74 24 50 48 8b 32 4c 89 74 24 28 4c Data Ascii: HJIyuHQHJIHIH;QuLAHJH;uLLAILBHHyIC@IHYcH(HH(H@WH0HzMLQI;ML+M;HuIH0_H\$@Hl$HHt$PH2Lt$(L
2024-03-26 18:38:21 UTC	16384	IN	Data Raw: 33 c9 e8 31 cb ff ff 83 cf ff eb 4c 4d 85 c0 74 cd 48 8d 45 5f 48 89 55 ff 48 89 45 0f 4c 8d 4d ff 48 8d 45 bf 48 89 55 07 48 89 45 17 4c 8d 45 0f 48 8d 45 67 48 89 45 1f 48 8d 55 07 48 8d 45 6f 48 89 45 27 48 8d 4d 7f 48 8d 45 77 48 89 45 2f e8 4a cc ff ff 8b f8 80 7d e7 02 75 0b 48 8b 4d bf 83 a1 a8 03 00 00 fd 80 7d ef 00 74 0f 8b 5d eb 48 8d 4d bf e8 9d c7 ff ff 89 58 20 80 7d f7 00 74 0f 8b 5d f3 48 8d 4d bf e8 88 c7 ff ff 89 58 24 8b c7 48 81 c4 b0 00 00 00 5f 5b 5d c3 40 55 53 56 57 41 54 41 56 41 57 48 8d ac 24 f0 fb ff ff 48 81 ec 10 05 00 00 48 8b 05 a7 1d 05 00 48 33 c4 48 89 85 00 04 00 00 48 8b 85 70 04 00 00 45 33 e4 4c 89 64 24 50 49 8b d8 44 88 64 24 60 48 8b f2 44 88 64 24 78 4c 8b f9 44 88 65 80 44 88 65 88 48 85 c0 74 05 0f 10 00 eb 10 Data Ascii: 31LMtHE_HUHELMHEHUHELEHEgHEHUHEoHE'HMHEwHE/J}uHM}t]HMX }t]HMX$H_[]@USVWATAVAWH$HHH3HHpE3Ld$PIDd$`HDd$xLDeDeHt
2024-03-26 18:38:21 UTC	16384	IN	Data Raw: 4d 85 c0 74 10 48 85 c9 0f 84 24 01 00 00 89 19 e9 1d 01 00 00 48 85 f6 74 03 83 09 ff 48 8b bc 24 80 00 00 00 48 81 fd ff ff ff 7f 76 0a be 16 00 00 00 e9 29 01 00 00 38 5f 28 75 0e 48 8b cf e8 3b bd ff ff 44 0f b7 4c 24 78 48 8b 47 18 8b 48 0c 81 f9 e9 fd 00 00 75 35 41 0f b7 d1 4c 8d 44 24 68 4c 8b cf 48 89 5c 24 68 49 8b ce e8 f5 88 00 00 48 85 f6 74 02 89 06 83 f8 04 0f 8e af 00 00 00 38 5f 30 74 03 8b 5f 2c 8b c3 eb 37 48 39 98 38 01 00 00 75 5b b8 ff 00 00 00 66 44 3b c8 76 36 4d 85 f6 74 12 48 85 ed 74 0d 4c 8b c5 33 d2 49 8b ce e8 b6 09 01 00 b8 2a 00 00 00 89 47 2c c6 47 30 01 48 8b 5c 24 60 48 8b 6c 24 70 48 83 c4 40 41 5e 5f 5e c3 4d 85 f6 74 08 48 85 ed 74 79 45 88 0e 48 85 f6 74 47 c7 06 01 00 00 00 eb 3f 48 8d 44 24 68 89 5c 24 68 48 89 44 Data Ascii: MtH$HtH$Hv)8_(uH;DL$xHGHu5ALD$hLH\$hIHt8_0t_,7H98u[fD;v6MtHtL3I*G,G0H\$`Hl$pH@A^_^MtHtyEHtG?HD$h\$hHD
2024-03-26 18:38:21 UTC	16384	IN	Data Raw: 00 eb 08 4c 89 49 08 48 83 c1 10 48 3b ca 75 f3 81 38 8d 00 00 c0 8b 7b 10 74 7a 81 38 8e 00 00 c0 74 6b 81 38 8f 00 00 c0 74 5c 81 38 90 00 00 c0 74 4d 81 38 91 00 00 c0 74 3e 81 38 92 00 00 c0 74 2f 81 38 93 00 00 c0 74 20 81 38 b4 02 00 c0 74 11 81 38 b5 02 00 c0 8b d7 75 40 ba 8d 00 00 00 eb 36 ba 8e 00 00 00 eb 2f ba 85 00 00 00 eb 28 ba 8a 00 00 00 eb 21 ba 84 00 00 00 eb 1a ba 81 00 00 00 eb 13 ba 86 00 00 00 eb 0c ba 83 00 00 00 eb 05 ba 82 00 00 00 89 53 10 49 ba 70 33 d3 30 4f 1f 9c 8b b9 08 00 00 00 49 8b c0 ff 15 4b c8 02 00 89 7b 10 eb 1a 4c 89 48 08 49 ba 70 73 d7 50 49 86 c1 c6 8b 48 04 49 8b c0 ff 15 2c c8 02 00 48 89 6b 08 e9 02 ff ff ff cc cc cc 48 83 ec 28 e8 3b 90 ff ff 48 8d 54 24 30 48 8b 88 90 00 00 00 48 89 4c 24 30 48 8b c8 e8 e6 Data Ascii: LIHH;u8{tz8tk8t\8tM8t>8t/8t 8t8u@6/(!SIp30OIK{LHIpsPIHI,HkH(;HT$0HHL$0H

Target ID:	0
Start time:	16:38:14
Start date:	26/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff730e10000
File size:	2'509'656 bytes
MD5 hash:	464953824E644F10FFDC9E093FD18F94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	16:38:14
Start date:	26/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1996 /prefetch:8
Imagebase:	0x7ff730e10000
File size:	2'509'656 bytes
MD5 hash:	464953824E644F10FFDC9E093FD18F94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	16:38:17
Start date:	26/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://download01.logi.com/web/ftp/pub/techsupport/optionsplus/logioptionsplus_installer.exe"
Imagebase:	0x7ff730e10000
File size:	2'509'656 bytes
MD5 hash:	464953824E644F10FFDC9E093FD18F94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:38:18
Start date:	26/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2972 /prefetch:8
Imagebase:	0x7ff730e10000
File size:	2'509'656 bytes
MD5 hash:	464953824E644F10FFDC9E093FD18F94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:38:18
Start date:	26/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6164 /prefetch:8
Imagebase:	0x7ff730e10000
File size:	2'509'656 bytes
MD5 hash:	464953824E644F10FFDC9E093FD18F94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:38:22
Start date:	26/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3352 /prefetch:8
Imagebase:	0x7ff730e10000
File size:	2'509'656 bytes
MD5 hash:	464953824E644F10FFDC9E093FD18F94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:38:22
Start date:	26/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,3226854870238447149,17782080952752134390,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5480 /prefetch:8
Imagebase:	0x7ff730e10000
File size:	2'509'656 bytes
MD5 hash:	464953824E644F10FFDC9E093FD18F94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:39:34
Start date:	26/03/2024
Path:	C:\Users\user\Downloads\logioptionsplus_installer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Downloads\logioptionsplus_installer.exe"
Imagebase:	0x7ff61b1b0000
File size:	30'454'528 bytes
MD5 hash:	43D5805571B019C67F965C749AD18AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	16:39:36
Start date:	26/03/2024
Path:	C:\Users\user\AppData\Local\Temp\logioptionsplus_setup.exe
Wow64 process (32bit):	false
Commandline:	--install-event=897bbe07-5e15-4275-a4f7-6d424b298ef0.optionsplus_install_finish_event
Imagebase:	0x1f5ec370000
File size:	29'747'968 bytes
MD5 hash:	AE8C1F75DCE5968EB9634E5A1E2C9E56
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	16:39:39
Start date:	26/03/2024
Path:	C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe" /install /quiet /norestart
Imagebase:	0x520000
File size:	15'060'496 bytes
MD5 hash:	BE433764FA9BBE0F2F9C654F6512C9E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:39:39
Start date:	26/03/2024
Path:	C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\{716D2A00-ED5F-4B2E-85FD-2F355FA256A9}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe" -burn.filehandle.attached=532 -burn.filehandle.self=528 /install /quiet /norestart
Imagebase:	0xf30000
File size:	647'904 bytes
MD5 hash:	94970FC3A8ED7B9DE44F4117419CE829
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:39:39
Start date:	26/03/2024
Path:	C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\{209FFBAC-C06D-4197-A955-92B5A16AC523}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A922CA2A-29A1-4011-A158-7648632856CA} {2230389D-DB71-45B4-9086-D875DD617B8B} 3740
Imagebase:	0xa20000
File size:	647'904 bytes
MD5 hash:	94970FC3A8ED7B9DE44F4117419CE829
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:39:40
Start date:	26/03/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff70e230000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Function 00007FF61B1E6960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF61B1E698C
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF61B1E699A
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF61B1E69A6
QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0 ref: 00007FF61B1E69B6

Memory Dump Source

Source File: 0000000B.00000002.50394874380.00007FF61B1B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF61B1B0000, based on PE: true

Associated: 0000000B.00000002.50394815228.00007FF61B1B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.50395032093.00007FF61B201000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.50395118012.00007FF61B21E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.50395184466.00007FF61B21F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.50395253435.00007FF61B220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.50395310647.00007FF61B222000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.50395364097.00007FF61B228000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.50395364097.00007FF61BC28000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.50395364097.00007FF61C628000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.50395364097.00007FF61CC33000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.50395364097.00007FF61CD93000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.50395364097.00007FF61CDA2000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff61b1b0000_logioptionsplus_installer.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 2a04e88297396b997b6eeab5648a1bf30cee7e63ed4354a0780f5980656fa62e
Instruction ID: 1a64e0e9afabc417dd4b4df2c1a65c7b83dfe307108f56c4f0504a9a3e164250
Opcode Fuzzy Hash: 2a04e88297396b997b6eeab5648a1bf30cee7e63ed4354a0780f5980656fa62e
Instruction Fuzzy Hash: CE115E22B14F0289EB00DF61E8542B833B4FB1DB68F441E31EA2D86BA4DF78D198C340

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: logioptionsplus_setup.exePID: 1716, Parent PID: 3364COMMON

Execution Graph

Execution Coverage:	14.6%
Dynamic/Decrypted Code Coverage:	60%
Signature Coverage:	0%
Total number of Nodes:	15
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFCB3544AF5 Relevance: 1.6, APIs: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32 ref: 00007FFCB3544BCB

Memory Dump Source

Source File: 0000000C.00000002.50426492257.00007FFCB3540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCB3540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffcb3540000_logioptionsplus_setup.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 23ce8c463026e32d52e82ae93bad1c9b7bace8bf5e2fcfeaa8f02e64a4b2d0ba
Instruction ID: 49fbc03b426b488c1f29f3bb5f6969bfe89bde974b2b558d8872e9fc54d81403
Opcode Fuzzy Hash: 23ce8c463026e32d52e82ae93bad1c9b7bace8bf5e2fcfeaa8f02e64a4b2d0ba
Instruction Fuzzy Hash: 2041AB7190CB1C8FDB58DF68D8957E9BBE0EB65321F0042ABD049D7256CB71A849CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCB35409C9 Relevance: 1.6, APIs: 1, Instructions: 110
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 00007FFCB3540A67

Memory Dump Source

Source File: 0000000C.00000002.50426492257.00007FFCB3540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCB3540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffcb3540000_logioptionsplus_setup.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2c542ceb2eee27f1241058424d97e2d8589da9910c2c0ea02b489ad1955a02d6
Instruction ID: f40fb4de3d435544d14041cfe8070542bcdaf8eae921b4d4a85f08bf6ee53d51
Opcode Fuzzy Hash: 2c542ceb2eee27f1241058424d97e2d8589da9910c2c0ea02b489ad1955a02d6
Instruction Fuzzy Hash: C931A23190CA5C8FDB58DB5CC845AE9BBE0EF55321F04826FD009D3552DB75A805CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCB35404BA Relevance: 1.6, APIs: 1, Instructions: 102
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 00007FFCB3540A67

Memory Dump Source

Source File: 0000000C.00000002.50426492257.00007FFCB3540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCB3540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffcb3540000_logioptionsplus_setup.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c5448b3de425161837057948da1f2f61a9cee89292a2de3e4f00ca07efa04775
Instruction ID: e2441124429bead40fd5a24ad57512340f083441dc4d279291ac9c9a4cc09196
Opcode Fuzzy Hash: c5448b3de425161837057948da1f2f61a9cee89292a2de3e4f00ca07efa04775
Instruction Fuzzy Hash: 1D218F7190CA1C9FDB58DB9CC449AF9BBE0FB59321F10822ED00AD3651DB70A846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCB342E2D2 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.50425959377.00007FFCB342D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCB342D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffcb342d000_logioptionsplus_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ed9bf8e4829918d49b269cc94a0b528ed5eab3e053a4c3ec5cb8936e3466c7b
Instruction ID: 4f86d5e83be7ab1467c31d913e89101f0293c350782bbb4b173878015f4bd1b7
Opcode Fuzzy Hash: 3ed9bf8e4829918d49b269cc94a0b528ed5eab3e053a4c3ec5cb8936e3466c7b
Instruction Fuzzy Hash: D041263180DBC84FE7568B2C9C559623FB0EF57321B0501EFD188DB1A3D625E84ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFCDB80FB30 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFCDB80FB5C
GetCurrentThreadId.KERNEL32 ref: 00007FFCDB80FB6A
GetCurrentProcessId.KERNEL32 ref: 00007FFCDB80FB76
QueryPerformanceCounter.KERNEL32 ref: 00007FFCDB80FB86

Memory Dump Source

Source File: 0000000C.00000002.50426803998.00007FFCDB341000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFCDB340000, based on PE: true

Associated: 0000000C.00000002.50426768811.00007FFCDB340000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000C.00000002.50435261926.00007FFCDB986000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000C.00000002.50435261926.00007FFCDB9B5000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000C.00000002.50437523577.00007FFCDBB12000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000C.00000002.50437615180.00007FFCDBB1D000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000C.00000002.50437672429.00007FFCDBB21000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000C.00000002.50437736357.00007FFCDBB26000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000C.00000002.50437767031.00007FFCDBB27000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000C.00000002.50437823644.00007FFCDBB2B000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000C.00000002.50437921370.00007FFCDBB36000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000C.00000002.50437955753.00007FFCDBB37000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000C.00000002.50438107752.00007FFCDBB4D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000C.00000002.50438147822.00007FFCDBB54000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000C.00000002.50438147822.00007FFCDBB56000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000C.00000002.50438228937.00007FFCDBB58000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000C.00000002.50438706884.00007FFCDBBA7000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffcdb340000_logioptionsplus_setup.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: a05c5e081f22e6f106a02bfd4ac51985d00b678111cc167880abfd50fda618fe
Instruction ID: f6dbf19c95b0a1c0f2c4d24c455809f92ddd859c4ca2b769f08c07cf21e6e030
Opcode Fuzzy Hash: a05c5e081f22e6f106a02bfd4ac51985d00b678111cc167880abfd50fda618fe
Instruction Fuzzy Hash: 09112E26B15F558AEB00CF60E8552BD33B4FB19758F840E32DA6D86BA4DF78D194C350

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vc_redist.x64.exePID: 6744, Parent PID: 1716COMMON

Executed Functions

Function 00523BC3 Relevance: 47.6, APIs: 23, Strings: 4, Instructions: 311
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 00523C3F
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00523C52
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000001,00000000,?), ref: 00523C9D
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00523CA7
GetTempPathW.KERNEL32(00000104,?,?,?,?,00000001,00000000,?), ref: 00523CF5
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00523CFF
FindFirstFileW.KERNELBASE(?,?,?,*.*,?,?,?,?,00000001,00000000,?), ref: 00523D52
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00523D63
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00000001,00000000,?), ref: 00523E3D
DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,00000001,00000000,?), ref: 00523E51
GetTempFileNameW.KERNEL32(?,DEL,00000000,?,?,?,?,00000001,00000000,?), ref: 00523E78
MoveFileExW.KERNEL32(?,?,00000001,?,?,?,00000001,00000000,?), ref: 00523E9B
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 00523EB4
FindNextFileW.KERNELBASE(000000FF,?,?,?,?,?,?,?,00000001,00000000,?), ref: 00523EC4
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00523ED9
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00523F08
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00523F2A
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00523F4C
RemoveDirectoryW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 00523F63
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00523F6D
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 00523F93
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00523FAE
FindClose.KERNEL32(000000FF,?,?,?,00000001,00000000,?), ref: 00523FE4

Strings

DEL, xrefs: 00523E6C
dirutil.cpp, xrefs: 00523C75, 00523EF9
43u, xrefs: 00523CF5
*.*, xrefs: 00523D2B

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFileLast$AttributesFindMove$Temp$CloseDeleteDirectoryFirstNameNextPathRemove
String ID: 43u$*.*$DEL$dirutil.cpp
API String ID: 1544372074-664229191
Opcode ID: f5084deb31b86f9510a4903a43a94b3f118c4a613b63e630e84ccf71f6d4b2f0
Instruction ID: aea29ce0e2b7d30df2cc2e2eaa6f551877a3b13af8474156c8ba84036d50ea5d
Opcode Fuzzy Hash: f5084deb31b86f9510a4903a43a94b3f118c4a613b63e630e84ccf71f6d4b2f0
Instruction Fuzzy Hash: 2BB10C72E00239AAEB305B799D44BA67AF9BF55710F0102A5ED08F71D0D7798E84DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0052508D Relevance: 44.1, APIs: 5, Strings: 20, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 0052510F

Part of subcall function 005603F0: InitializeCriticalSection.KERNEL32(0058B60C,?,0052511B,00000000,?,?,?,?,?,?), ref: 00560407

Part of subcall function 00521209: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,00525137,00000000,?), ref: 00521247
Part of subcall function 00521209: GetLastError.KERNEL32(?,?,?,00525137,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00521251

CoInitializeEx.OLE32(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 0052517D

Part of subcall function 00560CD1: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00560CF2

GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 0052520F
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00525219
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0052549B

Strings

Failed to get OS info., xrefs: 00525247
Failed to initialize COM., xrefs: 00525189
Setup, xrefs: 005253FC
Failed to initialize engine state., xrefs: 00525164
Failed to initialize Regutil., xrefs: 005251C1
Failed to run untrusted mode., xrefs: 005253AE
Failed to run per-user mode., xrefs: 0052538C
Failed to initialize core., xrefs: 005252BB
Failed to run embedded mode., xrefs: 0052533C
Failed to initialize Wiutil., xrefs: 005251D9
Failed to parse command line., xrefs: 0052513D
Failed to initialize Cryputil., xrefs: 0052519E
_Failed, xrefs: 005253F7
engine.cpp, xrefs: 0052523D
Failed to run per-machine mode., xrefs: 00525364
Invalid run mode., xrefs: 005252F1
Failed to initialize XML util., xrefs: 005251F1
Failed to run RunOnce mode., xrefs: 00525314
3.10.4.4718, xrefs: 0052527C
txt, xrefs: 005253F2

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.10.4.4718$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$Setup$_Failed$engine.cpp$txt
API String ID: 3262001429-867073019
Opcode ID: c332f262500b5dc8a25cfbafff86016d172c9b092947e1e0a9c909d2067e641b
Instruction ID: bc167871e3ccfd8a852fabb842fdaff47206f1df1315a3a00a9ff8d11aad6177
Opcode Fuzzy Hash: c332f262500b5dc8a25cfbafff86016d172c9b092947e1e0a9c909d2067e641b
Instruction Fuzzy Hash: ADB1A571D40A399BEB32AE64DC4ABEE7EA4BF55311F040095F905A72C1EB709E90DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00562F23 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 152libraryloadercomCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,005634DF,00000000,?,00000000), ref: 00562F3D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0054BDED,?,005252FD,?,00000000,?), ref: 00562F49
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00562F89
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00562F95
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 00562FA0
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00562FAA
CoCreateInstance.OLE32(0058B6C8,00000000,00000001,0056B808,?,?,?,?,?,?,?,?,?,?,?,0054BDED), ref: 00562FE5
ExitProcess.KERNEL32 ref: 00563094

Strings

xmlutil.cpp, xrefs: 00562F6D
IsWow64Process, xrefs: 00562F83
Wow64RevertWow64FsRedirection, xrefs: 00562FA2
Wow64EnableWow64FsRedirection, xrefs: 00562F97
kernel32.dll, xrefs: 00562F2D
Wow64DisableWow64FsRedirection, xrefs: 00562F8F

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$xmlutil.cpp
API String ID: 2124981135-499589564
Opcode ID: 301b4737835fc335ced9380e6a96d2d018454902328ebbe7325e61f0a5ae3b30
Instruction ID: 4b569d31ea97819f0fe87aba20ede583b327fd38ab17e2254eed4608b679f281
Opcode Fuzzy Hash: 301b4737835fc335ced9380e6a96d2d018454902328ebbe7325e61f0a5ae3b30
Instruction Fuzzy Hash: 9341B035A00215ABEB20DFA9C859B6EBFE8FF44720F114069E905EB291DB71DE449B90

Uniqueness

Uniqueness Score: -1.00%

Function 00521070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005233D7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,005210DD,?,00000000), ref: 005233F8

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 005210F6

Part of subcall function 00521174: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,0052111A,cabinet.dll,00000009,?,?,00000000), ref: 00521185
Part of subcall function 00521174: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,0052111A,cabinet.dll,00000009,?,?,00000000), ref: 00521190
Part of subcall function 00521174: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0052119E
Part of subcall function 00521174: GetLastError.KERNEL32(?,?,?,?,0052111A,cabinet.dll,00000009,?,?,00000000), ref: 005211B9
Part of subcall function 00521174: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 005211C1
Part of subcall function 00521174: GetLastError.KERNEL32(?,?,?,?,0052111A,cabinet.dll,00000009,?,?,00000000), ref: 005211D6

FindCloseChangeNotification.KERNELBASE(?,?,?,?,0056B4C0,?,cabinet.dll,00000009,?,?,00000000), ref: 00521131

Strings

comres.dll, xrefs: 005210B5
clbcatq.dll, xrefs: 005210BC
feclient.dll, xrefs: 005210D1
version.dll, xrefs: 005210A7
crypt32.dll, xrefs: 005210CA
msasn1.dll, xrefs: 005210C3
wininet.dll, xrefs: 005210AE
cabinet.dll, xrefs: 00521099
msi.dll, xrefs: 005210A0

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AddressErrorFileLastModuleProc$ChangeCloseCreateFindHandleHeapInformationNameNotification
String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 2670336470-3151496603
Opcode ID: 8dcceb6c2bda23ab603bc27603a93d9ca9cf3c55a4af2142cefe0502206ea671
Instruction ID: 30b95a3e51a4276f160f5e5a6d6c64a474a3742a9f6f3b95b44a2defb57c339d
Opcode Fuzzy Hash: 8dcceb6c2bda23ab603bc27603a93d9ca9cf3c55a4af2142cefe0502206ea671
Instruction Fuzzy Hash: 62217E71900219AAEB109FA9DC09AEFBFF9BF55325F104119E910F72C1EB708958CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00539EB7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 51COMMON

Download Yara Rule

Strings

Failed to calculate working folder to ensure it exists., xrefs: 00539ED4
Failed to copy working folder., xrefs: 00539F12
Failed create working folder., xrefs: 00539EEA
=SR, xrefs: 00539EB7

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CurrentDirectoryErrorLastProcessWindows
String ID: =SR$Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
API String ID: 3841436932-2768834200
Opcode ID: a3f248f8a18f9c4155ecb14d854a95a24ad2d58f567c434704fec317a1a95a8f
Instruction ID: d1e5d396452030dd4cb56e706d0b74a99f6d855d353af70cffb4babd9933d628
Opcode Fuzzy Hash: a3f248f8a18f9c4155ecb14d854a95a24ad2d58f567c434704fec317a1a95a8f
Instruction Fuzzy Hash: 6D017172D45629BA8F239A55DC0ACAFBF68FF81720F104155F804A6212DBB18E50FA90

Uniqueness

Uniqueness Score: -1.00%

Function 00554812 Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,005547E8,00000000,00587CF8,0000000C,0055493F,00000000,00000002,00000000), ref: 00554833
TerminateProcess.KERNEL32(00000000,?,005547E8,00000000,00587CF8,0000000C,0055493F,00000000,00000002,00000000), ref: 0055483A
ExitProcess.KERNEL32 ref: 0055484C

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 9f9a6a97afb04c11dce23f1a93f161f98872400af231619e45a541b599e55e79
Instruction ID: ff4604b81b6600beb203344e5da133c4cc5bd204f4a2e8c7098bd5b299df0fea
Opcode Fuzzy Hash: 9f9a6a97afb04c11dce23f1a93f161f98872400af231619e45a541b599e55e79
Instruction Fuzzy Hash: 73E0B631400688ABDF116F59DD2DA5A3F69FB5135AF050025FC059B132CB75EDCAEB84

Uniqueness

Uniqueness Score: -1.00%

Function 005238D4 Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238E5
RtlAllocateHeap.NTDLL(00000000,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238EC

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 3c7d339b8c2528b4221dc6fd056236fc32a1891f7db1b815e73309f6c8722bbd
Instruction ID: 08d2835bf43f468af75007ef83cfeb72ed20a344b705352c222412938c7980de
Opcode Fuzzy Hash: 3c7d339b8c2528b4221dc6fd056236fc32a1891f7db1b815e73309f6c8722bbd
Instruction Fuzzy Hash: 4AC01273190208B78B005FF8DC0DC59379CA725602B008500F505C3110C77CE158D760

Uniqueness

Uniqueness Score: -1.00%

Function 0052F86E Relevance: 117.7, APIs: 3, Strings: 64, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to get @Contact., xrefs: 0052FB72
registration.cpp, xrefs: 0052FC11
DisableModify, xrefs: 0052FB80
Update, xrefs: 0052FCA8
Publisher, xrefs: 0052FA52
Failed to get @DisableModify., xrefs: 0052FC42
Failed to get @Department., xrefs: 0052FD18
Failed to set registration paths., xrefs: 0052FD92
Registration, xrefs: 0052F888
Failed to parse related bundles, xrefs: 0052F90D
Failed to get @Register., xrefs: 0052F9FA
ParentDisplayName, xrefs: 0052FB0B
Failed to get @DisplayName., xrefs: 0052FA1F
Failed to get @Name., xrefs: 0052FD5E
Failed to get @HelpTelephone., xrefs: 0052FAB3
Failed to get @Manufacturer., xrefs: 0052FCF0
Failed to select registration node., xrefs: 0052F8A6
Failed to get @Version., xrefs: 0052F92E
Failed to get @AboutUrl., xrefs: 0052FAD8
yes, xrefs: 0052FBC0
Failed to get @Comments., xrefs: 0052FB4A
ExecutableName, xrefs: 0052F97E
Failed to get @UpdateUrl., xrefs: 0052FAFD
ProviderKey, xrefs: 0052F95D
Failed to parse software tag., xrefs: 0052FC9A
Invalid modify disabled type: %ls, xrefs: 0052FC1E
Failed to get @Id., xrefs: 0052F8D3
Manufacturer, xrefs: 0052FCDD
UpdateUrl, xrefs: 0052FAE6
Failed to get @ProductFamily., xrefs: 0052FD3D
Failed to get @Publisher., xrefs: 0052FA69
Failed to parse @Version: %ls, xrefs: 0052F94F
DisableRemove, xrefs: 0052FC53
DisplayName, xrefs: 0052FA08
HelpLink, xrefs: 0052FA77
Failed to get @HelpLink., xrefs: 0052FA8E
AboutUrl, xrefs: 0052FAC1
Version, xrefs: 0052F91B
Failed to get @DisableRemove., xrefs: 0052FC6A
msasn1.dll, xrefs: 0052F8BF
Failed to get @Classification., xrefs: 0052FD7F
ProductFamily, xrefs: 0052FD26
Arp, xrefs: 0052F9BD
Failed to get @PerMachine., xrefs: 0052F9AF
Department, xrefs: 0052FD01
Comments, xrefs: 0052FB33
Failed to select Update node., xrefs: 0052FCC6
Failed to get @Tag., xrefs: 0052F8F4
clbcatq.dll, xrefs: 0052F8E0
Failed to get @ParentDisplayName., xrefs: 0052FB22
=SR, xrefs: 0052F86E
Contact, xrefs: 0052FB5B
Failed to get @ProviderKey., xrefs: 0052F970
HelpTelephone, xrefs: 0052FA9C
Failed to select ARP node., xrefs: 0052F9D9
Tag, xrefs: 0052F8E1
button, xrefs: 0052FB9F
Failed to get @ExecutableName., xrefs: 0052F991
Register, xrefs: 0052F9E7
Classification, xrefs: 0052FD6C
Failed to get @DisplayVersion., xrefs: 0052FA44
Name, xrefs: 0052FD4B
PerMachine, xrefs: 0052F99C
DisplayVersion, xrefs: 0052FA2D

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID:
String ID: =SR$AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$clbcatq.dll$msasn1.dll$registration.cpp$yes
API String ID: 0-3993718304
Opcode ID: 0cdf114692c4d81aba613daa93699bface9f9aef1b1cdf615cc7c21a0eff1fd2
Instruction ID: a766c831a57b014220fffa37e16e43c8a0f30f32fc999a49a5ee83e95d0dcef4
Opcode Fuzzy Hash: 0cdf114692c4d81aba613daa93699bface9f9aef1b1cdf615cc7c21a0eff1fd2
Instruction Fuzzy Hash: A5E1B332E40A7ABBCB219AA4FC46EAD7E74BF02710F114A75FD15B72D0D7609D40A784

Uniqueness

Uniqueness Score: -1.00%

Function 0052B389 Relevance: 93.3, APIs: 24, Strings: 29, Instructions: 565
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000000,771AC310,00000000), ref: 0052B3FF
SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,771AC310,00000000), ref: 0052B44C
GetLastError.KERNEL32(?,?,?,00000000,771AC310,00000000), ref: 0052B452
ReadFile.KERNELBASE(00000000,\CRH,00000040,?,00000000,?,?,?,00000000,771AC310,00000000), ref: 0052B49A
GetLastError.KERNEL32(?,?,?,00000000,771AC310,00000000), ref: 0052B4A0
SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,771AC310,00000000), ref: 0052B4FD
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,771AC310,00000000), ref: 0052B503
ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,771AC310,00000000), ref: 0052B54C
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,771AC310,00000000), ref: 0052B552
SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,771AC310,00000000), ref: 0052B5C3
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,771AC310,00000000), ref: 0052B5C9

Strings

burn, xrefs: 0052B734
section.cpp, xrefs: 0052B420, 0052B473, 0052B4C1, 0052B524, 0052B573, 0052B5EA, 0052B639, 0052B688, 0052B6DD, 0052B794, 0052B7D4, 0052B826, 0052B88B, 0052B8B5, 0052B8DC, 0052B9C3, 0052BA03, 0052BA22, 0052BA5F, 0052BA9D, 0052BAC0, 0052BADB
Failed to read DOS header., xrefs: 0052B4CB
Failed to read complete section info., xrefs: 0052B8C1
(, xrefs: 0052B719
Failed to find valid NT image header in buffer., xrefs: 0052BACC
PE, xrefs: 0052B594
Failed to find valid DOS image header in buffer., xrefs: 0052BAE7
4, xrefs: 0052B780
Failed to seek past optional headers., xrefs: 0052B6E7
.wix, xrefs: 0052B72C
Failed to read signature offset., xrefs: 0052B643
Failed to seek to start of file., xrefs: 0052B47D
Failed to read NT header., xrefs: 0052B57D
Failed to read section info., xrefs: 0052B895
\CRH, xrefs: 0052B3A0, 0052B494, 0052B4E7, 0052B3AD, 0052B497
Failed to read complete image section header, index: %u, xrefs: 0052BA71
Failed to open handle to engine process path., xrefs: 0052B42A
Failed to find Burn section., xrefs: 0052BA2E
Failed to seek to section info., xrefs: 0052B5F4, 0052B830
Failed to read signature size., xrefs: 0052B692
Failed to read section info, unsupported version: %08x, xrefs: 0052B8F1
PE Header from file didn't match PE Header in memory., xrefs: 0052BA0D
Failed to read image section header, index: %u, xrefs: 0052BAA8
Failed to read section info, data to short: %u, xrefs: 0052B7A6
Failed to seek to NT header., xrefs: 0052B52E
Failed to get total size of bundle., xrefs: 0052B91F
Failed to allocate memory for container sizes., xrefs: 0052B9CF
Failed to allocate buffer for section info., xrefs: 0052B7E0

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast$File$Pointer$Read
String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$\CRH$burn$section.cpp
API String ID: 2600052162-3324376087
Opcode ID: 5f232fc5a7969fe462b6a3e04f05ccf7c08014a5cefae9126f8b51e995962645
Instruction ID: 77b1c684e57753e2f21699228cd916a372f5c545270729fe875ce05bfaa20bfa
Opcode Fuzzy Hash: 5f232fc5a7969fe462b6a3e04f05ccf7c08014a5cefae9126f8b51e995962645
Instruction Fuzzy Hash: D412A0B1A40235ABEB209B24DC86FA77EA9FF46710F004169F909EB1C1D7758E41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0052CCB6 Relevance: 86.1, APIs: 3, Strings: 46, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005238D4: GetProcessHeap.KERNEL32(?,000001C7,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238E5
Part of subcall function 005238D4: RtlAllocateHeap.NTDLL(00000000,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238EC

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,download,000000FF,00000000,Packaging,00000000,00000000,FilePath,comres.dll,00000000,0056CA64,?,00000000), ref: 0052CDEC

Strings

comres.dll, xrefs: 0052CDA3
download, xrefs: 0052CDDE
Failed to get @CertificateRootThumbprint., xrefs: 0052D0C0
external, xrefs: 0052CE1A
Failed to parse @FileSize., xrefs: 0052D09A
msasn1.dll, xrefs: 0052CF1D
Failed to find catalog., xrefs: 0052D0C7
Failed to select payload nodes., xrefs: 0052CCE4
wininet.dll, xrefs: 0052D007
CertificateRootPublicKeyIdentifier, xrefs: 0052CF36
Failed to get @Hash., xrefs: 0052D0DC
Container, xrefs: 0052CE44
Hash, xrefs: 0052CFB0
Payload, xrefs: 0052CCD1
Failed to get @Packaging., xrefs: 0052D10C
Invalid value for @Packaging: %ls, xrefs: 0052D0F9
embedded, xrefs: 0052CDFE
Failed to get @LayoutOnly., xrefs: 0052D090
Failed to get @FilePath., xrefs: 0052D113
Packaging, xrefs: 0052CDBF
Failed to to find container: %ls, xrefs: 0052D07F
Failed to get @FileSize., xrefs: 0052D0A4
Failed to get payload node count., xrefs: 0052CD09
msi.dll, xrefs: 0052CF58
Failed to get @Catalog., xrefs: 0052D0CE
Failed to hex decode @CertificateRootThumbprint., xrefs: 0052D0B9
CertificateRootThumbprint, xrefs: 0052CF73
feclient.dll, xrefs: 0052CE85
version.dll, xrefs: 0052CF5C
Failed to get @CertificateRootPublicKeyIdentifier., xrefs: 0052D0B2
Failed to hex decode @CertificateRootPublicKeyIdentifier., xrefs: 0052D0AB
Failed to allocate memory for payload structs., xrefs: 0052CD42
Failed to hex decode the Payload/@Hash., xrefs: 0052D0D5
Failed to get next node., xrefs: 0052D121
payload.cpp, xrefs: 0052CD38
Failed to get @Id., xrefs: 0052D11A
Catalog, xrefs: 0052CFE5
Failed to get @SourcePath., xrefs: 0052D0EA
FileSize, xrefs: 0052CEFB
SourcePath, xrefs: 0052CEA9
LayoutOnly, xrefs: 0052CE86
Failed to get @DownloadUrl., xrefs: 0052D0E3
cabinet.dll, xrefs: 0052CF99
FilePath, xrefs: 0052CDA4
DownloadUrl, xrefs: 0052CED2
Failed to get @Container., xrefs: 0052D086

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Heap$AllocateCompareProcessString
String ID: Catalog$CertificateRootPublicKeyIdentifier$CertificateRootThumbprint$Container$DownloadUrl$Failed to allocate memory for payload structs.$Failed to find catalog.$Failed to get @Catalog.$Failed to get @CertificateRootPublicKeyIdentifier.$Failed to get @CertificateRootThumbprint.$Failed to get @Container.$Failed to get @DownloadUrl.$Failed to get @FilePath.$Failed to get @FileSize.$Failed to get @Hash.$Failed to get @Id.$Failed to get @LayoutOnly.$Failed to get @Packaging.$Failed to get @SourcePath.$Failed to get next node.$Failed to get payload node count.$Failed to hex decode @CertificateRootPublicKeyIdentifier.$Failed to hex decode @CertificateRootThumbprint.$Failed to hex decode the Payload/@Hash.$Failed to parse @FileSize.$Failed to select payload nodes.$Failed to to find container: %ls$FilePath$FileSize$Hash$Invalid value for @Packaging: %ls$LayoutOnly$Packaging$Payload$SourcePath$cabinet.dll$comres.dll$download$embedded$external$feclient.dll$msasn1.dll$msi.dll$payload.cpp$version.dll$wininet.dll
API String ID: 1171520630-1949177747
Opcode ID: 794ccfbf7ca544531fbc6087da3a0116b67c884abd9af0b36ec854b3dab2d184
Instruction ID: c6977ba41784a6b22b5b7d6e41c5abba799cab8491a746699bde872976768e72
Opcode Fuzzy Hash: 794ccfbf7ca544531fbc6087da3a0116b67c884abd9af0b36ec854b3dab2d184
Instruction Fuzzy Hash: 9EC1F532D4563ABBCB219A90EC09EAEBF74BF06720F110265F900B75E0D775AE51D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00540A77 Relevance: 54.5, APIs: 20, Strings: 11, Instructions: 288
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,00000000,00000000,?,00540621,?,?), ref: 00540A85
GetLastError.KERNEL32(?,?,?,00000000,00000000,?,00540621,?,?), ref: 00540A92
WaitForSingleObject.KERNEL32(?,?,?,?,?,00000000,00000000,?,00540621,?,?), ref: 00540ACE
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,?,00540621,?,?), ref: 00540AD8

Strings

Failed to reset begin operation event., xrefs: 00540B4B
Failed to create file: %ls, xrefs: 00540D38
Failed to set file pointer to beginning of file., xrefs: 00540E20
cabextract.cpp, xrefs: 00540AB6, 00540AFC, 00540B41, 00540B6D, 00540CBE, 00540D2B, 00540D7D, 00540DC2, 00540E16
Failed to wait for begin operation event., xrefs: 00540B06
Failed to copy stream name: %ls, xrefs: 00540BB7
Invalid operation for this state., xrefs: 00540B79
Failed to set file pointer to end of file., xrefs: 00540D87
Failed to allocate buffer for stream., xrefs: 00540CC8
Failed to set operation complete event., xrefs: 00540AC0
Failed to set end of file., xrefs: 00540DCC

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast$EventObjectSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 3600396749-2104912459
Opcode ID: ea4af87ac3a45b73fb4c316efc982e363e04c162d546dcf56f439122981a3239
Instruction ID: 8fe1a6b93313a70cbd4591f130c894b8785c58a4ae1b0b28bf3ae1b9944aac0c
Opcode Fuzzy Hash: ea4af87ac3a45b73fb4c316efc982e363e04c162d546dcf56f439122981a3239
Instruction Fuzzy Hash: B191EE72A80722ABF7206A699D49BAA3ED4FF44754F114224FE09EB5E0D371CC20A6D5

Uniqueness

Uniqueness Score: -1.00%

Function 00524C33 Relevance: 38.7, APIs: 6, Strings: 16, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005233D7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,005210DD,?,00000000), ref: 005233F8

CloseHandle.KERNEL32(00000000,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00524E3A
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00524E49
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00524E58
CloseHandle.KERNEL32(?,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00524E63

Strings

"%ls" %ls, xrefs: 00524D74
Failed to append original command line., xrefs: 00524D63
Failed to allocate parameters for unelevated process., xrefs: 00524CF4
Failed to launch clean room process: %ls, xrefs: 00524DF1
Failed to allocate full command-line., xrefs: 00524D88
Failed to wait for clean room process: %ls, xrefs: 00524E1D
burn.clean.room, xrefs: 00524CD8
Failed to append %ls, xrefs: 00524D16
engine.cpp, xrefs: 00524DE4
burn.filehandle.attached, xrefs: 00524D11
burn.filehandle.self, xrefs: 00524D3F
D, xrefs: 00524DA3
%ls %ls, xrefs: 00524D4F
Failed to get path for current process., xrefs: 00524C7D
-%ls="%ls", xrefs: 00524CE0
Failed to cache to clean room., xrefs: 00524CBC

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseHandle$FileModuleName
String ID: "%ls" %ls$%ls %ls$-%ls="%ls"$D$Failed to allocate full command-line.$Failed to allocate parameters for unelevated process.$Failed to append %ls$Failed to append original command line.$Failed to cache to clean room.$Failed to get path for current process.$Failed to launch clean room process: %ls$Failed to wait for clean room process: %ls$burn.clean.room$burn.filehandle.attached$burn.filehandle.self$engine.cpp
API String ID: 3884789274-2391192076
Opcode ID: 4a9c41b809a5e55d53a22603b70883607bf8d26534abccffc63fd319a0c58a1a
Instruction ID: 587fd6d319a8b5d324b056dafa0f1abdd64cf8084160d2287a9faf2465494c11
Opcode Fuzzy Hash: 4a9c41b809a5e55d53a22603b70883607bf8d26534abccffc63fd319a0c58a1a
Instruction Fuzzy Hash: 11718132D0123AABEF219BA4DC45DEFBF78BF45710F114125F910B7291DB705A419BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00537337 Relevance: 35.3, APIs: 1, Strings: 19, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to get source process folder from path., xrefs: 00537513
WixBundleElevated, xrefs: 005374B3, 005374C4
Failed to open manifest stream., xrefs: 005373B8
Failed to get manifest stream from container., xrefs: 005373D9
WixBundleSourceProcessFolder, xrefs: 00537522
WixBundleSourceProcessPath, xrefs: 005374E6
Failed to overwrite the %ls built-in variable., xrefs: 005374C9
Failed to set source process folder variable., xrefs: 00537533
Failed to set original source variable., xrefs: 00537558
Failed to load catalog files., xrefs: 005375FD
WixBundleOriginalSource, xrefs: 00537547
Failed to extract bootstrapper application payloads., xrefs: 005375DD
Failed to parse command line., xrefs: 00537474
Failed to open attached UX container., xrefs: 0053739B
Failed to load manifest., xrefs: 005373F5
Failed to initialize internal cache functionality., xrefs: 0053758D
Failed to get unique temporary folder for bootstrapper application., xrefs: 005375BC
Failed to initialize variables., xrefs: 0053737E
Failed to set source process path variable., xrefs: 005374F7

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath
API String ID: 32694325-252221001
Opcode ID: b62de46369b2cb416b9577fa9fd88e7c07f29ce934e49114a1be66c2cf8d6c2d
Instruction ID: f0eba8479f8f3fad2ee804b36070135e9fe5eced41030484a41245a48a995089
Opcode Fuzzy Hash: b62de46369b2cb416b9577fa9fd88e7c07f29ce934e49114a1be66c2cf8d6c2d
Instruction Fuzzy Hash: B09168B2D4861EBBDB229AA4DC56EEEBF6CBF08700F004566F515E7141D7309944DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 005384C4 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 205
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,40000000,00000005,00000000,00000002,08000080,00000000,?,00000000,00000000,00524CB6,?,?,00000000,00524CB6,00000000), ref: 00538507
GetLastError.KERNEL32 ref: 00538514
FindCloseChangeNotification.KERNELBASE(00000000,?,00000000,0056B4F0,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005386F6

Strings

Failed to seek to checksum in exe header., xrefs: 005385F9
cache.cpp, xrefs: 00538538, 005385EF, 00538656, 005386C5
Failed to update signature offset., xrefs: 00538615
Failed to zero out original data offset., xrefs: 005386E8
Failed to copy engine from: %ls to: %ls, xrefs: 0053859C
Failed to seek to original data in exe burn section header., xrefs: 005386CF
Failed to seek to beginning of engine file: %ls, xrefs: 0053856D
cabinet.dll, xrefs: 0053866F
msi.dll, xrefs: 00538608
Failed to seek to signature table in exe header., xrefs: 00538660
Failed to create engine file at path: %ls, xrefs: 00538545

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ChangeCloseCreateErrorFileFindLastNotification
String ID: Failed to copy engine from: %ls to: %ls$Failed to create engine file at path: %ls$Failed to seek to beginning of engine file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$cabinet.dll$cache.cpp$msi.dll
API String ID: 4091947256-1976062716
Opcode ID: c021f88e1f03cdd6df737a07e15f43391794ab8890eab06d79fd1c464dcd4c8d
Instruction ID: ad7d98bcc6c42e93b10983916752dd678e43de72967ea70a773b516c5e5c5006
Opcode Fuzzy Hash: c021f88e1f03cdd6df737a07e15f43391794ab8890eab06d79fd1c464dcd4c8d
Instruction Fuzzy Hash: 3E51D472A403267BFB156A689C4AF7B3EA8FB54750F014125FD05E7281EB608D01A7E5

Uniqueness

Uniqueness Score: -1.00%

Function 005380AE Relevance: 33.4, APIs: 7, Strings: 12, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00525381), ref: 00538104

Part of subcall function 0056076C: OpenProcessToken.ADVAPI32(?,00000008,?,005252B5,00000000,?,?,?,?,?,?,?,005374AB,00000000), ref: 0056078A
Part of subcall function 0056076C: GetLastError.KERNEL32(?,?,?,?,?,?,?,005374AB,00000000), ref: 00560794
Part of subcall function 0056076C: FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,005374AB,00000000), ref: 0056081D

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 0053812A
GetLastError.KERNEL32 ref: 00538134
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 005381B1
GetLastError.KERNEL32 ref: 005381BB

Strings

Failed to convert working folder guid into string., xrefs: 0053823A
Temp\, xrefs: 00538189
Failed to ensure windows path for working folder ended in backslash., xrefs: 0053817F
cache.cpp, xrefs: 00538158, 005381DF, 00538230
Failed to create working folder guid., xrefs: 00538207
43u, xrefs: 005381B1
Failed to append bundle id on to temp path for working folder., xrefs: 00538264
Failed to copy working folder path., xrefs: 0053827F
Failed to concat Temp directory on windows path for working folder., xrefs: 005381A1
Failed to get temp path for working folder., xrefs: 005381E9
Failed to get windows path for working folder., xrefs: 00538162
%ls%ls\, xrefs: 0053824C

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast$Process$ChangeCloseCurrentDirectoryFindNotificationOpenPathTempTokenWindows
String ID: 43u$%ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$cache.cpp
API String ID: 58964441-2656921328
Opcode ID: 751e9b6d3669652146d3dfd394eaaaef4ba56e90e02be3e8be309a900619e72e
Instruction ID: 5d68e5d0d914d486ead432b91ed9b5d33532ea470bd00438c1fc5a0dab7a1ee4
Opcode Fuzzy Hash: 751e9b6d3669652146d3dfd394eaaaef4ba56e90e02be3e8be309a900619e72e
Instruction Fuzzy Hash: 8A41F972B40B25BBEB2196A49C4DFAB7FACBB40710F004151FD09F7180EB74DE48A6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00527503 Relevance: 33.4, APIs: 1, Strings: 21, Instructions: 378
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00537378,005252B5,00000000,0052533D), ref: 00527523

Strings

', xrefs: 005277E2
WixBundleProviderKey, xrefs: 00527D5A
$, xrefs: 00527C54
#, xrefs: 0052759C
WixBundleVersion, xrefs: 00527DAC
WixBundleExecutePackageAction, xrefs: 00527CCE
WixBundleElevated, xrefs: 00527D2E
WixBundleForcedRestartPackage, xrefs: 00527CF0
WixBundleSourceProcessFolder, xrefs: 00527D86
WixBundleSourceProcessPath, xrefs: 00527D6D
WixBundleActiveParent, xrefs: 00527D47
WixBundleTag, xrefs: 00527D99
0, xrefs: 0052753D
Failed to add built-in variable: %ls., xrefs: 00527DF0
Date, xrefs: 00527642
InstallerVersion, xrefs: 0052771E
LogonUser, xrefs: 005277B2
InstallerName, xrefs: 005276F8
WixBundleAction, xrefs: 00527C90
WixBundleExecutePackageCacheFolder, xrefs: 00527CAC
WixBundleInstalled, xrefs: 00527D12

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleVersion
API String ID: 32694325-826827252
Opcode ID: ada77ea1980785941f86fda6445fd9d10407b60295676853f05fe887205546fe
Instruction ID: a9a2311422711a7fde3f05abd4a969f7a93f1777e0a8fcffad92e4bfa2af0192
Opcode Fuzzy Hash: ada77ea1980785941f86fda6445fd9d10407b60295676853f05fe887205546fe
Instruction Fuzzy Hash: 973226B0C262798BDB65CF59998879DBEF8BB49B04F5081DBE14CA7251D7B00B84CF84

Uniqueness

Uniqueness Score: -1.00%

Function 00540E43 Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00540E65
CoUninitialize.OLE32 ref: 005410D9

Strings

Failed to reset begin operation event., xrefs: 00541091
Failed to initialize cabinet.dll., xrefs: 00540EE7
Failed to initialize COM., xrefs: 00540E71
cabextract.cpp, xrefs: 00540EDB, 00540FFF, 0054104A, 00541087, 005410B3
Failed to wait for begin operation event., xrefs: 00541054
Invalid operation for this state., xrefs: 005410BD
Failed to extract all files from container, erf: %d:%X:%d, xrefs: 00540FC0
Failed to set operation complete event., xrefs: 00541009
<the>.cab, xrefs: 00540F05

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 3442037557-1168358783
Opcode ID: cc451bb75085cde7ea3da7ba17d3f66fba3696a1bbc3e2379e4d241abee70c50
Instruction ID: bba31847b3064b62590aaea24ec5a21cf87c3f7b8840b2bbe80fe70d5bab6799
Opcode Fuzzy Hash: cc451bb75085cde7ea3da7ba17d3f66fba3696a1bbc3e2379e4d241abee70c50
Instruction Fuzzy Hash: D8516D36A90722F7973026649C4DEEB7E64FB80724B324235FD06BB2C0D6758D81A6D5

Uniqueness

Uniqueness Score: -1.00%

Function 005241D2 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 158
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,0052515E,?,?,00000000,?,?), ref: 005241FE
InitializeCriticalSection.KERNEL32(000000D0,?,?,0052515E,?,?,00000000,?,?), ref: 00524207
lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,0052515E,?,?,00000000,?,?), ref: 0052424D
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,0052515E,?,?,00000000,?,?), ref: 00524257
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,0052515E,?,?,00000000,?,?), ref: 0052426B
lstrlenW.KERNEL32(burn.filehandle.attached,?,?,0052515E,?,?,00000000,?,?), ref: 0052427B
lstrlenW.KERNEL32(burn.filehandle.self,?,?,0052515E,?,?,00000000,?,?), ref: 005242CB
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,0052515E,?,?,00000000,?,?), ref: 005242D5
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,0052515E,?,?,00000000,?,?), ref: 005242E9
lstrlenW.KERNEL32(burn.filehandle.self,?,?,0052515E,?,?,00000000,?,?), ref: 005242F9

Strings

Failed to parse file handle: '%ls', xrefs: 0052437D
engine.cpp, xrefs: 00524390, 005243BC
burn.filehandle.attached, xrefs: 00524248, 00524250, 00524255, 00524256, 00524276, 0052439A
Missing required parameter for switch: %ls, xrefs: 0052439F
burn.filehandle.self, xrefs: 005242C6, 005242CE, 005242D3, 005242D4, 005242F4, 005243C6
Failed to initialize engine section., xrefs: 00524362

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$engine.cpp
API String ID: 3039292287-3209860532
Opcode ID: 8e37581a2b5bc45d875031e966d4b69a0ac3aef434f19d4ca692b9acc97d1d6b
Instruction ID: a24ddce7edf7ae349a3d8ae6d4e067e4dd93cc54d94fc5982430c3d361191f43
Opcode Fuzzy Hash: 8e37581a2b5bc45d875031e966d4b69a0ac3aef434f19d4ca692b9acc97d1d6b
Instruction Fuzzy Hash: 24517171A40226BBDB24EB69EC46FAABF68FF55760F000115F618D7290D770A9D0CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0052C129 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 128
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,0052C319,005252FD,?,?,0052533D), ref: 0052C170
GetLastError.KERNEL32(?,0052C319,005252FD,?,?,0052533D,0052533D,00000000,?,00000000), ref: 0052C181
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,0052C319,005252FD,?,?,0052533D,0052533D,00000000,?), ref: 0052C1D0
GetCurrentProcess.KERNEL32(000000FF,00000000,?,0052C319,005252FD,?,?,0052533D,0052533D,00000000,?,00000000), ref: 0052C1D6
DuplicateHandle.KERNELBASE(00000000,?,0052C319,005252FD,?,?,0052533D,0052533D,00000000,?,00000000), ref: 0052C1D9
GetLastError.KERNEL32(?,0052C319,005252FD,?,?,0052533D,0052533D,00000000,?,00000000), ref: 0052C1E3
SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,0052C319,005252FD,?,?,0052533D,0052533D,00000000,?,00000000), ref: 0052C235
GetLastError.KERNEL32(?,0052C319,005252FD,?,?,0052533D,0052533D,00000000,?,00000000), ref: 0052C23F

Strings

Failed to open file: %ls, xrefs: 0052C1B2
feclient.dll, xrefs: 0052C232
Failed to duplicate handle to container: %ls, xrefs: 0052C214
crypt32.dll, xrefs: 0052C231
Failed to open container., xrefs: 0052C28B
Failed to move file pointer to container offset., xrefs: 0052C26D
container.cpp, xrefs: 0052C1A5, 0052C207, 0052C263

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp$crypt32.dll$feclient.dll
API String ID: 2619879409-373955632
Opcode ID: 7418e9b14eb63f83dcf551e9dc837d5adb8f3cc7807a491922b8c1d11f691cac
Instruction ID: 09e1c39ee9b87be8927f255e01676393ab73531dcd2180a8d574dbf781465238
Opcode Fuzzy Hash: 7418e9b14eb63f83dcf551e9dc837d5adb8f3cc7807a491922b8c1d11f691cac
Instruction Fuzzy Hash: EF41D236640311ABEB109E69AC89E5B3FE9FFC6760F114129F918DB292DB71C801DB60

Uniqueness

Uniqueness Score: -1.00%

Function 005629B3 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 005237EA: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00523829
Part of subcall function 005237EA: GetLastError.KERNEL32 ref: 00523833

Part of subcall function 00564932: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 0056495A

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 005629FD
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 00562A20
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 00562A43
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00562A66
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00562A89
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00562AAC
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00562ACF

Strings

MsiSourceListAddSourceExW, xrefs: 00562AB6
Msi.dll, xrefs: 005629C5
MsiGetProductInfoExW, xrefs: 00562A70
MsiSetExternalUIRecord, xrefs: 00562A93
MsiGetPatchInfoExW, xrefs: 00562A4D
MsiEnumProductsExW, xrefs: 00562A2A
MsiDeterminePatchSequenceW, xrefs: 005629F2
MsiDetermineApplicablePatchesW, xrefs: 00562A07

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AddressProc$ErrorLast$DirectorySystem
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 2510051996-1735120554
Opcode ID: cd8d4238ed507977a21b4434dde0ef62d973d7cbaa3a37851a0b30f7cbe798a3
Instruction ID: 54cf4d7c83f8a5f568a7c9c523abbfd258b06ace6cb48614adf2a9a1a1cb4a01
Opcode Fuzzy Hash: cd8d4238ed507977a21b4434dde0ef62d973d7cbaa3a37851a0b30f7cbe798a3
Instruction Fuzzy Hash: 3331CEB0A41208AFFB18DF26EC56A293FBDFB64700751652DEC05B2271F7B19908EB40

Uniqueness

Uniqueness Score: -1.00%

Function 00541484 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 103COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,0052C285,?,00000000,?,0052C319), ref: 005414BB
GetLastError.KERNEL32(?,0052C285,?,00000000,?,0052C319,005252FD,?,?,0052533D,0052533D,00000000,?,00000000), ref: 005414C4

Strings

Failed to copy file name., xrefs: 005414A6
Failed to create begin operation event., xrefs: 005414F2
cabextract.cpp, xrefs: 005414E8, 0054152E, 0054157A
Failed to create operation complete event., xrefs: 00541538
Failed to wait for operation complete., xrefs: 00541597
wininet.dll, xrefs: 0054149A
Failed to create extraction thread., xrefs: 00541584

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp$wininet.dll
API String ID: 545576003-938279966
Opcode ID: c4cda8d9b8673031aec36d491278244d2f850988353799dd723922b9f97bd6e5
Instruction ID: 7f12072b4a1fd61df076e5dc16be4db278e0d1d0673d604739bf3763d12f4c6e
Opcode Fuzzy Hash: c4cda8d9b8673031aec36d491278244d2f850988353799dd723922b9f97bd6e5
Instruction Fuzzy Hash: 2A2108B2A40B367AF72016796C45EE72DECFF847A4B014126FC0AE7180D654CD409AE5

Uniqueness

Uniqueness Score: -1.00%

Function 0055FBAD Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 0055FBD5
GetProcAddress.KERNEL32(SystemFunction041), ref: 0055FBE7
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 0055FC2A
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0055FC3E
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 0055FC76
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0055FC8A

Strings

cryputil.cpp, xrefs: 0055FC5F
AdvApi32.dll, xrefs: 0055FBB4
CryptProtectMemory, xrefs: 0055FC1F
SystemFunction040, xrefs: 0055FBCA
CryptUnprotectMemory, xrefs: 0055FC6B
SystemFunction041, xrefs: 0055FBD7
Crypt32.dll, xrefs: 0055FC0B

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$cryputil.cpp
API String ID: 4214558900-3191127217
Opcode ID: 6c574c2b4c7a93af65b3f54d6923dd12e306ac156e483bcc85700a1a63618b47
Instruction ID: 8e729a9794dd2ab5d340de86303021bd75e9b7c8db1f848d3f23b68718915d52
Opcode Fuzzy Hash: 6c574c2b4c7a93af65b3f54d6923dd12e306ac156e483bcc85700a1a63618b47
Instruction Fuzzy Hash: 43218175A443269BF7216B2AAD18B167DD8FB60752F020136EC00F72B1F7A59C4DEB90

Uniqueness

Uniqueness Score: -1.00%

Function 00540627 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 103fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 00540657
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 0054066F
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 00540674
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 00540677
GetLastError.KERNEL32(?,?), ref: 00540681
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 005406F0
GetLastError.KERNEL32(?,?), ref: 005406FD

Strings

Failed to duplicate handle to cab container., xrefs: 005406AF
cabextract.cpp, xrefs: 005406A5, 00540721
Failed to open cabinet file: %hs, xrefs: 0054072E
Failed to add virtual file pointer for cab container., xrefs: 005406D6
<the>.cab, xrefs: 00540650

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$cabextract.cpp
API String ID: 3030546534-3446344238
Opcode ID: cce8655973f802727c5871e11dc56cda8ab47739b3bb6c0346d2184ef589e74f
Instruction ID: dd833d265e4c4976a660d9182b1ce25f749753a0dab468692b00e59e93a9d033
Opcode Fuzzy Hash: cce8655973f802727c5871e11dc56cda8ab47739b3bb6c0346d2184ef589e74f
Instruction Fuzzy Hash: AF313272A01235BBEB206B699C48E9B7FACFF45760F110225FE08E7190C7709D10DAE1

Uniqueness

Uniqueness Score: -1.00%

Function 00536859 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000000FF,00000000,00000001,00000002,?,00000000,?,?,00524D0B,?,?), ref: 00536879
GetCurrentProcess.KERNEL32(?,00000000,?,?,00524D0B,?,?), ref: 0053687F
DuplicateHandle.KERNELBASE(00000000,?,?,00524D0B,?,?), ref: 00536882
GetLastError.KERNEL32(?,?,00524D0B,?,?), ref: 0053688C
CloseHandle.KERNEL32(000000FF,?,00524D0B,?,?), ref: 00536905

Strings

%ls -%ls=%u, xrefs: 005368D9
core.cpp, xrefs: 005368B0
burn.filehandle.attached, xrefs: 005368D2
Failed to duplicate file handle for attached container., xrefs: 005368BA
Failed to append the file handle to the command line., xrefs: 005368ED

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CurrentHandleProcess$CloseDuplicateErrorLast
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to duplicate file handle for attached container.$burn.filehandle.attached$core.cpp
API String ID: 4224961946-4196573879
Opcode ID: 6061798fc664d729d6d798a8ae85c3c2b3cbf32189530c121ae30e033c07a280
Instruction ID: f315ad16db69c9b1ebc48640fa0a24c36ce45784df75686d245af4ad35ea6af4
Opcode Fuzzy Hash: 6061798fc664d729d6d798a8ae85c3c2b3cbf32189530c121ae30e033c07a280
Instruction Fuzzy Hash: CB11D631A40715FBDB10ABB8AD09A5EBFA8FF05B30F204225F824E71D0D7B18D01A7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00569814 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 221libraryCOMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005698A2
LoadLibraryExA.KERNELBASE(?,00000000,00000000), ref: 0056992E
GetLastError.KERNEL32 ref: 0056993A
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 0056997A

Strings

$, xrefs: 00569836

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: 704fd63592b154263d08f65376c8466c116d25f11213cc2a26d34a8514314bfd
Instruction ID: 07dfc3898fbd013db279d2737ff21ef3fca57ad9dfd23e4dc7010bb601a27eb2
Opcode Fuzzy Hash: 704fd63592b154263d08f65376c8466c116d25f11213cc2a26d34a8514314bfd
Instruction Fuzzy Hash: 01818C75E00219AFDB11DF99D884AAEBBB9FF98310F15402AE801EB311DBB0DD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00536915 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 72fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000005,?,00000003,00000080,00000000,?,00000000,?,?,?), ref: 0053694B
CloseHandle.KERNEL32(00000000), ref: 005369BB

Strings

%ls -%ls=%u, xrefs: 00536963, 00536995
Failed to append the file handle to the obfuscated command line., xrefs: 005369A9
burn.filehandle.self, xrefs: 0053695C, 0053698E
Failed to append the file handle to the command line., xrefs: 00536977

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to append the file handle to the obfuscated command line.$burn.filehandle.self
API String ID: 3498533004-3263533295
Opcode ID: 8803364e32bebcc1af8ed6b49b3355fb946c9f33396e54ff0c92d73304e01a12
Instruction ID: 6f1168eca1b0a77d1c770c6a1bf11fdc940ef16156ee0f1d83f9f5192b31d4cb
Opcode Fuzzy Hash: 8803364e32bebcc1af8ed6b49b3355fb946c9f33396e54ff0c92d73304e01a12
Instruction Fuzzy Hash: 0411C8336406147BDB205A6CAC09F5B7FA8FB85B70F118368FD28EB1E1E7B058159691

Uniqueness

Uniqueness Score: -1.00%

Function 0056076C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,?,005252B5,00000000,?,?,?,?,?,?,?,005374AB,00000000), ref: 0056078A
GetLastError.KERNEL32(?,?,?,?,?,?,?,005374AB,00000000), ref: 00560794
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,005374AB,00000000), ref: 005607C6
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,005374AB,00000000), ref: 0056081D

Strings

procutil.cpp, xrefs: 0056080B

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Token$ChangeCloseErrorFindInformationLastNotificationOpenProcess
String ID: procutil.cpp
API String ID: 2387526074-1178289305
Opcode ID: 0ed3befa9fe2d6878cf70dd90f537c0c34e5b3d3219aa38fc6ddef49b74af6d5
Instruction ID: 9e9489b1caf9a79b351b74b7856aa42476ff1134848993e97db347b93eb28def
Opcode Fuzzy Hash: 0ed3befa9fe2d6878cf70dd90f537c0c34e5b3d3219aa38fc6ddef49b74af6d5
Instruction Fuzzy Hash: 69216271D40229EBEB109B999C48A9FBFA8FF54720F114166ED15E7190D7708E44EBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0056343B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0056344A
InterlockedIncrement.KERNEL32(0058B6D8), ref: 00563467
CLSIDFromProgID.OLE32(Msxml2.DOMDocument,0058B6C8,?,?,?,?,?,?), ref: 00563482
CLSIDFromProgID.OLE32(MSXML.DOMDocument,0058B6C8,?,?,?,?,?,?), ref: 0056348E

Strings

MSXML.DOMDocument, xrefs: 00563489
Msxml2.DOMDocument, xrefs: 0056347D

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: b6777242069de0006f627e4d5b42cb7d8b458ae6ae6d7f59f478b1b3c664a589
Instruction ID: 78e25b0a4aceb2e748a86d786a9b185f085aa65433cbde89026a03ee49fd8224
Opcode Fuzzy Hash: b6777242069de0006f627e4d5b42cb7d8b458ae6ae6d7f59f478b1b3c664a589
Instruction Fuzzy Hash: 74F06C3074423557EF125B96AC0DF179F68BB91F96F100425EC40E31D4F754858597B0

Uniqueness

Uniqueness Score: -1.00%

Function 00564932 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 0056495A
GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00564989
GetLastError.KERNEL32(?,00000000,00000000,00000000), ref: 005649B3
GetLastError.KERNEL32(00000000,0056B790,?,?,?,00000000,00000000,00000000), ref: 005649F4
GlobalFree.KERNEL32(00000000), ref: 00564A28

Strings

fileutil.cpp, xrefs: 00564978, 005649D1

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: fileutil.cpp
API String ID: 1145190524-2967768451
Opcode ID: ca23e507f4d356bbc015bff5dbca64ffde2b83f728b071147804f8f4febed324
Instruction ID: a050b87f6e22313c93b138ddd22d56524c490d423e5eda56799cf25345a9fcdc
Opcode Fuzzy Hash: ca23e507f4d356bbc015bff5dbca64ffde2b83f728b071147804f8f4febed324
Instruction Fuzzy Hash: 6021A535A40329BBE711ABA98C49AABBFACFF94364B014116FD05E7250D770CD40DAE0

Uniqueness

Uniqueness Score: -1.00%

Function 005407E4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 0054088A
GetLastError.KERNEL32(?,?,?), ref: 00540894

Strings

cabextract.cpp, xrefs: 005408B8
Failed to move file pointer 0x%x bytes., xrefs: 005408C5
Invalid seek type., xrefs: 00540820

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$cabextract.cpp
API String ID: 2976181284-417918914
Opcode ID: d1cb630e637445a06616252e36c68ccf7252ed9b190edfb22002cfed2d3386d7
Instruction ID: 8f6ec6e6a0832d700abb2cd32e298c554c948a7b0edcef03c9b520e09c9ee71f
Opcode Fuzzy Hash: d1cb630e637445a06616252e36c68ccf7252ed9b190edfb22002cfed2d3386d7
Instruction Fuzzy Hash: D731A331A0061AFFDB04DF68DD849AABBA9FF44314B108229FA19E7690D730ED11DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00524013 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(0052533D,005253B5,00000000,00000000,?,00539EE4,00000000,00000000,0052533D,00000000,005252B5,00000000,?,=SR,0052D4AC,=SR), ref: 00524021
GetLastError.KERNEL32(?,00539EE4,00000000,00000000,0052533D,00000000,005252B5,00000000,?,=SR,0052D4AC,=SR,00000000,00000000), ref: 0052402F
CreateDirectoryW.KERNEL32(0052533D,005253B5,00525381,?,00539EE4,00000000,00000000,0052533D,00000000,005252B5,00000000,?,=SR,0052D4AC,=SR,00000000), ref: 00524097
GetLastError.KERNEL32(?,00539EE4,00000000,00000000,0052533D,00000000,005252B5,00000000,?,=SR,0052D4AC,=SR,00000000,00000000), ref: 005240A1

Strings

dirutil.cpp, xrefs: 005240CF

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: dirutil.cpp
API String ID: 1375471231-2193988115
Opcode ID: 24465427cfc6b582f5a708f3d6484a4a75f1e0302e8b83304c2e5d177ea50323
Instruction ID: 1770d638f75e4e3ef6c40ccc5f33f8f1a81794526805b1660ebfaefc1636371c
Opcode Fuzzy Hash: 24465427cfc6b582f5a708f3d6484a4a75f1e0302e8b83304c2e5d177ea50323
Instruction Fuzzy Hash: 3C11D52A600231E6EB311AA56C4CB3BBE94FF56760F104125FF05EF0D0D7A58CC5AAE1

Uniqueness

Uniqueness Score: -1.00%

Function 00560917 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,?,00524E16,?,000000FF,?,?,?,?,?,00000000,?,?), ref: 00560927
GetLastError.KERNEL32(?,?,00524E16,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 00560935

Strings

procutil.cpp, xrefs: 00560959

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: procutil.cpp
API String ID: 1211598281-1178289305
Opcode ID: c6855459503c417e17b8cf3348fc9dbd6384c2cbe16188b2e5514ce2a132b7de
Instruction ID: 20cb6b1737535d158c8d48e900ccbc68c712d6be1f85e596e84e6551afbea50e
Opcode Fuzzy Hash: c6855459503c417e17b8cf3348fc9dbd6384c2cbe16188b2e5514ce2a132b7de
Instruction Fuzzy Hash: A411CE36E00225EBFB209BA98C086AB7ED6FF043A0F114216FD05E7291D3758D40A6E0

Uniqueness

Uniqueness Score: -1.00%

Function 0054074E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0054114F: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,0054077D,?,?,?), ref: 00541177
Part of subcall function 0054114F: GetLastError.KERNEL32(?,0054077D,?,?,?), ref: 00541181

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 0054078B
GetLastError.KERNEL32 ref: 00540795

Strings

Failed to read during cabinet extraction., xrefs: 005407C3
cabextract.cpp, xrefs: 005407B9

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$cabextract.cpp
API String ID: 2170121939-2426083571
Opcode ID: 4e1978bf258b0f4952913e1bca55fdead9c5c23052c452e9671f904e34a73dea
Instruction ID: e473bf19b024205860d89e8df68d2dbd04c8080ae35ab3c1c962e27deb3f6c8b
Opcode Fuzzy Hash: 4e1978bf258b0f4952913e1bca55fdead9c5c23052c452e9671f904e34a73dea
Instruction Fuzzy Hash: C501C472A00225BBEB209FA8DC08E9B7FA9FF49760F014119FD08E7690D7359A11DBD4

Uniqueness

Uniqueness Score: -1.00%

Function 0054114F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,0054077D,?,?,?), ref: 00541177
GetLastError.KERNEL32(?,0054077D,?,?,?), ref: 00541181

Strings

Failed to move to virtual file pointer., xrefs: 005411AF
cabextract.cpp, xrefs: 005411A5

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$cabextract.cpp
API String ID: 2976181284-3005670968
Opcode ID: eba1b46b2ef861f25940f87b3bff54c799a382e8cfc7a6cea56cfb73c1509302
Instruction ID: eefa27c2affcb0ecf7fd1fcbf8bac0c9f0f0ca6bee2e9feadb145797c47063ee
Opcode Fuzzy Hash: eba1b46b2ef861f25940f87b3bff54c799a382e8cfc7a6cea56cfb73c1509302
Instruction Fuzzy Hash: E701F232600636BBEB211B6A9C08EC7BFA9FF827B1B008129FD0C96150D7318C50D6D4

Uniqueness

Uniqueness Score: -1.00%

Function 00563DB5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00563E5E
GetLastError.KERNEL32 ref: 00563EC1

Strings

fileutil.cpp, xrefs: 00563EE5

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: fileutil.cpp
API String ID: 1948546556-2967768451
Opcode ID: 36360328541dce318f2084e31a69205aa61d00c3e1dc8ef29a7e3168ee3abc91
Instruction ID: c9f3ed240ee5de325760b700afd04b1dae93f1a90876e82d1d0255124c9c8054
Opcode Fuzzy Hash: 36360328541dce318f2084e31a69205aa61d00c3e1dc8ef29a7e3168ee3abc91
Instruction Fuzzy Hash: F4414071E002699BDB21CF58CD407EABBB8FF48751F0041A6E949E7240D7B59ED4DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0052501B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,00521104,?,?,00000000), ref: 0052503A
CompareStringW.KERNELBASE(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,00521104,?,?,00000000), ref: 0052506A

Strings

burn.clean.room, xrefs: 00525027, 00525034, 00525061

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: d8f9c54da97c7e95f4d4a93437f87f7409c93115c8cdac195ab52b671f42bfaa
Instruction ID: 9024a7428a106ca65141bd089b10f320c11403618713f7c642c8275a7adf1b43
Opcode Fuzzy Hash: d8f9c54da97c7e95f4d4a93437f87f7409c93115c8cdac195ab52b671f42bfaa
Instruction Fuzzy Hash: 50016D72600635AFA3244B99AC8CD73BFACFF2A7607104116FA49D3A50E3719C84D7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00564CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00563E85,?,?,?), ref: 00564D12
GetLastError.KERNEL32(?,?,00563E85,?,?,?), ref: 00564D1C

Strings

fileutil.cpp, xrefs: 00564D44

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: fileutil.cpp
API String ID: 442123175-2967768451
Opcode ID: bea59a7b4b0e775512ee72d542824ff4c1b6a9c07043082767e36f34156791a0
Instruction ID: a5980fa02569f474c989ac1abe860ac4a7bffc32eda05eaa3a382444b3c51b9b
Opcode Fuzzy Hash: bea59a7b4b0e775512ee72d542824ff4c1b6a9c07043082767e36f34156791a0
Instruction Fuzzy Hash: 06F08C72A01229BBD711DE9ACC49E9BBBADFB45761F000216FD04E7140E731AE00DAE0

Uniqueness

Uniqueness Score: -1.00%

Function 005647D3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,00538564,00000000,00000000,00000000,00000000,00000000), ref: 005647EB
GetLastError.KERNEL32(?,?,?,00538564,00000000,00000000,00000000,00000000,00000000), ref: 005647F5

Strings

fileutil.cpp, xrefs: 00564819

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: fileutil.cpp
API String ID: 2976181284-2967768451
Opcode ID: c98f1a2fd6c124fbecb2f1be7167b86766e4709a05523d5a0ff551d5b965c9f0
Instruction ID: 15b1ee6a6df2ca5f9336161a32e9909c3fa9f251c6fe02abc11ede661c7fd689
Opcode Fuzzy Hash: c98f1a2fd6c124fbecb2f1be7167b86766e4709a05523d5a0ff551d5b965c9f0
Instruction Fuzzy Hash: C9F01971A00269ABAB219F999C09EAB7FA8FF09750B014119FD09E7260E671DD10DBE4

Uniqueness

Uniqueness Score: -1.00%

Function 005237EA Relevance: 4.6, APIs: 3, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00523829
GetLastError.KERNEL32 ref: 00523833
LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 0052389B

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem
String ID:
API String ID: 1230559179-0
Opcode ID: ff1e165b951b2aeddd5c9c69ae192f7992a244bd41c3e160b2d873c1df3f759b
Instruction ID: f9d2351f9c1aab69cc742bfd6c2270bdee0c5be9d26593d0b40474a12225bb1a
Opcode Fuzzy Hash: ff1e165b951b2aeddd5c9c69ae192f7992a244bd41c3e160b2d873c1df3f759b
Instruction Fuzzy Hash: 33219BB6D0233A67EB209B649C49F9A7BACBF45710F110165FD04EB281E674DE4897A0

Uniqueness

Uniqueness Score: -1.00%

Function 00523999 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00523B34,00000000,?,00521472,00000000,80004005,00000000,80004005,00000000,000001C7,?,005213B7), ref: 005239A3
RtlFreeHeap.NTDLL(00000000,?,00523B34,00000000,?,00521472,00000000,80004005,00000000,80004005,00000000,000001C7,?,005213B7,000001C7,00000100), ref: 005239AA
GetLastError.KERNEL32(?,00523B34,00000000,?,00521472,00000000,80004005,00000000,80004005,00000000,000001C7,?,005213B7,000001C7,00000100,?), ref: 005239B4

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: 915d4ecc6e903f57aa62cc3ac1c3e5caf73abe0cdd5001eada809c360a4c84cf
Instruction ID: 78872bf903820f5e5178b3481a1a7eaa516c2eaff3b502acae4eb6b05fcb773c
Opcode Fuzzy Hash: 915d4ecc6e903f57aa62cc3ac1c3e5caf73abe0cdd5001eada809c360a4c84cf
Instruction Fuzzy Hash: C2D012736002346797102BFEAC0C697BE9CEF1A5A1B014121FD05D3110D7758954D6E5

Uniqueness

Uniqueness Score: -1.00%

Function 00560E3F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00565699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00560E52

Strings

regutil.cpp, xrefs: 00560E8A

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Open
String ID: regutil.cpp
API String ID: 71445658-955085611
Opcode ID: 974a63f998206ceeab85da8f029fbaf185ea4261dedab17df1b08fba96719908
Instruction ID: 46dd420d9e75d3a83556ae3ecfe32a6d3c6d4e74f066fdc80f0f8861bfa5fb4f
Opcode Fuzzy Hash: 974a63f998206ceeab85da8f029fbaf185ea4261dedab17df1b08fba96719908
Instruction Fuzzy Hash: BEF0A7727011356BEF2459564C04BAB7D89FF456A0F118525BD49DB1A0E336CC10D3D0

Uniqueness

Uniqueness Score: -1.00%

Function 00563499 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 005634CE

Part of subcall function 00562F23: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,005634DF,00000000,?,00000000), ref: 00562F3D
Part of subcall function 00562F23: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0054BDED,?,005252FD,?,00000000,?), ref: 00562F49

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID:
API String ID: 52713655-0
Opcode ID: b1bf251b31b66fc05851d54617526de8329d1a8a66d9fb4dcd13903df9c2cc11
Instruction ID: fbfee4ad407084ad1b9fb363693f0e510b20e36ac7f6cb4f88723876fd1ce49a
Opcode Fuzzy Hash: b1bf251b31b66fc05851d54617526de8329d1a8a66d9fb4dcd13903df9c2cc11
Instruction Fuzzy Hash: 42311976E006299BCB11DFA8C8C4ADEBBF8FF08710F01456AED15EB311D6709E048BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00565728 Relevance: 1.6, APIs: 1, Instructions: 60registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(80070490,00000000,80070490,0058AAA0,00000000,80070490,00000000,?,0053890E,WiX\Burn,PackageCache,00000000,0058AAA0,00000000,00000000,80070490), ref: 00565782

Part of subcall function 00560F6E: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00560FE4
Part of subcall function 00560F6E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 0056101F

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: bb85445f0cda2a532165ad1a42712c4e918aaee55efa628d64a1bccff6178e64
Instruction ID: 70058ab313e096896a6ebf3d95d79b72db637c8fc3d4965cf5b6697db3411640
Opcode Fuzzy Hash: bb85445f0cda2a532165ad1a42712c4e918aaee55efa628d64a1bccff6178e64
Instruction Fuzzy Hash: 7D11C23688062AEBCF21AEA4DC859AEBF69FF443A1F150239ED4167111E3314D50EAD0

Uniqueness

Uniqueness Score: -1.00%

Function 005234C5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,005389CA,0000001C,80070490,00000000,00000000,80070490), ref: 005234E5

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 70632c46fef7b4b29bd578ce4ab052b44ab1337574e1435eeeac1fe281822234
Instruction ID: bf8f19e7840c0f1ac6cb5bd0844fae16ad3e96ea62cbcf5e31930c1e87752fec
Opcode Fuzzy Hash: 70632c46fef7b4b29bd578ce4ab052b44ab1337574e1435eeeac1fe281822234
Instruction Fuzzy Hash: 11E012763012357BAB023E666C0DDEB7F9CFF16750B008491FE40D6140E665E95096F4

Uniqueness

Uniqueness Score: -1.00%

Function 00562DD0 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(00000000,00000000,0052547B,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00562DDD

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: b6222008727221e7b849a2a47f7346daca097df29b277a66b1d1b113e8e53179
Instruction ID: 2f9117aa49f89efad798e21f5eb95ca51fe40c9cc7637bff008efcbf9dfc5a42
Opcode Fuzzy Hash: b6222008727221e7b849a2a47f7346daca097df29b277a66b1d1b113e8e53179
Instruction Fuzzy Hash: 31E0F6F59262299EBB108F5BBD545527BBCFB28B40311265BFC00E3271E3B04448AF90

Uniqueness

Uniqueness Score: -1.00%

Function 005214B2 Relevance: 1.3, APIs: 1, Instructions: 54stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,005221B8,?,00000000,?,00000000,?,005238BD,00000000,?,00000104), ref: 005214E4

Part of subcall function 00523B51: GetProcessHeap.KERNEL32(00000000,000001C7,?,005221DC,000001C7,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 00523B59
Part of subcall function 00523B51: HeapSize.KERNEL32(00000000,?,005221DC,000001C7,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 00523B60

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: abb93ffd1f4145d5149f0544405423942e8f320fc8103521a3af028a811f2d7d
Instruction ID: 3ebec8b22079586a09c1908115ee31f5c05a40f1a0efaf291d88755d8d7ed1e2
Opcode Fuzzy Hash: abb93ffd1f4145d5149f0544405423942e8f320fc8103521a3af028a811f2d7d
Instruction Fuzzy Hash: 18012637300639ABCF116E14EC44E9B7F95BFA2760F214225F9299B1E0D7319D409AD8

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0052A7EF Relevance: 172.2, APIs: 29, Strings: 69, Instructions: 688COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 0052B01A

Part of subcall function 005238D4: GetProcessHeap.KERNEL32(?,000001C7,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238E5
Part of subcall function 005238D4: RtlAllocateHeap.NTDLL(00000000,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238EC

CompareStringW.KERNEL32(0000007F,00000000,0056CA64,000000FF,DirectorySearch,000000FF,0056CA64,Condition,feclient.dll,0056CA64,Variable,?,0056CA64,0056CA64,?,?), ref: 0052A927
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Type,?,?,Path,clbcatq.dll), ref: 0052A97C
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,path,000000FF), ref: 0052A998
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,FileSearch,000000FF), ref: 0052A9BC
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Type,?,?,Path,clbcatq.dll), ref: 0052AA0F
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 0052AA29
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,RegistrySearch,000000FF), ref: 0052AA51
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKCR,000000FF,?,Root,?), ref: 0052AA8F
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKCU,000000FF), ref: 0052AAAE
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKLM,000000FF), ref: 0052AACD
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Win64,msi.dll,?,Type,?,?,Value,version.dll,?), ref: 0052AB8B
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,value,000000FF), ref: 0052ABA5

Part of subcall function 005631C7: VariantInit.OLEAUT32(?), ref: 005631DD
Part of subcall function 005631C7: SysAllocString.OLEAUT32(?), ref: 005631F9
Part of subcall function 005631C7: VariantClear.OLEAUT32(?), ref: 00563280
Part of subcall function 005631C7: SysFreeString.OLEAUT32(00000000), ref: 0056328B

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,numeric,000000FF,?,VariableType,?,?,ExpandEnvironment,cabinet.dll), ref: 0052AC04
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,string,000000FF), ref: 0052AC26
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 0052AC46
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,directory,000000FF), ref: 0052AD1E
SysFreeString.OLEAUT32(?), ref: 0052AEFC

Strings

Variable, xrefs: 0052A8DC
version, xrefs: 0052AA1C, 0052AC39, 0052ADD9
wininet.dll, xrefs: 0052AB01
directory, xrefs: 0052AD11
Failed to select search nodes., xrefs: 0052A81E
Value, xrefs: 0052AB1D
HKCU, xrefs: 0052AAA1
exists, xrefs: 0052A96D, 0052AA00, 0052AB7C
RegistrySearch, xrefs: 0052AA44
Failed to get Value attribute., xrefs: 0052AF3A
Failed to allocate memory for search structs., xrefs: 0052A87B
feclient.dll, xrefs: 0052A8F6
Invalid value for @Type: %ls, xrefs: 0052AF9F
Failed to get @ExpandEnvironment., xrefs: 0052AF4E
Failed to get @UpgradeCode., xrefs: 0052AF8B
UpgradeCode, xrefs: 0052AD8A
Failed to get @Id., xrefs: 0052AFE2
search.cpp, xrefs: 0052A871
FeatureId, xrefs: 0052AE8F
ComponentId, xrefs: 0052ACA5
Condition, xrefs: 0052A8F7
HKU, xrefs: 0052AADF
Failed to get @FeatureId., xrefs: 0052AFB5
Type, xrefs: 0052A954, 0052A9E7, 0052AB40, 0052ACC0, 0052ADC0, 0052AEAA
DirectorySearch|FileSearch|RegistrySearch|MsiComponentSearch|MsiProductSearch|MsiFeatureSearch, xrefs: 0052A80B
Win64, xrefs: 0052AB5B
value, xrefs: 0052AB98
Failed to get Key attribute., xrefs: 0052AF6C
DirectorySearch, xrefs: 0052A918
Unexpected element name: %ls, xrefs: 0052AFCB
Failed to get @Path., xrefs: 0052AF30
Key, xrefs: 0052AB02
Failed to get @Condition., xrefs: 0052AF26
comres.dll, xrefs: 0052ACA4, 0052AD59, 0052AD89, 0052AE8E
Root, xrefs: 0052AA67
Path, xrefs: 0052A939, 0052A9CC
HKCR, xrefs: 0052AA80
VariableType, xrefs: 0052ABDC
MsiProductSearch, xrefs: 0052AD37
HKLM, xrefs: 0052AAC0
ProductCode, xrefs: 0052AC82, 0052AD5A, 0052AE74
Failed to get Win64 attribute., xrefs: 0052AF44
ExpandEnvironment, xrefs: 0052ABB9
keyPath, xrefs: 0052ACD9
language, xrefs: 0052ADF5
Failed to get @ProductCode., xrefs: 0052AFBC
clbcatq.dll, xrefs: 0052A938, 0052A9CB, 0052AC81, 0052AE73
assignment, xrefs: 0052AE2B
Failed to get @ComponentId., xrefs: 0052AF84
=SR, xrefs: 0052A7EF
msi.dll, xrefs: 0052AB5A
Failed to get @Type., xrefs: 0052AFAE
Failed to get @Root., xrefs: 0052AF7D
MsiComponentSearch, xrefs: 0052AC5F
version.dll, xrefs: 0052AB1C
Failed to get @Variable., xrefs: 0052AFDB
Failed to get @VariableType., xrefs: 0052AF62
Failed to get next node., xrefs: 0052AFE9
MsiFeatureSearch, xrefs: 0052AE51
string, xrefs: 0052AC19
Invalid value for @VariableType: %ls, xrefs: 0052AF5B
Failed to get search node count., xrefs: 0052A843
path, xrefs: 0052A98B, 0052AA38
Invalid value for @Root: %ls, xrefs: 0052AF76
state, xrefs: 0052ACF5, 0052AE11, 0052AEC3
Failed to get @ProductCode or @UpgradeCode., xrefs: 0052AF92
numeric, xrefs: 0052ABF5
cabinet.dll, xrefs: 0052ABB8
FileSearch, xrefs: 0052A9AF

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: String$Compare$Free$HeapVariant$AllocAllocateClearInitProcess
String ID: =SR$ComponentId$Condition$DirectorySearch$DirectorySearch|FileSearch|RegistrySearch|MsiComponentSearch|MsiProductSearch|MsiFeatureSearch$ExpandEnvironment$Failed to allocate memory for search structs.$Failed to get @ComponentId.$Failed to get @Condition.$Failed to get @ExpandEnvironment.$Failed to get @FeatureId.$Failed to get @Id.$Failed to get @Path.$Failed to get @ProductCode or @UpgradeCode.$Failed to get @ProductCode.$Failed to get @Root.$Failed to get @Type.$Failed to get @UpgradeCode.$Failed to get @Variable.$Failed to get @VariableType.$Failed to get Key attribute.$Failed to get Value attribute.$Failed to get Win64 attribute.$Failed to get next node.$Failed to get search node count.$Failed to select search nodes.$FeatureId$FileSearch$HKCR$HKCU$HKLM$HKU$Invalid value for @Root: %ls$Invalid value for @Type: %ls$Invalid value for @VariableType: %ls$Key$MsiComponentSearch$MsiFeatureSearch$MsiProductSearch$Path$ProductCode$RegistrySearch$Root$Type$Unexpected element name: %ls$UpgradeCode$Value$Variable$VariableType$Win64$assignment$cabinet.dll$clbcatq.dll$comres.dll$directory$exists$feclient.dll$keyPath$language$msi.dll$numeric$path$search.cpp$state$string$value$version$version.dll$wininet.dll
API String ID: 2748437055-1015289144
Opcode ID: e35fd5dcd13b3575c026b5bdcb0a94df8f71d0d37cec6250ac2932b14dfff50d
Instruction ID: 004e845c456967adaa51951819704b7cc062024cfba2df8710910f8ae559f1d5
Opcode Fuzzy Hash: e35fd5dcd13b3575c026b5bdcb0a94df8f71d0d37cec6250ac2932b14dfff50d
Instruction Fuzzy Hash: 53222878A49236BFCB219A54DD46EAEBE65BF06B30F200711F430B72D1D7749E40DA92

Uniqueness

Uniqueness Score: -1.00%

Function 005615CB Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 0056166B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00561675
CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 005616C2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005616C8
CreateWellKnownSid.ADVAPI32(00000017,00000000,?,?), ref: 00561702
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00561708
CreateWellKnownSid.ADVAPI32(00000018,00000000,?,?), ref: 00561748
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0056174E
CreateWellKnownSid.ADVAPI32(00000010,00000000,?,?), ref: 0056178E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00561794
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,?), ref: 005617D4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005617DA
SetEntriesInAclA.ADVAPI32(00000005,?,00000000,?), ref: 005618BD
LocalFree.KERNEL32(?), ref: 005619DC

Strings

srputil.cpp, xrefs: 00561696

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast$CreateKnownWell$DescriptorEntriesFreeInitializeLocalSecurity
String ID: srputil.cpp
API String ID: 3627156773-4105181634
Opcode ID: 1c4d0a1ae3472c1faf96ac7caec7f99b371192854d9fe8ef2c17690a4d379426
Instruction ID: 20af4c88fba4a6d5e0a4ccdfc7c8ca58102fb3e0f9134659db2a6131cfb4ceed
Opcode Fuzzy Hash: 1c4d0a1ae3472c1faf96ac7caec7f99b371192854d9fe8ef2c17690a4d379426
Instruction Fuzzy Hash: 7EB14871D40729AAFB209BA98D48BEB7AFCFF18750F014166ED09F7150E7709D848BA4

Uniqueness

Uniqueness Score: -1.00%

Function 005369CC Relevance: 33.6, APIs: 6, Strings: 13, Instructions: 358synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0052D39D: EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00536E4B,000000B8,00000000,?,00000000,757A95A0), ref: 0052D3AC
Part of subcall function 0052D39D: InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 0052D3BB
Part of subcall function 0052D39D: LeaveCriticalSection.KERNEL32(000000D0,?,00536E4B,000000B8,00000000,?,00000000,757A95A0), ref: 0052D3D0

ReleaseMutex.KERNEL32(00000000,?,00000000,?,00000000,00000001,00000000), ref: 00536D9A
CloseHandle.KERNEL32(00000000), ref: 00536DA3
CloseHandle.KERNEL32(@GR,?,00000000,?,00000000,00000001,00000000), ref: 00536DC0

Strings

Another per-machine setup is already executing., xrefs: 00536BD9
Failed to elevate., xrefs: 00536BA5
UX aborted apply begin., xrefs: 00536AA6
Another per-user setup is already executing., xrefs: 00536AF1
Failed to cache engine to working directory., xrefs: 00536B7F
Failed to set initial apply variables., xrefs: 00536B18
@GR, xrefs: 00536CBC, 00536C0B, 00536AB3, 00536CDB, 00536CF5, 00536DBF
core.cpp, xrefs: 00536A9C, 00536C76
Failed while caching, aborting execution., xrefs: 00536CA8
Failed to create cache thread., xrefs: 00536C80
Failed to register bundle., xrefs: 00536C00
crypt32.dll, xrefs: 00536CD2
Engine cannot start apply because it is busy with another action., xrefs: 00536A2F

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseCriticalHandleSection$CompareEnterExchangeInterlockedLeaveMutexRelease
String ID: @GR$Another per-machine setup is already executing.$Another per-user setup is already executing.$Engine cannot start apply because it is busy with another action.$Failed to cache engine to working directory.$Failed to create cache thread.$Failed to elevate.$Failed to register bundle.$Failed to set initial apply variables.$Failed while caching, aborting execution.$UX aborted apply begin.$core.cpp$crypt32.dll
API String ID: 322611130-409395771
Opcode ID: 640de2735f4b889aaae7d393d7e8dc36dc91c908ee097d777fdf7c3cd8c7fe00
Instruction ID: d0f82f4a6e6e86ba3bb05c1b0f750dcadace451c9e4b0e765f219bffa76b74d1
Opcode Fuzzy Hash: 640de2735f4b889aaae7d393d7e8dc36dc91c908ee097d777fdf7c3cd8c7fe00
Instruction Fuzzy Hash: 9FC1A371A0161ABFDB199BA0C849BEEBFB8FF04315F00862EF515A6141DB70AD54DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 005244E9 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 137COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,00000001,00000000,?,?,?,?,?,?,?), ref: 00524512
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00524519
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00524523
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00524573
GetLastError.KERNEL32 ref: 0052457D
CloseHandle.KERNEL32(?), ref: 00524677

Strings

Failed to adjust token to add shutdown privileges., xrefs: 005245F9
Failed to get shutdown privilege LUID., xrefs: 005245AB
SeShutdownPrivilege, xrefs: 00524566
Failed to get process token., xrefs: 00524551
engine.cpp, xrefs: 00524547, 005245A1, 005245EF, 00524658
Failed to schedule restart., xrefs: 00524662

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLastProcess$CloseCurrentHandleLookupOpenPrivilegeTokenValue
String ID: Failed to adjust token to add shutdown privileges.$Failed to get process token.$Failed to get shutdown privilege LUID.$Failed to schedule restart.$SeShutdownPrivilege$engine.cpp
API String ID: 4232854991-1583736410
Opcode ID: f8de3911695c518e687ce42f513002e536c04f41ab4cf7cd8d5d91ce910154bf
Instruction ID: 9541b4ece6f0cd4c518947f26f61f59d03bed5a3fee1f58f37f484783dc52072
Opcode Fuzzy Hash: f8de3911695c518e687ce42f513002e536c04f41ab4cf7cd8d5d91ce910154bf
Instruction Fuzzy Hash: 5141D372A40725ABFB205BB9AC4DBBB7E98FF02750F010125FE01F71D0D7658D449AA1

Uniqueness

Uniqueness Score: -1.00%

Function 00534CE8 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 161pipeCOMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 00534D16
GetLastError.KERNEL32(?,00000000,?,?,0052442A,?), ref: 00534D1F
CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,?,?,00000000,?,?,0052442A,?), ref: 00534DC0
GetLastError.KERNEL32(?,0052442A,?), ref: 00534DCD
CloseHandle.KERNEL32(00000000,pipe.cpp,00000132,00000000,?,?,?,?,?,?,?,0052442A,?), ref: 00534E93
LocalFree.KERNEL32(00000000,?,0052442A,?), ref: 00534EC1

Strings

Failed to create the security descriptor for the connection event and pipe., xrefs: 00534D4D
Failed to allocate full name of cache pipe: %ls, xrefs: 00534E2A
\\.\pipe\%ls.Cache, xrefs: 00534E14
pipe.cpp, xrefs: 00534D43, 00534DF1, 00534E77
Failed to create pipe: %ls, xrefs: 00534DFE, 00534E84
Failed to allocate full name of pipe: %ls, xrefs: 00534D8D
D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD), xrefs: 00534D11
\\.\pipe\%ls, xrefs: 00534D77

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: DescriptorErrorLastSecurity$CloseConvertCreateFreeHandleLocalNamedPipeString
String ID: D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD)$Failed to allocate full name of cache pipe: %ls$Failed to allocate full name of pipe: %ls$Failed to create pipe: %ls$Failed to create the security descriptor for the connection event and pipe.$\\.\pipe\%ls$\\.\pipe\%ls.Cache$pipe.cpp
API String ID: 3065245045-3253666091
Opcode ID: a9f6e8ba86c8630faa1a3ee4209287cf78a5ee7d00c27fe12e3b1a5dc7117222
Instruction ID: 6fa1614bd7f49c5065de33ae8bab54daa16367015876eda6b8ff3d0690a15144
Opcode Fuzzy Hash: a9f6e8ba86c8630faa1a3ee4209287cf78a5ee7d00c27fe12e3b1a5dc7117222
Instruction Fuzzy Hash: 7051A271E40315BBEB119BA8AC4ABAEBFA8FF04720F104125FD14E61D0D3B55E94EA91

Uniqueness

Uniqueness Score: -1.00%

Function 0055F961 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 167encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000003,F0000040,00000003,00000000,00000000,00539CFF,00000003,000007D0,00000003,?,000007D0,00000000,000007D0), ref: 0055F9C6
GetLastError.KERNEL32 ref: 0055F9D0
CryptCreateHash.ADVAPI32(?,?,00000000,00000000,?), ref: 0055FA0D
GetLastError.KERNEL32 ref: 0055FA17
CryptDestroyHash.ADVAPI32(00000000), ref: 0055FAC9
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0055FAE0
GetLastError.KERNEL32 ref: 0055FAFB
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000), ref: 0055FB33
GetLastError.KERNEL32 ref: 0055FB3D
SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00008004,00000001), ref: 0055FB76
GetLastError.KERNEL32 ref: 0055FB84

Strings

cryputil.cpp, xrefs: 0055FAB0

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CryptErrorLast$Hash$Context$AcquireCreateDestroyFileParamPointerRelease
String ID: cryputil.cpp
API String ID: 1716956426-2185294990
Opcode ID: 5379a8ce2c125fca1f7cd28e7e722db72662c6f3f764714ee9d8e238620af8fe
Instruction ID: 9cc65962a81b6ab730abe7c2b34d770b06d511c60c82ccfcbc3e04a00a2ef2bf
Opcode Fuzzy Hash: 5379a8ce2c125fca1f7cd28e7e722db72662c6f3f764714ee9d8e238620af8fe
Instruction Fuzzy Hash: 1C519732E00265ABFB319A698C08BE77AE8FB04751F014166FE4DE7150D7B48DC8DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0054C0FA Relevance: 25.4, Strings: 20, Instructions: 364COMMON

Download Yara Rule

Strings

Failed to allocate space for burn package payload inside of related bundle struct, xrefs: 0054C14D
Failed to allocate memory for dependency providers., xrefs: 0054C481
Failed to allocate memory for pseudo bundle payload hash., xrefs: 0054C275
Failed to append relation type to install arguments for related bundle package, xrefs: 0054C371
Failed to copy display name for pseudo bundle., xrefs: 0054C4F2
Failed to copy cache id for pseudo bundle., xrefs: 0054C327
Failed to copy uninstall arguments for related bundle package, xrefs: 0054C3EB
Failed to append relation type to repair arguments for related bundle package, xrefs: 0054C3B9
Failed to copy local source path for pseudo bundle., xrefs: 0054C203
Failed to copy key for pseudo bundle payload., xrefs: 0054C1BB
Failed to copy install arguments for related bundle package, xrefs: 0054C34C
pseudobundle.cpp, xrefs: 0054C141, 0054C17A, 0054C269, 0054C475
Failed to copy repair arguments for related bundle package, xrefs: 0054C398
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 0054C186
Failed to copy download source for pseudo bundle., xrefs: 0054C231
Failed to append relation type to uninstall arguments for related bundle package, xrefs: 0054C40C
-%ls, xrefs: 0054C114
Failed to copy filename for pseudo bundle., xrefs: 0054C1DF
Failed to copy key for pseudo bundle., xrefs: 0054C30A
Failed to copy version for pseudo bundle., xrefs: 0054C4D0

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: -%ls$Failed to allocate memory for dependency providers.$Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of related bundle struct$Failed to allocate space for burn payload inside of related bundle struct$Failed to append relation type to install arguments for related bundle package$Failed to append relation type to repair arguments for related bundle package$Failed to append relation type to uninstall arguments for related bundle package$Failed to copy cache id for pseudo bundle.$Failed to copy display name for pseudo bundle.$Failed to copy download source for pseudo bundle.$Failed to copy filename for pseudo bundle.$Failed to copy install arguments for related bundle package$Failed to copy key for pseudo bundle payload.$Failed to copy key for pseudo bundle.$Failed to copy local source path for pseudo bundle.$Failed to copy repair arguments for related bundle package$Failed to copy uninstall arguments for related bundle package$Failed to copy version for pseudo bundle.$pseudobundle.cpp
API String ID: 1357844191-2832335422
Opcode ID: aa3589b45a1b70dd4126fc79f34aa1de79b7240ff839bfcc6fb4155cc19542cf
Instruction ID: 4a8604812615af67e833d446ca2aa779747f622ac147450b033f05b86f844a26
Opcode Fuzzy Hash: aa3589b45a1b70dd4126fc79f34aa1de79b7240ff839bfcc6fb4155cc19542cf
Instruction Fuzzy Hash: D4C1E371A01666BBDB55CE64CC55EAA7EA8BF89718F008125FD09EB341DB70EC10EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00539C99 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 181COMMON

Download Yara Rule

Strings

Failed to concat complete cached path., xrefs: 00539CEF
Failed to move verified file to complete payload path: %ls, xrefs: 00539E68
Failed to transfer working path to unverified path for payload: %ls., xrefs: 00539D9F
Failed to get cached path for package with cache id: %ls, xrefs: 00539CC3
Failed to reset permissions on unverified cached payload: %ls, xrefs: 00539DEC
Failed to create unverified path., xrefs: 00539D69
Failed to find payload: %ls in working path: %ls and unverified path: %ls, xrefs: 00539DC6
copying, xrefs: 00539E27
moving, xrefs: 00539E2C, 00539E34

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID:
String ID: Failed to concat complete cached path.$Failed to create unverified path.$Failed to find payload: %ls in working path: %ls and unverified path: %ls$Failed to get cached path for package with cache id: %ls$Failed to move verified file to complete payload path: %ls$Failed to reset permissions on unverified cached payload: %ls$Failed to transfer working path to unverified path for payload: %ls.$copying$moving
API String ID: 0-1289240508
Opcode ID: bf00410b70826019bbc8270d07f94e168c4f2a1c45707f2a48ed99a3f46589e3
Instruction ID: c3f2b968970f1b5b79d82303eb9e1a09e7ac1c6819e4671e74b66dbbf3c9fed2
Opcode Fuzzy Hash: bf00410b70826019bbc8270d07f94e168c4f2a1c45707f2a48ed99a3f46589e3
Instruction Fuzzy Hash: 35518F7694061ABBDF236B90DC06FAEBF7ABF44710F104451F904761A1E7B25EA0BB81

Uniqueness

Uniqueness Score: -1.00%

Function 0055FDC2 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 130threadtimeCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0058B60C,00000000,?,?,?,?,00541014,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 0055FDF0
GetCurrentProcessId.KERNEL32(00000000,?,00541014,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 0055FE00
GetCurrentThreadId.KERNEL32 ref: 0055FE09
GetLocalTime.KERNEL32(8007139F,?,00541014,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 0055FE1F
LeaveCriticalSection.KERNEL32(0058B60C,?,00000000,00000000,0000FDE9), ref: 0055FF12

Strings

0cX, xrefs: 0055FEA5
0cX, xrefs: 0055FE67
(cX, xrefs: 0055FE56
,cX, xrefs: 0055FE4F
$cX, xrefs: 0055FE5D
%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 0055FEB9

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: $cX$%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls$(cX$,cX$0cX$0cX
API String ID: 296830338-3121086414
Opcode ID: c335728374655ac143ad984f510f8488d25b599cb13f0c24e232923851f5b407
Instruction ID: e8d58cc882b43b8671cd9ee194c915cefed0de5678dfda425457c6a5208b9830
Opcode Fuzzy Hash: c335728374655ac143ad984f510f8488d25b599cb13f0c24e232923851f5b407
Instruction Fuzzy Hash: 55417F72900219ABEF209BA5DC55ABEBBF8BF49712F104426FD01F2160E7349D48DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00526184 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C), ref: 005261D2
GetLastError.KERNEL32 ref: 005261DC

Strings

Failed to get OS info., xrefs: 0052620A
variable.cpp, xrefs: 00526200
Failed to set variant value., xrefs: 00526314

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLastVersion
String ID: Failed to get OS info.$Failed to set variant value.$variable.cpp
API String ID: 305913169-1971907631
Opcode ID: 60ee67014dedf93917dda2206cda32aa9add927d87c99601cf4f3684f3cb31fe
Instruction ID: d473c6a54fd59c49f9e6aa342e9d8b7015e3f678d00cba555c2a267de8442796
Opcode Fuzzy Hash: 60ee67014dedf93917dda2206cda32aa9add927d87c99601cf4f3684f3cb31fe
Instruction Fuzzy Hash: C4417571A00228EBDB20DBA9DC45EEA7FB8FF9A710F10059AF505E7180D6709E91DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0053993E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?,*.*,?,?,?,00000000,.unverified,?), ref: 005399ED
lstrlenW.KERNEL32(?), ref: 00539A14
FindNextFileW.KERNEL32(00000000,00000010), ref: 00539A74
FindClose.KERNEL32(00000000), ref: 00539A7F

Part of subcall function 00523BC3: GetFileAttributesW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 00523C3F
Part of subcall function 00523BC3: GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00523C52

Strings

.unverified, xrefs: 00539981
*.*, xrefs: 005399C7

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: FileFind$AttributesCloseErrorFirstLastNextlstrlen
String ID: *.*$.unverified
API String ID: 457978746-2528915496
Opcode ID: c3297bf9bd544fb6bc22397b73ed296ebc5879ec00da00b6ebf63f1948bde4a0
Instruction ID: 71c3611960877f3238c31283c155ffe490fcb75d14494cd66f455b1bba663f5f
Opcode Fuzzy Hash: c3297bf9bd544fb6bc22397b73ed296ebc5879ec00da00b6ebf63f1948bde4a0
Instruction Fuzzy Hash: 2541417190056DAEDF21AB64DC4DBEA7FB8BF44301F4002A5E908E60A0EBB48EC4DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00568733 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 79timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000001,00000000), ref: 00568788
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 0056879A

Strings

feclient.dll, xrefs: 00568762
%04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u, xrefs: 005687E3
crypt32.dll, xrefs: 00568758
%04hu-%02hu-%02huT%02hu:%02hu:%02huZ, xrefs: 00568771

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Time$InformationLocalSpecificSystemZone
String ID: %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u$%04hu-%02hu-%02huT%02hu:%02hu:%02huZ$crypt32.dll$feclient.dll
API String ID: 1772835396-1985132828
Opcode ID: 3b04c16fdca409bc9843de742fa545e306905dd36c91c94f00283e57d063adb4
Instruction ID: df5cf1330682f1ef97f1d59316b6019518c7fd05fecff3140c54412a499f1d74
Opcode Fuzzy Hash: 3b04c16fdca409bc9843de742fa545e306905dd36c91c94f00283e57d063adb4
Instruction Fuzzy Hash: CF212CA6900128BAE7209B9A9D05FBBB3FCFB58B01F10455AF954E6080E778AD84D770

Uniqueness

Uniqueness Score: -1.00%

Function 005260BA Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 005260EA
GetLastError.KERNEL32 ref: 005260F4

Strings

Failed to get the user name., xrefs: 0052611C
variable.cpp, xrefs: 00526112
Failed to set variant value., xrefs: 00526138

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLastNameUser
String ID: Failed to get the user name.$Failed to set variant value.$variable.cpp
API String ID: 2054405381-1522884404
Opcode ID: 1cef4f6f40fb30aed29e90055c8901ce03430eb5dcbd11b9feea23669888cf5e
Instruction ID: fcf28459e74d22d7dcfa375f4321f32289e42b42a3a02100b3858b259f17b894
Opcode Fuzzy Hash: 1cef4f6f40fb30aed29e90055c8901ce03430eb5dcbd11b9feea23669888cf5e
Instruction Fuzzy Hash: C201D631A00339A7D720EBA4EC0DAAB7FA8FF51720F000166FC14E7281EA749E4496A1

Uniqueness

Uniqueness Score: -1.00%

Function 0055FD20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000900,?,00000000,00000000,00000000,00000000,?,00000000,?,?,005603EC,?,00000000,?,?,00000001), ref: 0055FD3F
GetLastError.KERNEL32(?,005603EC,?,00000000,?,?,00000001,?,00525523,?,?,00000000,?,?,0052528D,00000002), ref: 0055FD4B
LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,005603EC,?,00000000,?,?,00000001,?,00525523,?,?), ref: 0055FDB3

Strings

logutil.cpp, xrefs: 0055FD69

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: logutil.cpp
API String ID: 1365068426-3545173039
Opcode ID: 98b18ea67313915b7e56b27bcf69704745dd60810bde03e5cd701bc63bf1bafb
Instruction ID: a25d5327a73ba4c2348e3d32533ab85d2aabbe62e10aff1715f577547863e2ba
Opcode Fuzzy Hash: 98b18ea67313915b7e56b27bcf69704745dd60810bde03e5cd701bc63bf1bafb
Instruction Fuzzy Hash: AA11BF32600219ABDB21AF94CD19FEF7F79FF54761F01402AFD0196160D7718A64E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00546945 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,005468EF,00000000,00000003), ref: 0054695C
GetLastError.KERNEL32(?,005468EF,00000000,00000003,00000000,?,?,?,?,?,?,?,?,?,00546CE1,?), ref: 00546966

Strings

Failed to set service start type., xrefs: 00546994
msuengine.cpp, xrefs: 0054698A

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ChangeConfigErrorLastService
String ID: Failed to set service start type.$msuengine.cpp
API String ID: 1456623077-1628545019
Opcode ID: 129477cdc3668e23ea1936d9f3dea477f3d8c4c02c8271155ce82d96a7290926
Instruction ID: 45c0124d2b51c9e88372877615b25d95313ee69e926b35ff9b38d4527dbf5bc0
Opcode Fuzzy Hash: 129477cdc3668e23ea1936d9f3dea477f3d8c4c02c8271155ce82d96a7290926
Instruction Fuzzy Hash: FBF0653374433576AB2026ADAC0DF877ED8EF027B0B114325FD2CE61D0DA658D4192E5

Uniqueness

Uniqueness Score: -1.00%

Function 0055A85E Relevance: 6.4, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

Strings

1#SNAN, xrefs: 0055BBA3
1#QNAN, xrefs: 0055BBAA
1#IND, xrefs: 0055BB9C
1#INF, xrefs: 0055BBB1

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID:
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 0-2761157908
Opcode ID: 938f4658c14a080780f4782b302485bfde2d87fed820704e78d33621d3a871a4
Instruction ID: bcf8567585c542820bf5431c3b929fd0a5d43fabf7d8938956fe19666201965e
Opcode Fuzzy Hash: 938f4658c14a080780f4782b302485bfde2d87fed820704e78d33621d3a871a4
Instruction Fuzzy Hash: 34C24871E046288BDB25CE28DD547A9BBB5FB84306F1446EBD80DE7240E774AE898F41

Uniqueness

Uniqueness Score: -1.00%

Function 0054E625 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0054E632
IsDebuggerPresent.KERNEL32(?,?,?,00000017,?), ref: 0054E6FA
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,00000017,?), ref: 0054E719
UnhandledExceptionFilter.KERNEL32(?,?,?,?,00000017,?), ref: 0054E723

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: ab2b36f75c49ce8ba4ce2b3dfde1203eafd684b4783c7ab6921517c8900c5ca1
Instruction ID: d608bb650f78ef64aff397fe5c16fb92eb29a00a1020878869a7e85510d1add7
Opcode Fuzzy Hash: ab2b36f75c49ce8ba4ce2b3dfde1203eafd684b4783c7ab6921517c8900c5ca1
Instruction Fuzzy Hash: 9F312875C012289BDB10DFA5D9896CDBBB8FF18304F1041AAE40DA7210E7714A89DF84

Uniqueness

Uniqueness Score: -1.00%

Function 0054E188 Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,0054E2A7,00580BF4,00000017), ref: 0054E18D
UnhandledExceptionFilter.KERNEL32(00580BF4,?,0054E2A7,00580BF4,00000017), ref: 0054E196
GetCurrentProcess.KERNEL32(C0000409,?,0054E2A7,00580BF4,00000017), ref: 0054E1A1
TerminateProcess.KERNEL32(00000000,?,0054E2A7,00580BF4,00000017), ref: 0054E1A8

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: f107d1d12b6d4461500bd633a4f3b2ad6b25a4f34d72a11f0f5e3445bd7c73e7
Instruction ID: a044408f02518ec03d24a580ea6453e2e8feab6dcd22d7eb8504712679984320
Opcode Fuzzy Hash: f107d1d12b6d4461500bd633a4f3b2ad6b25a4f34d72a11f0f5e3445bd7c73e7
Instruction Fuzzy Hash: 8CD0C935440108BBEB002BEAEC1CA4D3F6CBB14602F044000F309C7020CBB24485EB59

Uniqueness

Uniqueness Score: -1.00%

Function 0056962D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0056963E
GetSystemInfo.KERNEL32(?), ref: 00569659

Strings

D, xrefs: 0056964D

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 6209318961b2d5c6fe6c16e4006d3181e9503693b6e22e04026c07fa5917cffc
Instruction ID: fc6c789ed01e03feed04f8016c078017fe68af6b94aa7f82ba47fdbf05ee0505
Opcode Fuzzy Hash: 6209318961b2d5c6fe6c16e4006d3181e9503693b6e22e04026c07fa5917cffc
Instruction Fuzzy Hash: 8301FC36A0010A9BDF14DE64CC14BEE7FECBF84320F088125ED59DB140DB74E8518780

Uniqueness

Uniqueness Score: -1.00%

Function 00553BB0 Relevance: 4.6, APIs: 3, Instructions: 78COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00553CA8
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00553CB2
UnhandledExceptionFilter.KERNEL32(80003CDD,?,?,?,?,?,?), ref: 00553CBF

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: bfa6e016562b063a70ce88d5fba4c4a36098d5eca0bf6c2cf5f845afb1a965be
Instruction ID: 68d3f45f0f849d65fac47742f3d80319a906874f14b0aef17a00095602f00302
Opcode Fuzzy Hash: bfa6e016562b063a70ce88d5fba4c4a36098d5eca0bf6c2cf5f845afb1a965be
Instruction Fuzzy Hash: 0F31D474901219ABCB21DF68DC897CCBBB8BF18310F5045EAE80CA7251E7709F858F44

Uniqueness

Uniqueness Score: -1.00%

Function 0054E9A7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0054E9C0

Strings

, xrefs: 0054EB1D

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-3916222277
Opcode ID: 35482891899143a64f50a57fdb3717be3986ecc2270f17bf2130b538017dc2a0
Instruction ID: 88c4e0d7a2d6915dde52d46de77dc45afbd5eb57f43ce410e017a0862e3b7c7d
Opcode Fuzzy Hash: 35482891899143a64f50a57fdb3717be3986ecc2270f17bf2130b538017dc2a0
Instruction Fuzzy Hash: F1417D719003059BEB14CF6AD88A7AABFF4FB58318F24952BD805E7290E374AD44CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00557A87 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 00557B51

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 7e09001f84fb7551a3b61be2f6fcd8204a7d8a96722b3a1dd4dfe3fa1a3e0032
Instruction ID: 895680ee9694a01fe4bea86f6745307293b6188ec8bb9be3949ee889ac0e953a
Opcode Fuzzy Hash: 7e09001f84fb7551a3b61be2f6fcd8204a7d8a96722b3a1dd4dfe3fa1a3e0032
Instruction Fuzzy Hash: 9941077250021D6ECB209EB9DC5DDAB7BB8FB84315F1041AAFD0597180E6319E85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0056393B Relevance: 3.1, APIs: 2, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00563AC9: RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,0056396A,?), ref: 00563B3A

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0056398E
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0056399F

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AllocateCheckCloseInitializeMembershipToken
String ID:
API String ID: 2114926846-0
Opcode ID: 5b7b5002994bcb54a0ed069ec5596e9b074bb61236e1cd819211c6ca03abfa4f
Instruction ID: 32f8f1f0afe64fae7edcfc4471963ccdaf56fc35144ff09b4bc7d61fed6e520a
Opcode Fuzzy Hash: 5b7b5002994bcb54a0ed069ec5596e9b074bb61236e1cd819211c6ca03abfa4f
Instruction Fuzzy Hash: C1113C7190021EEBDB10DFA5DD89AAFBBB8FF18304F50082DA545A7181E7B09A48DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00564315 Relevance: 3.0, APIs: 2, Instructions: 44fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00548FFA,?,000002C0,00000000,00000000), ref: 00564350
FindClose.KERNEL32(00000000), ref: 0056435C

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ecc4074bbff9a98c7048a4544419ea6647a4e10e46d2dd38faf30c8a6285b71b
Instruction ID: 327b34038d81b4662a49fab410f9a3026fbbc37fd240f1f260329d4d1772dcd3
Opcode Fuzzy Hash: ecc4074bbff9a98c7048a4544419ea6647a4e10e46d2dd38faf30c8a6285b71b
Instruction Fuzzy Hash: 1101D672600108ABDB10EFA9DD8D9ABB7ACFBD6315F000165E908D3240D7305E8D8B64

Uniqueness

Uniqueness Score: -1.00%

Function 00552B21 Relevance: 2.7, Strings: 2, Instructions: 214COMMON

Download Yara Rule

Strings

comres.dll, xrefs: 00552CC8, 00552CE1, 00552D09, 00552D34
0, xrefs: 00552C91

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID:
String ID: 0$comres.dll
API String ID: 0-3030269839
Opcode ID: f7a880ec5967ec64a90054ca813bf1243ddeae79b496adee3d9f08ad155e7dd2
Instruction ID: 655b94d4e13a3880d244301c7b807803ea040cf1562d5df07044848619dacb55
Opcode Fuzzy Hash: f7a880ec5967ec64a90054ca813bf1243ddeae79b496adee3d9f08ad155e7dd2
Instruction Fuzzy Hash: BC518A6060074567DF384E68447ABBE2F94FB53353F18490BDC86DB693D205EE4D8352

Uniqueness

Uniqueness Score: -1.00%

Function 0055ED4C Relevance: 1.8, APIs: 1, Instructions: 269COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0055ED47,?,?,00000008,?,?,0055E9E7,00000000), ref: 0055EF79

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: bb240608bc5c837714f32304693fcffd0ac5c3ac29626c00c7a4f094621bf486
Instruction ID: 5f911c5da7aa1937aefb025f20bddcb792aa421144658b7740317e8d7b9b4f4c
Opcode Fuzzy Hash: bb240608bc5c837714f32304693fcffd0ac5c3ac29626c00c7a4f094621bf486
Instruction Fuzzy Hash: 37B14A311206089FD719CF28C49AB647FE0FF45366F298659EC9ACF2A1C735EA85CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0054E773 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002E77F,0054DEF8), ref: 0054E778

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b7abb56010f7467afa5899a42f6673871f3da66e707c9aba8bfc7d16589f455d
Instruction ID: 3948edae1855d8b6d7831983cf61482cbc5625f9e936d88419de27a3875381bd
Opcode Fuzzy Hash: b7abb56010f7467afa5899a42f6673871f3da66e707c9aba8bfc7d16589f455d
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0054F919 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abeb0e76ff622d87ab59e9bfce7afd191e544c4c5f523c5d032c530f6a12f1e6
Instruction ID: 1f0751c91932f541c3d1c7136c7fed91d92051a37733fc88089abf57500f17a0
Opcode Fuzzy Hash: abeb0e76ff622d87ab59e9bfce7afd191e544c4c5f523c5d032c530f6a12f1e6
Instruction Fuzzy Hash: 240205322091A30ACB2D4A7DD47017A7FB17A523B631E576EDCB7CB0D5EE20D968D620

Uniqueness

Uniqueness Score: -1.00%

Function 0055A3B0 Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb5ef6380223df80c09fbffff4406c54564286920eb9de1bd108dda9bf4439f2
Instruction ID: 34ee36362543ca4585031e0e0595171a2390424dc930c456d5da4feb1b789258
Opcode Fuzzy Hash: eb5ef6380223df80c09fbffff4406c54564286920eb9de1bd108dda9bf4439f2
Instruction Fuzzy Hash: 48022B71E002199FDF14CFA9C8906ADBBF1FF88315F25826AD919E7341E730AA45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00550662 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 2eab368c2b10d946fb19af3e56ab087dc6d6237fab729b7cff4305c6d33a0f1a
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 7FC182362051A309DB6D46B9D43413EBFA17EA27B231A675FDCB2CB1C5EE20D52CD620

Uniqueness

Uniqueness Score: -1.00%

Function 00550A97 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 3b9c282f28df8b743043002136a5e3cda4f8be98bbb29b51e92e8fd7b4b32502
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: B5C173362051A30ADB2D46B9D47413EFFA17A927B231A676FDCB2CB1D4EE20D52CD520

Uniqueness

Uniqueness Score: -1.00%

Function 0055022D Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: a2cc9486c98ae34b40eca9a1911ea622dbdf978b9cfe157417fdcae6cb8ba113
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 6CC164362051A30ADF6D46B9D43813EBFA17A917B371A676FDCB2CB0D4EE20D52C9610

Uniqueness

Uniqueness Score: -1.00%

Function 0054FE15 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: cb6c4d0b801e849029508b7247ea7ba7efd23e3fb5874d65fcef82e709d08a3b
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 18C1A9362050630ADF6D46BDD43817EBFA17A927B231A676ED8B3CB1D5EE20C528D610

Uniqueness

Uniqueness Score: -1.00%

Function 00552D50 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27ea883e320c7b797b04cbf2739f81bfe90ca0f44cd3a7b9a9cce592464bacd2
Instruction ID: 8f07efb7790d0d96462502c49e279180f97a0c505c31a5e8619e4ffa00b69337
Opcode Fuzzy Hash: 27ea883e320c7b797b04cbf2739f81bfe90ca0f44cd3a7b9a9cce592464bacd2
Instruction Fuzzy Hash: 9D61477120070A66DB38592888BBBBE6FA8FF93342F14091BEC47DB281D615AD4F8755

Uniqueness

Uniqueness Score: -1.00%

Function 0052FE26 Relevance: 81.0, APIs: 1, Strings: 45, Instructions: 476registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000101,?,?,00020006,00000000,?,?,?), ref: 00530409

Strings

ParentKeyName, xrefs: 0053017A, 0053018D
ModifyPath, xrefs: 0053021D, 00530233
EstimatedSize, xrefs: 00530385, 0053038A, 00530399
Failed to update resume mode., xrefs: 005303D6
Publisher, xrefs: 0053009C, 005300AF
/uninstall, xrefs: 005302DC
"%ls" %ls, xrefs: 005302ED
BundleTag, xrefs: 0052FFCA, 0052FFCF
QuietUninstallString, xrefs: 005302B5, 005302CB
"%ls" /modify, xrefs: 00530218
Failed to write update registration., xrefs: 0053034E
SystemComponent, xrefs: 00530290, 005302A3
Comments, xrefs: 005301A2, 005301B5
Failed to write software tags., xrefs: 0053032E
BundleUpgradeCode, xrefs: 0052FEE9, 0052FEF1
EngineVersion, xrefs: 0052FFEC, 0052FFF1
ParentDisplayName, xrefs: 0053015A, 0053016D
Contact, xrefs: 005301CA, 005301DD
%hs, xrefs: 0052FFE7
DisplayIcon, xrefs: 0053000A, 00530014
"%ls" /uninstall /quiet, xrefs: 005302B0
Failed to register the bundle dependency key., xrefs: 005303BC
NoElevateOnModify, xrefs: 0053023F, 00530252
BundleCachePath, xrefs: 0052FECE, 0052FED3
HelpTelephone, xrefs: 005300E8, 005300FB
UninstallString, xrefs: 005302F2, 00530308
BundleProviderKey, xrefs: 0052FFA9, 0052FFAE
Failed to create registration key., xrefs: 0052FEAE
%s,0, xrefs: 0053000F
/modify, xrefs: 005302E1, 005302E9
%hu.%hu.%hu.%hu, xrefs: 0052FF85
URLUpdateInfo, xrefs: 00530134, 00530147
URLInfoAbout, xrefs: 0053010E, 00530121
BundleVersion, xrefs: 0052FF61, 0052FF8A
Failed to cache bundle from path: %ls, xrefs: 0052FE81
NoModify, xrefs: 005301F3, 00530206
3.10.4.4718, xrefs: 0052FFE2
NoRemove, xrefs: 0053026B, 0053027E
BundlePatchCode, xrefs: 0052FF43, 0052FF4B
DisplayName, xrefs: 00530043, 00530056
HelpLink, xrefs: 005300C2, 005300D5
Failed to write %ls value., xrefs: 0053039A
BundleDetectCode, xrefs: 0052FF25, 0052FF2D
BundleAddonCode, xrefs: 0052FF07, 0052FF0F
DisplayVersion, xrefs: 00530069, 0053007C

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Close
String ID: /uninstall$"%ls" %ls$"%ls" /modify$"%ls" /uninstall /quiet$%hs$%hu.%hu.%hu.%hu$%s,0$/modify$3.10.4.4718$BundleAddonCode$BundleCachePath$BundleDetectCode$BundlePatchCode$BundleProviderKey$BundleTag$BundleUpgradeCode$BundleVersion$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EngineVersion$EstimatedSize$Failed to cache bundle from path: %ls$Failed to create registration key.$Failed to register the bundle dependency key.$Failed to update resume mode.$Failed to write %ls value.$Failed to write software tags.$Failed to write update registration.$HelpLink$HelpTelephone$ModifyPath$NoElevateOnModify$NoModify$NoRemove$ParentDisplayName$ParentKeyName$Publisher$QuietUninstallString$SystemComponent$URLInfoAbout$URLUpdateInfo$UninstallString
API String ID: 3535843008-3978993339
Opcode ID: 4204750fd44a15aebb0d6e2333c5da503bd3cfdd55ba91d303cb908c8432b8b6
Instruction ID: 94aa80358e213ed77059f88d18c4ce531fb123b066b1bf8f43b6454a8379f1b1
Opcode Fuzzy Hash: 4204750fd44a15aebb0d6e2333c5da503bd3cfdd55ba91d303cb908c8432b8b6
Instruction Fuzzy Hash: A3F19F31A40B26FBCF225A64DD26B6EBFA5BB00710F146A60FC05B62D1D771AD60B7C4

Uniqueness

Uniqueness Score: -1.00%

Function 0052834D Relevance: 61.6, APIs: 5, Strings: 30, Instructions: 331COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,80070490,?,?,?,?,?,?,?,=SR,0054BF87,?,?,?), ref: 0052837E
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,=SR,0054BF87,?,?,?,?,=SR,Chain), ref: 005286DB

Strings

Failed to get variable node count., xrefs: 005283B8
Variable, xrefs: 00528388
version, xrefs: 00528503
Initializing hidden variable '%ls', xrefs: 00528548
Initializing string variable '%ls' to value '%ls', xrefs: 005284F1
Attempt to set built-in variable value: %ls, xrefs: 0052869F
Failed to select variable nodes., xrefs: 0052839B
Failed to change variant type., xrefs: 005286B1
Value, xrefs: 0052843C
=SR, xrefs: 0052834D
Failed to get @Type., xrefs: 0052865F
Initializing version variable '%ls' to value '%ls', xrefs: 0052852A
Failed to get @Value., xrefs: 0052866D
Invalid value for @Type: %ls, xrefs: 0052864F
Hidden, xrefs: 00528406
Persisted, xrefs: 00528421
Failed to set variant encryption, xrefs: 00528674
variable.cpp, xrefs: 00528690
Failed to find variable value '%ls'., xrefs: 005286A9
Failed to get next node., xrefs: 005286CD
Failed to get @Id., xrefs: 005286C6
string, xrefs: 005284CE
Failed to set value of variable: %ls, xrefs: 0052867E
Failed to get @Persisted., xrefs: 005286B8
Type, xrefs: 0052847A
Failed to get @Hidden., xrefs: 005286BF
Initializing numeric variable '%ls' to value '%ls', xrefs: 005284B9
numeric, xrefs: 00528493
Failed to insert variable '%ls'., xrefs: 0052859D
Failed to set variant value., xrefs: 00528666

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: =SR$Attempt to set built-in variable value: %ls$Failed to change variant type.$Failed to find variable value '%ls'.$Failed to get @Hidden.$Failed to get @Id.$Failed to get @Persisted.$Failed to get @Type.$Failed to get @Value.$Failed to get next node.$Failed to get variable node count.$Failed to insert variable '%ls'.$Failed to select variable nodes.$Failed to set value of variable: %ls$Failed to set variant encryption$Failed to set variant value.$Hidden$Initializing hidden variable '%ls'$Initializing numeric variable '%ls' to value '%ls'$Initializing string variable '%ls' to value '%ls'$Initializing version variable '%ls' to value '%ls'$Invalid value for @Type: %ls$Persisted$Type$Value$Variable$numeric$string$variable.cpp$version
API String ID: 3168844106-1648266440
Opcode ID: d88256582cd4c8caecaa3348844c3b6b61f49a654110b48c92da2d59c6e49516
Instruction ID: 22e8f62c6e0274dbbd91f48ff369168e2b55dca9b06772478e373db19f26b496
Opcode Fuzzy Hash: d88256582cd4c8caecaa3348844c3b6b61f49a654110b48c92da2d59c6e49516
Instruction Fuzzy Hash: 90B1BC72D0222ABBCF119AD4EC09EBEBF74BF56710F104655F910B72D0CB70AA409B90

Uniqueness

Uniqueness Score: -1.00%

Function 00546A85 Relevance: 58.1, APIs: 7, Strings: 26, Instructions: 377COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,0053BBCA,00000007,?,?,?), ref: 00546AD9

Part of subcall function 005609BB: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00525D8F,00000000), ref: 005609CF
Part of subcall function 005609BB: GetProcAddress.KERNEL32(00000000), ref: 005609D6
Part of subcall function 005609BB: GetLastError.KERNEL32(?,?,?,00525D8F,00000000), ref: 005609ED

CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 00546EC9
CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 00546EDD

Strings

Failed to format MSU uninstall command., xrefs: 00546C42
Failed to allocate WUSA.exe path., xrefs: 00546B6C
Failed to ensure WU service was enabled to install MSU package., xrefs: 00546CE7
"%ls" "%ls" /quiet /norestart, xrefs: 00546C01
Failed to CreateProcess on path: %ls, xrefs: 00546D53
Failed to get action arguments for MSU package., xrefs: 00546B8F
SysNative\, xrefs: 00546B23
wusa.exe, xrefs: 00546B59
Failed to get process exit code., xrefs: 00546DE5
Failed to find Windows directory., xrefs: 00546B18
D, xrefs: 00546CF4
Failed to format MSU install command., xrefs: 00546C15
WixBundleExecutePackageCacheFolder, xrefs: 00546BC4, 00546EF5
2, xrefs: 00546D6C
Failed to determine WOW64 status., xrefs: 00546AEB
Failed to wait for executable to complete: %ls, xrefs: 00546E58
Failed to append SysNative directory., xrefs: 00546B36
Failed to find System32 directory., xrefs: 00546B4E
"%ls" /uninstall /kb:%ls /quiet /norestart, xrefs: 00546C2E
Failed to append log path to MSU command-line., xrefs: 00546C8D
msuengine.cpp, xrefs: 00546D46, 00546DDB, 00546E03
Failed to get cached path for package: %ls, xrefs: 00546BB5
Failed to append log switch to MSU command-line., xrefs: 00546C6F
Failed to build MSU path., xrefs: 00546BEE
/log:, xrefs: 00546C5B
Bootstrapper application aborted during MSU progress., xrefs: 00546E0D

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Handle$Close$AddressCurrentErrorLastModuleProcProcess
String ID: /log:$"%ls" "%ls" /quiet /norestart$"%ls" /uninstall /kb:%ls /quiet /norestart$2$Bootstrapper application aborted during MSU progress.$D$Failed to CreateProcess on path: %ls$Failed to allocate WUSA.exe path.$Failed to append SysNative directory.$Failed to append log path to MSU command-line.$Failed to append log switch to MSU command-line.$Failed to build MSU path.$Failed to determine WOW64 status.$Failed to ensure WU service was enabled to install MSU package.$Failed to find System32 directory.$Failed to find Windows directory.$Failed to format MSU install command.$Failed to format MSU uninstall command.$Failed to get action arguments for MSU package.$Failed to get cached path for package: %ls$Failed to get process exit code.$Failed to wait for executable to complete: %ls$SysNative\$WixBundleExecutePackageCacheFolder$msuengine.cpp$wusa.exe
API String ID: 1400713077-4261965642
Opcode ID: 2ee5827fcf8ad08d95a883d1c9398a1522ddc2d99f8e6d54eee2704cf03ed8c1
Instruction ID: d274d99315d4a45c44649f9e04d2f730d19da94b3950c9e63a94655367949021
Opcode Fuzzy Hash: 2ee5827fcf8ad08d95a883d1c9398a1522ddc2d99f8e6d54eee2704cf03ed8c1
Instruction Fuzzy Hash: A3D1AE70A4031AEBDF11AEE4DC85BEF7FB8BF05708F104025B605A21A1D7B09E54EB62

Uniqueness

Uniqueness Score: -1.00%

Function 005352E3 Relevance: 52.7, APIs: 17, Strings: 13, Instructions: 222filepipesleepCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,?,0056B4F0,?,00000000,?,0052442A,?,0056B4F0), ref: 00535304
GetCurrentProcessId.KERNEL32(?,0052442A,?,0056B4F0), ref: 0053530F
SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,0052442A,?,0056B4F0), ref: 00535346
ConnectNamedPipe.KERNEL32(?,00000000,?,0052442A,?,0056B4F0), ref: 0053535B
GetLastError.KERNEL32(?,0052442A,?,0056B4F0), ref: 00535365
Sleep.KERNEL32(00000064,?,0052442A,?,0056B4F0), ref: 00535396
SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,0052442A,?,0056B4F0), ref: 005353B9
WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,0052442A,?,0056B4F0), ref: 005353D4
WriteFile.KERNEL32(?,*DR,0056B4F0,00000000,00000000,?,0052442A,?,0056B4F0), ref: 005353EF
WriteFile.KERNEL32(?,comres.dll,00000004,feclient.dll,00000000,?,0052442A,?,0056B4F0), ref: 0053540A
ReadFile.KERNEL32(?,wininet.dll,00000004,feclient.dll,00000000,?,0052442A,?,0056B4F0), ref: 00535425
GetLastError.KERNEL32(?,0052442A,?,0056B4F0), ref: 0053547D
GetLastError.KERNEL32(?,0052442A,?,0056B4F0), ref: 005354B1
GetLastError.KERNEL32(?,0052442A,?,0056B4F0), ref: 005354E5
GetLastError.KERNEL32(?,0052442A,?,0056B4F0), ref: 0053557B

Strings

comres.dll, xrefs: 00535408
feclient.dll, xrefs: 00535402, 0053541D
Failed to set pipe to non-blocking., xrefs: 005355A5
Failed to write secret to pipe., xrefs: 0053550F
pipe.cpp, xrefs: 00535469, 0053549D, 005354D1, 00535505, 00535539, 0053556A, 0053559B
wininet.dll, xrefs: 00535423
Failed to write secret length to pipe., xrefs: 00535543
Failed to write our process id to pipe., xrefs: 005354DB
Failed to reset pipe to blocking., xrefs: 00535574
Failed to read ACK from pipe., xrefs: 005354A7
Failed to wait for child to connect to pipe., xrefs: 00535473
crypt32.dll, xrefs: 005353D2
*DR, xrefs: 005353EB

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
String ID: *DR$Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$comres.dll$crypt32.dll$feclient.dll$pipe.cpp$wininet.dll
API String ID: 2944378912-1472080421
Opcode ID: 1454a45bc26b3f6e5b505647779d544be21f8fa89715e19e2a487052c38d8c95
Instruction ID: 2666899627e6c7276429d8d916a8a3fd97d0fb6e5faacb877a4f3212b82e4d09
Opcode Fuzzy Hash: 1454a45bc26b3f6e5b505647779d544be21f8fa89715e19e2a487052c38d8c95
Instruction Fuzzy Hash: 6561D8B2E40725AAFB109AB99C45BAABFE8FF04750F114525FD05E7180E7B4CE409AE1

Uniqueness

Uniqueness Score: -1.00%

Function 005672F4 Relevance: 45.8, APIs: 13, Strings: 13, Instructions: 340COMMON

Download Yara Rule

APIs

Part of subcall function 005238D4: GetProcessHeap.KERNEL32(?,000001C7,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238E5
Part of subcall function 005238D4: RtlAllocateHeap.NTDLL(00000000,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238EC

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,generator,000000FF,?,?,?), ref: 00567407
SysFreeString.OLEAUT32(00000000), ref: 005675D0
SysFreeString.OLEAUT32(00000000), ref: 0056766D

Strings

(, xrefs: 005675AB
category, xrefs: 00567362, 0056750F
icon, xrefs: 0056741E
updated, xrefs: 005674AE
subtitle, xrefs: 00567476
generator, xrefs: 005673FA
link, xrefs: 0056739C, 0056757E
logo, xrefs: 0056745A
entry, xrefs: 0056737F, 00567548
author, xrefs: 00567345, 005674D6
title, xrefs: 00567492
@, xrefs: 00567576
atomutil.cpp, xrefs: 00567321, 00567657

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: String$FreeHeap$AllocateCompareProcess
String ID: ($@$atomutil.cpp$author$category$entry$generator$icon$link$logo$subtitle$title$updated
API String ID: 1555028553-2592408802
Opcode ID: c999fe9fbbe4383fe15f448e3188d298eaf217f0e06ec128854ec29db258a0c1
Instruction ID: 90e408cf7d6a4aa9fe784c92d99efca9d257cb0b7f0dc9055419dc0e90fb0321
Opcode Fuzzy Hash: c999fe9fbbe4383fe15f448e3188d298eaf217f0e06ec128854ec29db258a0c1
Instruction Fuzzy Hash: 45B1803194861ABBDB219B68CC45FAEBE74BB19724F200754F921B72D1DB70EE40DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00566FB7 Relevance: 45.8, APIs: 11, Strings: 15, Instructions: 298COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,00583C78,000000FF,?,?,?), ref: 0056707E
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,summary,000000FF), ref: 005670A3
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 005670C3
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,published,000000FF), ref: 005670DF
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,updated,000000FF), ref: 00567107
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,author,000000FF), ref: 00567123
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,category,000000FF), ref: 0056715C
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,content,000000FF), ref: 00567195

Part of subcall function 00566BF6: SysFreeString.OLEAUT32(00000000), ref: 00566D2F
Part of subcall function 00566BF6: SysFreeString.OLEAUT32(00000000), ref: 00566D71

SysFreeString.OLEAUT32(00000000), ref: 00567219
SysFreeString.OLEAUT32(00000000), ref: 005672C9

Strings

feclient.dll, xrefs: 005670B0
category, xrefs: 00566FFF, 0056714E
version.dll, xrefs: 00566FDD
summary, xrefs: 00567095
content, xrefs: 00567187
updated, xrefs: 005670F9
clbcatq.dll, xrefs: 005670EC
(, xrefs: 005671F4
link, xrefs: 0056701C, 005671C7
author, xrefs: 00566FE2, 00567115
title, xrefs: 005670B5
cabinet.dll, xrefs: 00566FFA
msi.dll, xrefs: 00566FE1
atomutil.cpp, xrefs: 005672B6
published, xrefs: 005670D1

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: String$Compare$Free
String ID: ($atomutil.cpp$author$cabinet.dll$category$clbcatq.dll$content$feclient.dll$link$msi.dll$published$summary$title$updated$version.dll
API String ID: 318886736-4294603148
Opcode ID: b635b48b7796aeb74e1908573f8ea3138b34f68e69fdafe155da2b01a0101769
Instruction ID: c747e5f346530672489a43d203bbb7e03bba57fd63e9781de22c741cca12d81f
Opcode Fuzzy Hash: b635b48b7796aeb74e1908573f8ea3138b34f68e69fdafe155da2b01a0101769
Instruction Fuzzy Hash: 2AA1AD3590821ABBDB209BA4CC51FADBF64BF08734F204355F921AB2D1D770EA50DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0054D22C Relevance: 44.0, APIs: 10, Strings: 15, Instructions: 276processCOMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0054D2A7
StringFromGUID2.OLE32(?,?,00000027), ref: 0054D2D0
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?,?,?), ref: 0054D3BC
GetLastError.KERNEL32(?,?,?,?), ref: 0054D3C6
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00000064,?,?,?,?), ref: 0054D45B
GetExitCodeProcess.KERNEL32(?,?), ref: 0054D485
GetLastError.KERNEL32(?,?,?,?), ref: 0054D493
GetLastError.KERNEL32(?,?,?,?), ref: 0054D4CB

Part of subcall function 0054D12C: WaitForSingleObject.KERNEL32(?,000000FF,753330B0,00000000,?,?,?,?,0054D439,?), ref: 0054D145
Part of subcall function 0054D12C: ReleaseMutex.KERNEL32(?,?,?,?,0054D439,?), ref: 0054D161
Part of subcall function 0054D12C: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0054D1A4
Part of subcall function 0054D12C: ReleaseMutex.KERNEL32(?), ref: 0054D1BB
Part of subcall function 0054D12C: SetEvent.KERNEL32(?), ref: 0054D1C4

CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 0054D580
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 0054D598

Strings

Failed to get netfx return code., xrefs: 0054D4C1
Failed to create netfx chainer guid., xrefs: 0054D2B4
Failed to CreateProcess on path: %ls, xrefs: 0054D3F5
Failed to allocate event name., xrefs: 0054D333
D, xrefs: 0054D3A1
Failed to create netfx chainer., xrefs: 0054D352
%ls /pipe %ls, xrefs: 0054D373
Failed to process netfx chainer message., xrefs: 0054D43F
NetFxChainer.cpp, xrefs: 0054D2E5, 0054D3EA, 0054D4B7, 0054D4EF
Failed to allocate section name., xrefs: 0054D311
Failed to convert netfx chainer guid into string., xrefs: 0054D2EF
NetFxSection.%ls, xrefs: 0054D2FD
Failed to wait for netfx chainer process to complete, xrefs: 0054D4F9
Failed to allocate netfx chainer arguments., xrefs: 0054D387
NetFxEvent.%ls, xrefs: 0054D31F

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLastWait$CloseCreateHandleMutexObjectProcessReleaseSingle$CodeEventExitFromMultipleObjectsStringUuid
String ID: %ls /pipe %ls$D$Failed to CreateProcess on path: %ls$Failed to allocate event name.$Failed to allocate netfx chainer arguments.$Failed to allocate section name.$Failed to convert netfx chainer guid into string.$Failed to create netfx chainer guid.$Failed to create netfx chainer.$Failed to get netfx return code.$Failed to process netfx chainer message.$Failed to wait for netfx chainer process to complete$NetFxChainer.cpp$NetFxEvent.%ls$NetFxSection.%ls
API String ID: 2531618940-1825855094
Opcode ID: 2dce185e8fc20451e43ade90bb06eb7a9d1a890cbb9e2e5831dc1828ace1d044
Instruction ID: d2d5d81b203010804639ac0c193737d5b766fc772d5f77c3ab942098cdc9a7a9
Opcode Fuzzy Hash: 2dce185e8fc20451e43ade90bb06eb7a9d1a890cbb9e2e5831dc1828ace1d044
Instruction Fuzzy Hash: 20A19F72E40329ABEB60ABA4CC45BEEBFB8BF44314F100065E909F7191D7759E449FA1

Uniqueness

Uniqueness Score: -1.00%

Function 0052A311 Relevance: 40.5, APIs: 6, Strings: 17, Instructions: 299registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,?,00000000,?,?,?,?,?), ref: 0052A666

Strings

Failed to format key string., xrefs: 0052A361
Failed to open registry key., xrefs: 0052A3E9
Failed to clear variable., xrefs: 0052A3D4
Unsupported registry key value type. Type = '%u', xrefs: 0052A506
Failed to query registry key value size., xrefs: 0052A454
Failed to allocate string buffer., xrefs: 0052A565
Failed to set variable., xrefs: 0052A629
Failed to query registry key value., xrefs: 0052A4D8
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 0052A418
Failed to change value type., xrefs: 0052A60D
Failed to format value string., xrefs: 0052A387
search.cpp, xrefs: 0052A44A, 0052A47D, 0052A4CE, 0052A5D1
RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 0052A63E
Failed to read registry value., xrefs: 0052A5F4
Failed to allocate memory registry value., xrefs: 0052A487
Registry key not found. Key = '%ls', xrefs: 0052A3B0
Failed to get expand environment string., xrefs: 0052A5DB

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Close
String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$search.cpp
API String ID: 3535843008-3124384294
Opcode ID: b384419dbd18a93a7e19db8059b4db6c010ac4f09adaf8129399c36b078631e0
Instruction ID: 2b34fbf79620a7a4853cdf01e4c715fd060eeabc30d82ce95bd86b90470baf07
Opcode Fuzzy Hash: b384419dbd18a93a7e19db8059b4db6c010ac4f09adaf8129399c36b078631e0
Instruction Fuzzy Hash: 65A1C876E4063ABBDF119AE4EC46AAE7E69BF05710F144521F900B71D0E771DE00DB92

Uniqueness

Uniqueness Score: -1.00%

Function 0054CC24 Relevance: 40.5, APIs: 12, Strings: 11, Instructions: 235synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 005238D4: GetProcessHeap.KERNEL32(?,000001C7,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238E5
Part of subcall function 005238D4: RtlAllocateHeap.NTDLL(00000000,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238EC

CreateEventW.KERNEL32(00000000,00000000,00000000,?,00000000,00000018,00000001,?,00000000,?,?,0054D34C,?,?,?), ref: 0054CC6A
GetLastError.KERNEL32(?,?,0054D34C,?,?,?), ref: 0054CC77
ReleaseMutex.KERNEL32(?), ref: 0054CEDF

Strings

%ls_send, xrefs: 0054CCA9
Failed to create mutex: %ls, xrefs: 0054CD79
%ls_mutex, xrefs: 0054CD18
Failed to allocate memory for NetFxChainer struct., xrefs: 0054CC50
Failed to create event: %ls, xrefs: 0054CD0A
Failed to MapViewOfFile for %ls., xrefs: 0054CE13
Failed to memory map cabinet file: %ls, xrefs: 0054CDCB
failed to allocate memory for event name, xrefs: 0054CCBD
NetFxChainer.cpp, xrefs: 0054CC46, 0054CC98, 0054CCFD, 0054CD6C, 0054CDBE, 0054CE06
failed to copy event name to shared memory structure., xrefs: 0054CE3D
failed to allocate memory for mutex name, xrefs: 0054CD2C

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Heap$AllocateCreateErrorEventLastMutexProcessRelease
String ID: %ls_mutex$%ls_send$Failed to MapViewOfFile for %ls.$Failed to allocate memory for NetFxChainer struct.$Failed to create event: %ls$Failed to create mutex: %ls$Failed to memory map cabinet file: %ls$NetFxChainer.cpp$failed to allocate memory for event name$failed to allocate memory for mutex name$failed to copy event name to shared memory structure.
API String ID: 3944734951-2991465304
Opcode ID: 9bcf240008029f9875cbf0941c7a73c7a05c198ed77e3bdfe0488b170c89167f
Instruction ID: 836bd58e1c50b6992ba954b04b2397c5eb5cd0dc047f6afe8b36090dd2a83589
Opcode Fuzzy Hash: 9bcf240008029f9875cbf0941c7a73c7a05c198ed77e3bdfe0488b170c89167f
Instruction Fuzzy Hash: F5710D72A81722BBE762AB698C49F9B7EE8FF15350F014125FC08EB291D7708D50C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 0052E936 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 231COMMON

Download Yara Rule

APIs

Part of subcall function 005631C7: VariantInit.OLEAUT32(?), ref: 005631DD
Part of subcall function 005631C7: SysAllocString.OLEAUT32(?), ref: 005631F9
Part of subcall function 005631C7: VariantClear.OLEAUT32(?), ref: 00563280
Part of subcall function 005631C7: SysFreeString.OLEAUT32(00000000), ref: 0056328B

CompareStringW.KERNEL32(0000007F,00000000,000000FF,000000FF,Detect,000000FF,?,0056CA64,?,?,Action,?,?,?,00000000,?), ref: 0052EA07
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,Upgrade,000000FF), ref: 0052EA51

Strings

comres.dll, xrefs: 0052EA1A
Failed to resize Upgrade code array in registration, xrefs: 0052EB29
Invalid value for @Action: %ls, xrefs: 0052EB46
version.dll, xrefs: 0052EA64
Upgrade, xrefs: 0052EA44
Action, xrefs: 0052E9C4
Failed to get next RelatedBundle element., xrefs: 0052EB64
Failed to get RelatedBundle element count., xrefs: 0052E98B
Failed to get @Id., xrefs: 0052EB56
Failed to get @Action., xrefs: 0052EB5D
Addon, xrefs: 0052EA8E
RelatedBundle, xrefs: 0052E944
Failed to get RelatedBundle nodes, xrefs: 0052E966
Detect, xrefs: 0052E9F8
Failed to resize Detect code array in registration, xrefs: 0052EB22
Failed to resize Patch code array in registration, xrefs: 0052EB37
cabinet.dll, xrefs: 0052EAAE
Failed to resize Addon code array in registration, xrefs: 0052EB30
Patch, xrefs: 0052EAD1

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: String$CompareVariant$AllocClearFreeInit
String ID: Action$Addon$Detect$Failed to get @Action.$Failed to get @Id.$Failed to get RelatedBundle element count.$Failed to get RelatedBundle nodes$Failed to get next RelatedBundle element.$Failed to resize Addon code array in registration$Failed to resize Detect code array in registration$Failed to resize Patch code array in registration$Failed to resize Upgrade code array in registration$Invalid value for @Action: %ls$Patch$RelatedBundle$Upgrade$cabinet.dll$comres.dll$version.dll
API String ID: 702752599-259800149
Opcode ID: 8f2ce7e4840c4fe133e95c22bc4540d86f10d7eb69c3196a105134495bc629c8
Instruction ID: fd0011228cc67bceda471f4ff08d7cbbcf357ee5b25690102475f2a609db2093
Opcode Fuzzy Hash: 8f2ce7e4840c4fe133e95c22bc4540d86f10d7eb69c3196a105134495bc629c8
Instruction Fuzzy Hash: 8971B131A45626BBCB20CB94DC46EAEBFB4FF06720F204255F916A76C1D730AE50DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00528E48 Relevance: 37.2, APIs: 8, Strings: 13, Instructions: 433COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,560056DB,00000001,?,00529801,?,00000000,00000000), ref: 00528E8D

Strings

NOT, xrefs: 005291A7
Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d., xrefs: 0052928D
@, xrefs: 00528E93
-, xrefs: 00528FF1
Failed to parse condition "%ls". Invalid version format, at position %d., xrefs: 0052910C
AND, xrefs: 00529187
condition.cpp, xrefs: 00528F5C, 00529027, 0052909C, 005290F9, 0052923A, 0052927A, 005292B5
Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d., xrefs: 005290AF
Failed to set symbol value., xrefs: 00528F35
Failed to parse condition "%ls". Unterminated literal at position %d., xrefs: 00528F6F
Failed to parse condition "%ls". Unexpected '~' operator at position %d., xrefs: 005292C8
Failed to parse condition "%ls". Constant too big, at position %d., xrefs: 0052924D
Failed to parse condition "%ls". Unexpected character at position %d., xrefs: 0052903A

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: StringType
String ID: -$@$AND$Failed to parse condition "%ls". Constant too big, at position %d.$Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d.$Failed to parse condition "%ls". Invalid version format, at position %d.$Failed to parse condition "%ls". Unexpected '~' operator at position %d.$Failed to parse condition "%ls". Unexpected character at position %d.$Failed to parse condition "%ls". Unterminated literal at position %d.$Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d.$Failed to set symbol value.$NOT$condition.cpp
API String ID: 4177115715-3640792234
Opcode ID: 16f00ae054a9751bd71e4bc4451d8576395362a276d26c9feb6102386802e21a
Instruction ID: a499a6d69a5994802e10fbe45357b37168962686997c95d358becb5f33b4f349
Opcode Fuzzy Hash: 16f00ae054a9751bd71e4bc4451d8576395362a276d26c9feb6102386802e21a
Instruction Fuzzy Hash: 6CE1EDB2600225EBEB11CF54E889BBA7F69FF56710F144885E9058F2C5C7B5CAC1DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 005344E7 Relevance: 36.9, APIs: 10, Strings: 11, Instructions: 181fileCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,8000FFFF,feclient.dll,?,005349FE,0056B4D8,?,feclient.dll,00000000,?,?), ref: 005344FE
ReadFile.KERNEL32(feclient.dll,feclient.dll,00000004,?,00000000,?,005349FE,0056B4D8,?,feclient.dll,00000000,?,?), ref: 0053451F
GetLastError.KERNEL32(?,005349FE,0056B4D8,?,feclient.dll,00000000,?,?), ref: 00534525
WriteFile.KERNEL32(feclient.dll,?,00000004,005349FE,00000000,?,005349FE,0056B4D8,?,feclient.dll,00000000,?,?), ref: 0053468E
GetLastError.KERNEL32(?,005349FE,0056B4D8,?,feclient.dll,00000000,?,?), ref: 00534698

Strings

Failed to inform parent process that child is running., xrefs: 005346C6
feclient.dll, xrefs: 005344ED, 0053451D, 0053451E, 005345B2, 00534637, 0053468D
Failed to read size of verification secret from parent pipe., xrefs: 00534553
pipe.cpp, xrefs: 00534549, 00534574, 005345DD, 00534615, 00534662, 005346BC, 005346FC
msasn1.dll, xrefs: 00534636
Failed to read verification process id from parent pipe., xrefs: 0053466C
Verification secret from parent is too big., xrefs: 00534580
Failed to allocate buffer for verification secret., xrefs: 0053459C
Verification process id from parent does not match., xrefs: 00534708
Verification secret from parent does not match., xrefs: 00534621
Failed to read verification secret from parent pipe., xrefs: 005345E7

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFileLast$CurrentProcessReadWrite
String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$feclient.dll$msasn1.dll$pipe.cpp
API String ID: 3008747291-452622383
Opcode ID: 0466db5c27064f7ded9de1f774fee9f42729833624371ff4020c0974dca46176
Instruction ID: d2f7f6b36fce20ccd7fd7546a034f04abab7cc5bb0ed34b72872ca39a7eab780
Opcode Fuzzy Hash: 0466db5c27064f7ded9de1f774fee9f42729833624371ff4020c0974dca46176
Instruction Fuzzy Hash: 9E511472E40326BBEB119AA4AC86FAB7FA8FF01710F114115FE05E7190D7749E01AAE1

Uniqueness

Uniqueness Score: -1.00%

Function 005425AF Relevance: 36.9, APIs: 3, Strings: 18, Instructions: 145COMMON

Download Yara Rule

Strings

burn, xrefs: 00542693
DetectCondition, xrefs: 005425C7
Repairable, xrefs: 0054264F
netfx4, xrefs: 005426C8
UninstallArguments, xrefs: 0054260B
Failed to get @UninstallArguments., xrefs: 0054261C
Failed to get @Repairable., xrefs: 00542668
Failed to get @RepairArguments., xrefs: 0054263E
Invalid protocol type: %ls, xrefs: 0054270F
Failed to parse exit codes., xrefs: 005426BF
InstallArguments, xrefs: 005425E9
Protocol, xrefs: 00542676
none, xrefs: 005426E9
Failed to parse command lines., xrefs: 0054273B
Failed to get @InstallArguments., xrefs: 005425FA
Failed to get @DetectCondition., xrefs: 005425D8
Failed to get @Protocol., xrefs: 00542727
RepairArguments, xrefs: 0054262D

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: DetectCondition$Failed to get @DetectCondition.$Failed to get @InstallArguments.$Failed to get @Protocol.$Failed to get @RepairArguments.$Failed to get @Repairable.$Failed to get @UninstallArguments.$Failed to parse command lines.$Failed to parse exit codes.$InstallArguments$Invalid protocol type: %ls$Protocol$RepairArguments$Repairable$UninstallArguments$burn$netfx4$none
API String ID: 760788290-1911311241
Opcode ID: ee47c1f77a65564a4d716dd2988474ca1926dac8f476206d81a88c1a439c407a
Instruction ID: 6ca1ab82c0cd0222ae070b4401b0a6d69503bb691b391995ce17a901d90f3dd5
Opcode Fuzzy Hash: ee47c1f77a65564a4d716dd2988474ca1926dac8f476206d81a88c1a439c407a
Instruction Fuzzy Hash: 3C415A32A84732B6CB2551609C46FEEBE5CBB90B38F614711FC18B72D1CB64AD00B292

Uniqueness

Uniqueness Score: -1.00%

Function 00541970 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 005238D4: GetProcessHeap.KERNEL32(?,000001C7,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238E5
Part of subcall function 005238D4: RtlAllocateHeap.NTDLL(00000000,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238EC

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,success,000000FF,?,Type,00000000,?,?,00000000,?,00000001,?), ref: 00541A77
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,error,000000FF), ref: 00541A95

Strings

scheduleReboot, xrefs: 00541AA4
Failed to allocate memory for exit code structs., xrefs: 00541A02
ExitCode, xrefs: 0054197E
Failed to get @Code., xrefs: 00541B57
forceReboot, xrefs: 00541AC2
Failed to select exit code nodes., xrefs: 0054199D
error, xrefs: 00541A88
Failed to get next node., xrefs: 00541B7D
Failed to get exit code node count., xrefs: 005419C2
exeengine.cpp, xrefs: 005419F8
Code, xrefs: 00541AE4
Invalid exit code type: %ls, xrefs: 00541B66
Failed to parse @Code value: %ls, xrefs: 00541B50
Type, xrefs: 00541A4F
Failed to get @Type., xrefs: 00541B76
success, xrefs: 00541A68

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: Code$ExitCode$Failed to allocate memory for exit code structs.$Failed to get @Code.$Failed to get @Type.$Failed to get exit code node count.$Failed to get next node.$Failed to parse @Code value: %ls$Failed to select exit code nodes.$Invalid exit code type: %ls$Type$error$exeengine.cpp$forceReboot$scheduleReboot$success
API String ID: 2664528157-1714101571
Opcode ID: f464988d7b1b19bd453dee4b7fede98dea183718856e904463eefc0883f58bcf
Instruction ID: b47a15db106cc3eb1f3a391f56952ca43ea7c012b59d0ecf110ebdcefb23a39d
Opcode Fuzzy Hash: f464988d7b1b19bd453dee4b7fede98dea183718856e904463eefc0883f58bcf
Instruction Fuzzy Hash: CE610470A0161ABBDB109B54CC45EEEBFB5FF40724F208255F424AB2D1EB709E80E798

Uniqueness

Uniqueness Score: -1.00%

Function 0052567D Relevance: 33.5, APIs: 3, Strings: 19, Instructions: 476stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000002C0,00000100,00000100,00000000,00000000,?,005299BB,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,00000100), ref: 005256A2
lstrlenW.KERNEL32(00000000,?,005299BB,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,00000100), ref: 005256AC
LeaveCriticalSection.KERNEL32(000002C0,00000000,00000000,00000000,00000000,00000000,00000001,?,005299BB,000002C0,?,00000000,00000000,000002C0,00000100,000002C0), ref: 00525B56

Strings

Failed to get variable name., xrefs: 00525998
Failed to determine variable visibility: '%ls'., xrefs: 00525946
Failed to set record format string., xrefs: 005259DD
variable.cpp, xrefs: 0052590A, 0052592B, 00525984, 005259D0, 00525A60, 00525A95, 00525B0D
Failed to allocate record., xrefs: 00525917
Failed to set variable value., xrefs: 0052596D
Failed to format placeholder string., xrefs: 00525963
Failed to copy string., xrefs: 00525B3A
Failed to format record., xrefs: 00525B1A
Failed to append placeholder., xrefs: 00525959
Failed to allocate variable array., xrefs: 00525991
Failed to allocate string., xrefs: 00525AD1
Failed to reallocate variable array., xrefs: 00525938
*****, xrefs: 00525820
[%d], xrefs: 0052586F
Failed to allocate buffer for format string., xrefs: 005256CA
Failed to get formatted length., xrefs: 00525A6D
Failed to append string., xrefs: 00525728
Failed to set record string., xrefs: 00525AA2

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeavelstrlen
String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$variable.cpp
API String ID: 3224049430-2050445661
Opcode ID: a1f39969c7f933c56685c48276dcc1585309bd85a5cfe8eebcfb0b642669c65b
Instruction ID: 4f3bd5b6a0dee77c11160bb4fc6e88c986e527041ab04cc77d86e96267bef648
Opcode Fuzzy Hash: a1f39969c7f933c56685c48276dcc1585309bd85a5cfe8eebcfb0b642669c65b
Instruction Fuzzy Hash: 53F1D271E0063AEBDB109FA49845AAF7FB8FF45750F15452ABD05E7280E7749E40CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0052F09D Relevance: 33.4, APIs: 3, Strings: 16, Instructions: 180registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005639CD: GetVersionExW.KERNEL32(?,?,00000000,?), ref: 00563A1A

RegCloseKey.ADVAPI32(00000000,?,00020006,00020006,00000000,?,?,00000002,00000000,?,00000000,00000001,00000002), ref: 0052F2CB

Part of subcall function 00561344: RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,?,0052F11A,00000005,Resume,?,?,?,00000002,00000000), ref: 00561359

Strings

"%ls" /%ls, xrefs: 0052F172
Failed to write Installed value., xrefs: 0052F143
registration.cpp, xrefs: 0052F250, 0052F29D
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0052F0FA
Installed, xrefs: 0052F132
Resume, xrefs: 0052F10F
Failed to delete run key value., xrefs: 0052F25A
burn.runonce, xrefs: 0052F167
Failed to format resume command line for RunOnce., xrefs: 0052F186
Failed to delete resume command line value., xrefs: 0052F2A7
Failed to write resume command line value., xrefs: 0052F1EA
Failed to create run key., xrefs: 0052F1AA
Failed to write Resume value., xrefs: 0052F120
Failed to write run key value., xrefs: 0052F1C8
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 0052F0AE
BundleResumeCommandLine, xrefs: 0052F1D5, 0052F267

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseValueVersion
String ID: "%ls" /%ls$BundleResumeCommandLine$Failed to create run key.$Failed to delete resume command line value.$Failed to delete run key value.$Failed to format resume command line for RunOnce.$Failed to write Installed value.$Failed to write Resume value.$Failed to write resume command line value.$Failed to write run key value.$Installed$Resume$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce$burn.runonce$registration.cpp
API String ID: 2348918689-3140388177
Opcode ID: b903ce5ebcac1b671b52ef007bccec2d105accdad7bf581485e68e325dec6f90
Instruction ID: faf83acfeeb60b3f7b45d6c4abeaae7cecc89c80942c6e45cf322bc3b4afb060
Opcode Fuzzy Hash: b903ce5ebcac1b671b52ef007bccec2d105accdad7bf581485e68e325dec6f90
Instruction Fuzzy Hash: 0B51D036A4063AFADF225EA4FC46AAA7EB8BF02750F004535F905F61D0D770DD10A794

Uniqueness

Uniqueness Score: -1.00%

Function 00567FEC Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 309COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,00000000,000002C0), ref: 00568019
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF), ref: 00568034
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,upgrade,000000FF), ref: 005680D7
CompareStringW.KERNEL32(0000007F,00000000,00700079,000000FF,version,000000FF,00000018,0056B508,00000000), ref: 00568116
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exclusive,000000FF), ref: 00568169
CompareStringW.KERNEL32(0000007F,00000000,0056B508,000000FF,true,000000FF), ref: 00568187
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 005681BF
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,enclosure,000000FF), ref: 00568303

Strings

apuputil.cpp, xrefs: 00568226
upgrade, xrefs: 005680C9
true, xrefs: 00568179
application, xrefs: 00568026
type, xrefs: 0056805F
exclusive, xrefs: 0056815B
version, xrefs: 00568108, 005681B1
http://appsyndication.org/2006/appsyn, xrefs: 0056800C
enclosure, xrefs: 005682F1

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CompareString
String ID: application$apuputil.cpp$enclosure$exclusive$http://appsyndication.org/2006/appsyn$true$type$upgrade$version
API String ID: 1825529933-3037633208
Opcode ID: 1a765bb3c88700183f8bcd0275bcbf973fc034b71aaed6f04959c538d2f999dd
Instruction ID: 77b2c54d5c27d0dd5156279533279e3e27a9bafda89b28dc2552f06e9646cf72
Opcode Fuzzy Hash: 1a765bb3c88700183f8bcd0275bcbf973fc034b71aaed6f04959c538d2f999dd
Instruction Fuzzy Hash: 4FB17D71A44606ABDB209F58CC85F6A7BB6BB45730F244B55F939EB2D1DBB0E844CB00

Uniqueness

Uniqueness Score: -1.00%

Function 005676A1 Relevance: 31.7, APIs: 8, Strings: 10, Instructions: 210COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,rel,000000FF,?,?,?,00000000), ref: 00567703
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,href,000000FF), ref: 00567727
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,length,000000FF), ref: 00567746
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 0056777D
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,type,000000FF), ref: 00567798
SysFreeString.OLEAUT32(00000000), ref: 005677C3
SysFreeString.OLEAUT32(00000000), ref: 00567842
SysFreeString.OLEAUT32(00000000), ref: 0056788E

Strings

comres.dll, xrefs: 00567750
feclient.dll, xrefs: 00567734
length, xrefs: 00567739
rel, xrefs: 005676F4
version.dll, xrefs: 005677A7
title, xrefs: 00567770
msasn1.dll, xrefs: 0056787C
type, xrefs: 0056778B
href, xrefs: 0056771A
msi.dll, xrefs: 0056782A

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: String$Compare$Free
String ID: comres.dll$feclient.dll$href$length$msasn1.dll$msi.dll$rel$title$type$version.dll
API String ID: 318886736-3944986760
Opcode ID: 273d97e286dc07678807f95e077d0cbb01c01e168bf40314c8a5190d51bea6bb
Instruction ID: a7b37f2783fa0876690257429d02ba251ff1956038b397f4c9be1c8eeddcb6dd
Opcode Fuzzy Hash: 273d97e286dc07678807f95e077d0cbb01c01e168bf40314c8a5190d51bea6bb
Instruction Fuzzy Hash: BE712D3590411DFBDB25DB94CC88EAEBFB8FF08724F2046A4E925A7191D7319E44DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0053E177 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0053E05E: LoadBitmapW.USER32(?,00000001), ref: 0053E094
Part of subcall function 0053E05E: GetLastError.KERNEL32 ref: 0053E0A0

LoadCursorW.USER32(00000000,00007F00), ref: 0053E1D8
RegisterClassW.USER32(?), ref: 0053E1EC
GetLastError.KERNEL32 ref: 0053E1F7
UnregisterClassW.USER32(WixBurnSplashScreen,?), ref: 0053E2FC
DeleteObject.GDI32(00000000), ref: 0053E30B

Strings

splashscreen.cpp, xrefs: 0053E21B, 0053E284
Failed to register window., xrefs: 0053E225
WixBurnSplashScreen, xrefs: 0053E1E5, 0053E2F7
Failed to create window., xrefs: 0053E28E
Failed to load splash screen., xrefs: 0053E1B0
Unexpected return value from message pump., xrefs: 0053E2E6

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ClassErrorLastLoad$BitmapCursorDeleteObjectRegisterUnregister
String ID: Failed to create window.$Failed to load splash screen.$Failed to register window.$Unexpected return value from message pump.$WixBurnSplashScreen$splashscreen.cpp
API String ID: 164797020-2188509422
Opcode ID: 1f63a015da8b22246c3e8063c5546d93b4dd3ab02caa7754cf1e270684a96ed1
Instruction ID: 7eb6cba9d0588c78395e4a38e5d70356e37b4f8c25f8bb4d0940234ce7c8c4cf
Opcode Fuzzy Hash: 1f63a015da8b22246c3e8063c5546d93b4dd3ab02caa7754cf1e270684a96ed1
Instruction Fuzzy Hash: 5141AD76A00219BFEB119BA8EC4AAAABBF9FF04310F100525F905E71A0D7709D44D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00549BB3 Relevance: 30.0, APIs: 4, Strings: 13, Instructions: 230threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000001,?,00000000,000000FF,00000001,00000000,00000000,?,0054BA53,00000001), ref: 00549C18
GetLastError.KERNEL32(?,0054BA53,00000001), ref: 00549D88
GetExitCodeThread.KERNEL32(00000001,00000000,?,0054BA53,00000001), ref: 00549DC8
GetLastError.KERNEL32(?,0054BA53,00000001), ref: 00549DD2

Strings

Failed to load compatible package on per-machine package., xrefs: 00549D2E
Cache thread exited unexpectedly., xrefs: 00549E14
Failed to execute MSI package., xrefs: 00549C78
Failed to wait for cache check-point., xrefs: 00549DB9
Failed to execute dependency action., xrefs: 00549D08
Failed to execute package provider registration action., xrefs: 00549CE9
apply.cpp, xrefs: 00549DAC, 00549DF6
Failed to execute MSP package., xrefs: 00549C9D
Failed to execute compatible package action., xrefs: 00549D45
Failed to get cache thread exit code., xrefs: 00549E03
Failed to execute EXE package., xrefs: 00549C4F
Invalid execute action., xrefs: 00549E23
Failed to execute MSU package., xrefs: 00549CCD

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast$CodeExitMultipleObjectsThreadWait
String ID: Cache thread exited unexpectedly.$Failed to execute EXE package.$Failed to execute MSI package.$Failed to execute MSP package.$Failed to execute MSU package.$Failed to execute compatible package action.$Failed to execute dependency action.$Failed to execute package provider registration action.$Failed to get cache thread exit code.$Failed to load compatible package on per-machine package.$Failed to wait for cache check-point.$Invalid execute action.$apply.cpp
API String ID: 3703294532-2662572847
Opcode ID: 73479a318e50e7c7e61d43a0bc6dc4b2c53e01f43bb21f1391484057fb02d828
Instruction ID: ef15b11414551e1cbfc85d86e8e7f7f0cca32596f3a19e180810ed8eb5a4e959
Opcode Fuzzy Hash: 73479a318e50e7c7e61d43a0bc6dc4b2c53e01f43bb21f1391484057fb02d828
Instruction Fuzzy Hash: 9F714B71A4122AEFDB14DB64D94AAEFBFF8FB48714F104569B805E7240D2709E01ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 0054CA34 Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 173processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(75328FB0,00000002,00000000), ref: 0054CA40

Part of subcall function 00534B96: UuidCreate.RPCRT4(?), ref: 00534BC9

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000001,08000000,00000000,00000000,?,005421A5,?,?,00000000,?,?,?), ref: 0054CB1E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?), ref: 0054CB28
GetProcessId.KERNEL32(005421A5,?,?,00000000,?,?,?,?), ref: 0054CB60

Part of subcall function 005352E3: lstrlenW.KERNEL32(?,?,00000000,?,0056B4F0,?,00000000,?,0052442A,?,0056B4F0), ref: 00535304
Part of subcall function 005352E3: GetCurrentProcessId.KERNEL32(?,0052442A,?,0056B4F0), ref: 0053530F
Part of subcall function 005352E3: SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,0052442A,?,0056B4F0), ref: 00535346
Part of subcall function 005352E3: ConnectNamedPipe.KERNEL32(?,00000000,?,0052442A,?,0056B4F0), ref: 0053535B
Part of subcall function 005352E3: GetLastError.KERNEL32(?,0052442A,?,0056B4F0), ref: 00535365
Part of subcall function 005352E3: Sleep.KERNEL32(00000064,?,0052442A,?,0056B4F0), ref: 00535396
Part of subcall function 005352E3: SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,0052442A,?,0056B4F0), ref: 005353B9
Part of subcall function 005352E3: WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,0052442A,?,0056B4F0), ref: 005353D4
Part of subcall function 005352E3: WriteFile.KERNEL32(?,*DR,0056B4F0,00000000,00000000,?,0052442A,?,0056B4F0), ref: 005353EF
Part of subcall function 005352E3: WriteFile.KERNEL32(?,comres.dll,00000004,feclient.dll,00000000,?,0052442A,?,0056B4F0), ref: 0053540A

Part of subcall function 00560917: WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,?,00524E16,?,000000FF,?,?,?,?,?,00000000,?,?), ref: 00560927
Part of subcall function 00560917: GetLastError.KERNEL32(?,?,00524E16,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 00560935

CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,0054C992,?,?,?,?,?,00000000,?,?,?,?), ref: 0054CBE4
CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,0054C992,?,?,?,?,?,00000000,?,?,?,?), ref: 0054CBF3
CloseHandle.KERNEL32(00000000,?,?,000000FF,00000000,?,0054C992,?,?,?,?,?,00000000,?,?,?), ref: 0054CC0A

Strings

%ls -%ls %ls %ls %u, xrefs: 0054CAE3
burn.embedded, xrefs: 0054CADB
Failed to wait for embedded process to connect to pipe., xrefs: 0054CB82
Failed to create embedded process at path: %ls, xrefs: 0054CB56
Failed to wait for embedded executable: %ls, xrefs: 0054CBC7
Failed to process messages from embedded message., xrefs: 0054CBA7
Failed to create embedded pipe name and client token., xrefs: 0054CAA3
embedded.cpp, xrefs: 0054CB49
Failed to allocate embedded command., xrefs: 0054CAF7
Failed to create embedded pipe., xrefs: 0054CACA

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Handle$Process$CloseErrorFileLastNamedPipeWrite$CreateCurrentState$ConnectObjectSingleSleepUuidWaitlstrlen
String ID: %ls -%ls %ls %ls %u$Failed to allocate embedded command.$Failed to create embedded pipe name and client token.$Failed to create embedded pipe.$Failed to create embedded process at path: %ls$Failed to process messages from embedded message.$Failed to wait for embedded executable: %ls$Failed to wait for embedded process to connect to pipe.$burn.embedded$embedded.cpp
API String ID: 875070380-3803182736
Opcode ID: 55067916f7de532f1d4402be432a8ad9a8a2a9db7b2c7f59027082bc0c8f3b27
Instruction ID: 8deb4a3f34f654a0d68ca3ca4de903d0a325a42a459abdf2e202671fff99ae45
Opcode Fuzzy Hash: 55067916f7de532f1d4402be432a8ad9a8a2a9db7b2c7f59027082bc0c8f3b27
Instruction Fuzzy Hash: B6516A72D4122ABBDF51EAA4DC4AFEEBFB8FB44710F104121FA00B6290D7719A459B91

Uniqueness

Uniqueness Score: -1.00%

Function 00567E36 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 153stringCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,msi.dll,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,00000000,?,00568320,00000001,?), ref: 00567E56
CompareStringW.KERNEL32(0000007F,00000000,digest,000000FF,002E0069,000000FF,?,00568320,00000001,?), ref: 00567E71
CompareStringW.KERNEL32(0000007F,00000000,name,000000FF,002E0069,000000FF,?,00568320,00000001,?), ref: 00567E8C
CompareStringW.KERNEL32(0000007F,00000000,algorithm,000000FF,?,000000FF,?,00568320,00000001,?), ref: 00567EF8
CompareStringW.KERNEL32(0000007F,00000001,md5,000000FF,?,000000FF,?,00568320,00000001,?), ref: 00567F1C
CompareStringW.KERNEL32(0000007F,00000001,sha1,000000FF,?,000000FF,?,00568320,00000001,?), ref: 00567F40
CompareStringW.KERNEL32(0000007F,00000001,sha256,000000FF,?,000000FF,?,00568320,00000001,?), ref: 00567F60
lstrlenW.KERNEL32(006C0064,?,00568320,00000001,?), ref: 00567F7B

Strings

apuputil.cpp, xrefs: 00567F93
sha256, xrefs: 00567F57
algorithm, xrefs: 00567EEF
http://appsyndication.org/2006/appsyn, xrefs: 00567E49
sha1, xrefs: 00567F37
msi.dll, xrefs: 00567E50
md5, xrefs: 00567F13
name, xrefs: 00567E83
digest, xrefs: 00567E68

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CompareString$lstrlen
String ID: algorithm$apuputil.cpp$digest$http://appsyndication.org/2006/appsyn$md5$msi.dll$name$sha1$sha256
API String ID: 1657112622-2492263259
Opcode ID: 89ced0037551cf1382f652b4aa5be10a5ccc297b276fb1c35eaebe0892708fc7
Instruction ID: 04d1e463a3fc6909877b02d6d6b37bd68db5e6b837544530357051463523fb2d
Opcode Fuzzy Hash: 89ced0037551cf1382f652b4aa5be10a5ccc297b276fb1c35eaebe0892708fc7
Instruction Fuzzy Hash: 8F51AF3168C216BBEB204E14CC45F22BE65BB19738F204750FA34AB2E4C7B1EC80D790

Uniqueness

Uniqueness Score: -1.00%

Function 0052EBB2 Relevance: 28.2, APIs: 2, Strings: 14, Instructions: 173COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 0052ED40

Part of subcall function 005238D4: GetProcessHeap.KERNEL32(?,000001C7,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238E5
Part of subcall function 005238D4: RtlAllocateHeap.NTDLL(00000000,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238EC

SysFreeString.OLEAUT32(?), ref: 0052ECF8

Strings

Filename, xrefs: 0052EC73
registration.cpp, xrefs: 0052EC35
Failed to get @Filename., xrefs: 0052ED9D
Path, xrefs: 0052ECA6
Failed to get software tag count., xrefs: 0052EC07
Failed to get @Regid., xrefs: 0052ED93
Failed to convert SoftwareTag text to UTF-8, xrefs: 0052ED75
SoftwareTag, xrefs: 0052EBC1
Failed to select software tag nodes., xrefs: 0052EBE2
Regid, xrefs: 0052EC8E
Failed to get next node., xrefs: 0052EDA7
Failed to get SoftwareTag text., xrefs: 0052ED7F
Failed to allocate memory for software tag structs., xrefs: 0052EC3F
Failed to get @Path., xrefs: 0052ED89

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Failed to allocate memory for software tag structs.$Failed to convert SoftwareTag text to UTF-8$Failed to get @Filename.$Failed to get @Path.$Failed to get @Regid.$Failed to get SoftwareTag text.$Failed to get next node.$Failed to get software tag count.$Failed to select software tag nodes.$Filename$Path$Regid$SoftwareTag$registration.cpp
API String ID: 336948655-1068704183
Opcode ID: 50f81abbcc1cf83e221a954763b1a053e676e78860dd03431a8135d1ce9c51cc
Instruction ID: b3ecd127ff9f7c8dcbd9a49bd95af03406cd6e0942c6b8806ec8b9dab7dc848a
Opcode Fuzzy Hash: 50f81abbcc1cf83e221a954763b1a053e676e78860dd03431a8135d1ce9c51cc
Instruction Fuzzy Hash: 9851C335A01739ABDB219F98E896EAEBF74BF02710F54456DF905AB280C770DE009790

Uniqueness

Uniqueness Score: -1.00%

Function 00534933 Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 155sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?), ref: 0053498D
GetLastError.KERNEL32 ref: 0053499B
Sleep.KERNEL32(00000064), ref: 005349BF

Strings

feclient.dll, xrefs: 005349F2, 00534A8D, 00534AA1, 00534AE5
\\.\pipe\%ls.Cache, xrefs: 00534A20
pipe.cpp, xrefs: 005349D8, 00534ADB
Failed to allocate name of parent cache pipe., xrefs: 00534A34
Failed to verify parent pipe: %ls, xrefs: 00534A07
\\.\pipe\%ls, xrefs: 00534945
Failed to open companion process with PID: %u, xrefs: 00534AE7
Failed to allocate name of parent pipe., xrefs: 00534959
Failed to open parent pipe: %ls, xrefs: 005349E5

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CreateErrorFileLastSleep
String ID: Failed to allocate name of parent cache pipe.$Failed to allocate name of parent pipe.$Failed to open companion process with PID: %u$Failed to open parent pipe: %ls$Failed to verify parent pipe: %ls$\\.\pipe\%ls$\\.\pipe\%ls.Cache$feclient.dll$pipe.cpp
API String ID: 408151869-3212458075
Opcode ID: 136fcaf45a2a5ca36a73dc76656747e9fc65f764109a79ca68bf1cb08450da6e
Instruction ID: 9fd55e22b74bf9f2f73265a788a97b2a04912cf20e042cb3e07cacfc37dcb7f6
Opcode Fuzzy Hash: 136fcaf45a2a5ca36a73dc76656747e9fc65f764109a79ca68bf1cb08450da6e
Instruction Fuzzy Hash: B641C536980731BBEB2156A49C09B6B7F98BF00760F114221FD15F7190D775AE50EED4

Uniqueness

Uniqueness Score: -1.00%

Function 0052F410 Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 152registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00530348,InstallerVersion,InstallerVersion,00000000,00530348,InstallerName,InstallerName,00000000,00530348,Date,InstalledDate,00000000,00530348,LogonUser), ref: 0052F5BE

Part of subcall function 00561392: RegSetValueExW.ADVAPI32(00020006,00020006,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,0052F1C2,00000000,?,00020006), ref: 005613C5

Strings

Failed to create the key for update registration., xrefs: 0052F45E
ReleaseType, xrefs: 0052F515, 0052F51A, 0052F529
Publisher, xrefs: 0052F4CA, 0052F4DD
PublishingGroup, xrefs: 0052F4F2, 0052F505
Date, xrefs: 0052F554
InstalledBy, xrefs: 0052F52F, 0052F548
InstallerVersion, xrefs: 0052F58C, 0052F591, 0052F592, 0052F5A2
LogonUser, xrefs: 0052F534
InstallerName, xrefs: 0052F56F, 0052F574, 0052F575, 0052F585
InstalledDate, xrefs: 0052F54F, 0052F568
Failed to get the formatted key path for update registration., xrefs: 0052F432
PackageVersion, xrefs: 0052F4AA, 0052F4BD
ThisVersionInstalled, xrefs: 0052F46A, 0052F47D
Failed to write %ls value., xrefs: 0052F5A7
PackageName, xrefs: 0052F48A, 0052F49D

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseValue
String ID: Date$Failed to create the key for update registration.$Failed to get the formatted key path for update registration.$Failed to write %ls value.$InstalledBy$InstalledDate$InstallerName$InstallerVersion$LogonUser$PackageName$PackageVersion$Publisher$PublishingGroup$ReleaseType$ThisVersionInstalled
API String ID: 3132538880-2703781546
Opcode ID: 905f787b9e178d8a46a432f78842664c7ac637ad02c5b0c91caba257a51a3363
Instruction ID: fb1052936a6681f8110b6d7c59279b9d31a0858ff0a4b9ceac79c018e2007660
Opcode Fuzzy Hash: 905f787b9e178d8a46a432f78842664c7ac637ad02c5b0c91caba257a51a3363
Instruction Fuzzy Hash: 09414F31A41636BBCB225A54FC0AE7E7E75BF42710F118574B805B7291D7609E10F7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0054678F Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 150serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,00000000,?,?,?,?,?,?,?,?,00546CE1,?), ref: 005467C8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00546CE1,?,?,?), ref: 005467D5
OpenServiceW.ADVAPI32(00000000,wuauserv,00000027,?,?,?,?,?,?,?,?,00546CE1,?,?,?), ref: 0054681D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00546CE1,?,?,?), ref: 00546829
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,00546CE1,?,?,?), ref: 00546863
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00546CE1,?,?,?), ref: 0054686D
CloseServiceHandle.ADVAPI32(00000000), ref: 00546924
CloseServiceHandle.ADVAPI32(?), ref: 0054692E

Strings

Failed to query status of WU service., xrefs: 0054689B
Failed to read configuration for WU service., xrefs: 005468D4
lT, xrefs: 005467B0
Failed to open service control manager., xrefs: 00546803
wuauserv, xrefs: 00546817
Failed to mark WU service to start on demand., xrefs: 005468F5
msuengine.cpp, xrefs: 005467F9, 0054684D, 00546891
Failed to open WU service., xrefs: 00546857

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandleOpen$ManagerQueryStatus
String ID: Failed to mark WU service to start on demand.$Failed to open WU service.$Failed to open service control manager.$Failed to query status of WU service.$Failed to read configuration for WU service.$msuengine.cpp$wuauserv$lT
API String ID: 971853308-791995080
Opcode ID: a8c0dbde272293e4fc7ba2a194712e9ed98055bd570211f5e512bf8f27f4cf80
Instruction ID: 91da12ce4e34430e38c41703f5ac50146431dc6f313744d7d5ccb126ca58727b
Opcode Fuzzy Hash: a8c0dbde272293e4fc7ba2a194712e9ed98055bd570211f5e512bf8f27f4cf80
Instruction Fuzzy Hash: 2141B071A00325ABEB209AA99C49BEA7FF8FF49754F018425FC05F7241DBB4DC4096A2

Uniqueness

Uniqueness Score: -1.00%

Function 0053E563 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 135registryCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 0053E5AE
RegisterClassW.USER32(?), ref: 0053E5DA
GetLastError.KERNEL32 ref: 0053E5E5
CreateWindowExW.USER32(00000080,00579CC4,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 0053E64C
GetLastError.KERNEL32 ref: 0053E656
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 0053E6F4

Strings

uithread.cpp, xrefs: 0053E609, 0053E67A
Failed to register window., xrefs: 0053E613
WixBurnMessageWindow, xrefs: 0053E5D3, 0053E6EF
Failed to create window., xrefs: 0053E684
Unexpected return value from message pump., xrefs: 0053E6DF

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
API String ID: 213125376-288575659
Opcode ID: 072c6c9d8eeba49c73137f60e73f09cff280759eaffb348683548f6f061765e7
Instruction ID: 5ac20e168fc5fc0eeac40705c9e8924c7d922d3581a5713fb422d98f560f2d86
Opcode Fuzzy Hash: 072c6c9d8eeba49c73137f60e73f09cff280759eaffb348683548f6f061765e7
Instruction Fuzzy Hash: CC418472A00214ABEF119BA8ED4AADABFE8FF19350F104125F909E7290D7719D44DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0054DC0D Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 204stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00549751,75C08550,?,?,00000000,?,?,?,00000001,00000000,?), ref: 0054DC28

Strings

Failed to complete BITS job., xrefs: 0054DDD2
Failed while waiting for BITS download., xrefs: 0054DDD9
bitsengine.cpp, xrefs: 0054DC3E, 0054DD31
Failed to set credentials for BITS job., xrefs: 0054DCD6
Failed to create BITS job callback., xrefs: 0054DD3B
Failed to copy download URL., xrefs: 0054DC6F
Failed to initialize BITS job callback., xrefs: 0054DD49
Failed to download BITS job., xrefs: 0054DDBF
Invalid BITS engine URL: %ls, xrefs: 0054DC4A
Falied to start BITS job., xrefs: 0054DDE0
Failed to set callback interface for BITS job., xrefs: 0054DD60
Failed to add file to BITS job., xrefs: 0054DCF5
Failed to create BITS job., xrefs: 0054DCB7

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: lstrlen
String ID: Failed to add file to BITS job.$Failed to complete BITS job.$Failed to copy download URL.$Failed to create BITS job callback.$Failed to create BITS job.$Failed to download BITS job.$Failed to initialize BITS job callback.$Failed to set callback interface for BITS job.$Failed to set credentials for BITS job.$Failed while waiting for BITS download.$Falied to start BITS job.$Invalid BITS engine URL: %ls$bitsengine.cpp
API String ID: 1659193697-2382896028
Opcode ID: 3393ee0be8821c5c0c095e84f1f704d82a574418342e762c2dba51edc0691dcf
Instruction ID: 57c29d27a981922df1afb8af4375fc487b7e5957d9dd9791b9b3d3ccb4af4bc3
Opcode Fuzzy Hash: 3393ee0be8821c5c0c095e84f1f704d82a574418342e762c2dba51edc0691dcf
Instruction Fuzzy Hash: 74619E32E40625EBCB11AB94C889EEE7FB4BF44B54F114155FC05AB291E770DD10EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0052BB30 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 189processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000200,00000000,?,00000044,?,?,?,?,?), ref: 0052BC8F
GetLastError.KERNEL32(?,?,?,?), ref: 0052BC99
WaitForInputIdle.USER32(?,?), ref: 0052BCED
CloseHandle.KERNEL32(?,?,?), ref: 0052BD38
CloseHandle.KERNEL32(?,?,?), ref: 0052BD45

Strings

Failed to create obfuscated executable command., xrefs: 0052BC2D
Failed to format obfuscated argument string., xrefs: 0052BBD9
Failed to CreateProcess on path: %ls, xrefs: 0052BCCA
Failed to format argument string., xrefs: 0052BB8D
"%ls" %s, xrefs: 0052BBA8, 0052BBE9
Failed to create executable command., xrefs: 0052BBBC
approvedexe.cpp, xrefs: 0052BCBD
D, xrefs: 0052BC6E
"%ls", xrefs: 0052BBFF, 0052BC19

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseHandle$CreateErrorIdleInputLastProcessWait
String ID: "%ls"$"%ls" %s$D$Failed to CreateProcess on path: %ls$Failed to create executable command.$Failed to create obfuscated executable command.$Failed to format argument string.$Failed to format obfuscated argument string.$approvedexe.cpp
API String ID: 1086122317-2737401750
Opcode ID: 95b30f67725a4c2e362225ce1317a355eb76b183861c84f80ea72f23860b8b98
Instruction ID: 4bc1feeb82eaeb18ef3f960a0f9aca8ca3d088f2b39d09409d9c6e3dd0bc83f8
Opcode Fuzzy Hash: 95b30f67725a4c2e362225ce1317a355eb76b183861c84f80ea72f23860b8b98
Instruction Fuzzy Hash: 2D516A72D0062ABBEF119FA4EC46DAEBF79FF05301F004566EA14B6290D7319E50DB91

Uniqueness

Uniqueness Score: -1.00%

Function 005339FD Relevance: 24.6, APIs: 5, Strings: 9, Instructions: 128COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,?,00000000,crypt32.dll), ref: 00533A51
GetLastError.KERNEL32(?,00000000,crypt32.dll), ref: 00533A5B
GetCurrentProcessId.KERNEL32(?,?,?,00000104,?,?,00000000,crypt32.dll), ref: 00533AC4
ProcessIdToSessionId.KERNEL32(00000000,?,00000000,crypt32.dll), ref: 00533ACB

Strings

Failed to copy temp folder., xrefs: 00533B7A
43u, xrefs: 00533A51
Failed to get length of session id string., xrefs: 00533B1D
crypt32.dll, xrefs: 00533A10
Failed to get length of temp folder., xrefs: 00533AB5
Failed to get temp folder., xrefs: 00533A89
Failed to format session id as a string., xrefs: 00533AF9
%u\, xrefs: 00533AE5
logging.cpp, xrefs: 00533A7F

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Process$CurrentErrorLastPathSessionTemp
String ID: 43u$%u\$Failed to copy temp folder.$Failed to format session id as a string.$Failed to get length of session id string.$Failed to get length of temp folder.$Failed to get temp folder.$crypt32.dll$logging.cpp
API String ID: 1726527325-2489822815
Opcode ID: 2f33d01f94fbdab0265c584926bfcdd98fb9b68322d448d55838564e5f144e46
Instruction ID: f023e310c0a68dc7c83b7afdbe311b036c3ff73c91a875a7bcbf1c35743fe131
Opcode Fuzzy Hash: 2f33d01f94fbdab0265c584926bfcdd98fb9b68322d448d55838564e5f144e46
Instruction Fuzzy Hash: 4C41817298123DABDB219A649C4DEDABFB8FF15710F1001A5EC18F7140E6709F84DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00532DDC Relevance: 23.1, APIs: 1, Strings: 12, Instructions: 303COMMON

Download Yara Rule

Strings

Failed to lookup the bundle ID in the ancestors dictionary., xrefs: 005330F0
Failed to create dictionary from ancestors array., xrefs: 00532E46
feclient.dll, xrefs: 005330BB
Failed to add the package provider key "%ls" to the planned list., xrefs: 00533107
crypt32.dll, xrefs: 00532E0E
plan.cpp, xrefs: 0053311D
Failed to copy self to related bundle ancestors., xrefs: 0053312E
Failed to copy ancestors and self to related bundle ancestors., xrefs: 00532EF6
%ls;%ls, xrefs: 00532EDE
Failed to create string array from ancestors., xrefs: 00532E1A
Unexpected relation type encountered during plan: %d, xrefs: 005330FE
UX aborted plan related bundle., xrefs: 00533127

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID:
String ID: %ls;%ls$Failed to add the package provider key "%ls" to the planned list.$Failed to copy ancestors and self to related bundle ancestors.$Failed to copy self to related bundle ancestors.$Failed to create dictionary from ancestors array.$Failed to create string array from ancestors.$Failed to lookup the bundle ID in the ancestors dictionary.$UX aborted plan related bundle.$Unexpected relation type encountered during plan: %d$crypt32.dll$feclient.dll$plan.cpp
API String ID: 0-794096528
Opcode ID: 2c1fc3511636478b35738cc034b4a6771418276cef6c0236feb55820d04b96ea
Instruction ID: 299bef485292b0d47bd2d63134fcbe08e39e94c78928237f61b92d38ba47a96e
Opcode Fuzzy Hash: 2c1fc3511636478b35738cc034b4a6771418276cef6c0236feb55820d04b96ea
Instruction Fuzzy Hash: 23B1D271900616FFDB29DFA4CC45AAABFB5FF45310F108569E804AB250E731AE91DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0052B106 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 136COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,?,0052B9F7,00000008,?,00000000,00000000,?,?,?,00000000,771AC310,00000000), ref: 0052B10E
GetLastError.KERNEL32(?,0052B9F7,00000008,?,00000000,00000000,?,?,?,00000000,771AC310,00000000), ref: 0052B11A

Strings

Failed to find valid DOS image header in buffer., xrefs: 0052B17B
Failed to find Burn section., xrefs: 0052B230
Failed to get module handle to process., xrefs: 0052B148
.wixburn, xrefs: 0052B1BC
Bundle guid didn't match the guid in the PE Header in memory., xrefs: 0052B299
Failed to read section info, unsupported version: %08x, xrefs: 0052B25C
burn, xrefs: 0052B1E9
section.cpp, xrefs: 0052B13E, 0052B16F, 0052B19A, 0052B203, 0052B224, 0052B24D, 0052B28D
.wix, xrefs: 0052B1E1
Failed to read section info, data to short: %u, xrefs: 0052B212
Failed to find valid NT image header in buffer., xrefs: 0052B1A6

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorHandleLastModule
String ID: .wix$.wixburn$Bundle guid didn't match the guid in the PE Header in memory.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get module handle to process.$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$burn$section.cpp
API String ID: 4242514867-926796631
Opcode ID: 21d775b91f18b50e0f907a55b711765cf93dca79aa50cd382e74079095f0eae1
Instruction ID: 301d28511ce0d168c5c363a4e19272b266ff02ea661a3fca1e3df5280b6f3faf
Opcode Fuzzy Hash: 21d775b91f18b50e0f907a55b711765cf93dca79aa50cd382e74079095f0eae1
Instruction Fuzzy Hash: 7A41287A781331B7EB205654FC46E6B2F65FF82B20F154029F9025B6C1D7A9CA42C3A6

Uniqueness

Uniqueness Score: -1.00%

Function 005267E5 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 131libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,ntdll,?), ref: 00526835
GetLastError.KERNEL32 ref: 0052683F
GetProcAddress.KERNEL32(?,RtlGetVersion), ref: 00526882
GetLastError.KERNEL32 ref: 0052688C
FreeLibrary.KERNEL32(00000000,00000000,?), ref: 0052699D

Strings

Failed to get OS info., xrefs: 005268DD
Failed to locate RtlGetVersion., xrefs: 005268BA
ntdll, xrefs: 0052682F
Failed to locate NTDLL., xrefs: 0052686D
RtlGetVersion, xrefs: 00526877
variable.cpp, xrefs: 00526863, 005268B0
Failed to set variant value., xrefs: 00526981

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast$AddressFreeHandleLibraryModuleProc
String ID: Failed to get OS info.$Failed to locate NTDLL.$Failed to locate RtlGetVersion.$Failed to set variant value.$RtlGetVersion$ntdll$variable.cpp
API String ID: 3057421322-109962352
Opcode ID: c5d5e3f5f8572a4a412e0bea4ed8f8fad890569ffba2e0b56739af78db73983b
Instruction ID: ac0b6d4d8511cd5cd5897774f55e8d25d37f4cf8e0e9b1caee16bd80d1409fe5
Opcode Fuzzy Hash: c5d5e3f5f8572a4a412e0bea4ed8f8fad890569ffba2e0b56739af78db73983b
Instruction Fuzzy Hash: 74419471E002399BEB219B699C097EABEF4FF09750F000195E948F7190DB758E94DAA1

Uniqueness

Uniqueness Score: -1.00%

Function 005247E9 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 128memorysynchronizationCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,00000001,00000001,00000000,00000000,?,?,?,0052535E,?,?,?,?), ref: 0052481A
GetLastError.KERNEL32(?,?,?,0052535E,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0052482B
ReleaseMutex.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00524968
CloseHandle.KERNEL32(?,?,?,?,0052535E,?,?,?,?,?,?,?,?,?,?,?), ref: 00524971

Strings

comres.dll, xrefs: 005248D7
Failed to connect to unelevated process., xrefs: 00524810
Failed to allocate thread local storage for logging., xrefs: 00524859
engine.cpp, xrefs: 0052484F, 00524898
Failed to set elevated pipe into thread local storage for logging., xrefs: 005248A2
Failed to pump messages from parent process., xrefs: 0052493C
Failed to create the message window., xrefs: 005248C6

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AllocCloseErrorHandleLastMutexRelease
String ID: Failed to allocate thread local storage for logging.$Failed to connect to unelevated process.$Failed to create the message window.$Failed to pump messages from parent process.$Failed to set elevated pipe into thread local storage for logging.$comres.dll$engine.cpp
API String ID: 687263955-1790235126
Opcode ID: 02931cbedbd38f02f0416333cf005c6195650fd19b89ea4f48ba82fb7950468d
Instruction ID: b86e0c882da56ef44c95375c263323a7573212992f81276af8be18e8268019ce
Opcode Fuzzy Hash: 02931cbedbd38f02f0416333cf005c6195650fd19b89ea4f48ba82fb7950468d
Instruction Fuzzy Hash: F4419B72A00625BBEB119BA4DC49EDBBFACFF45710F000226FA15E3190DB719D949BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00527E7C Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 214COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,000000B9,00000002,?,00000000,00000000), ref: 00527E99
LeaveCriticalSection.KERNEL32(?,?,?), ref: 005280C1

Strings

Unsupported variable type., xrefs: 0052807E
Failed to write literal flag., xrefs: 0052809A
feclient.dll, xrefs: 00527F74, 00527FCA, 0052800B
Failed to write variable value as string., xrefs: 00528085
Failed to get numeric., xrefs: 00528093
Failed to write variable value type., xrefs: 005280A1
Failed to write variable name., xrefs: 005280A8
Failed to get version., xrefs: 00528072
Failed to write variable count., xrefs: 00527EB4
Failed to write variable value as number., xrefs: 0052806B
Failed to write included flag., xrefs: 005280AF
Failed to get string., xrefs: 0052808C

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get numeric.$Failed to get string.$Failed to get version.$Failed to write included flag.$Failed to write literal flag.$Failed to write variable count.$Failed to write variable name.$Failed to write variable value as number.$Failed to write variable value as string.$Failed to write variable value type.$Unsupported variable type.$feclient.dll
API String ID: 3168844106-2118673349
Opcode ID: 505980a62ece724dfbcd2a136f3bee5b6e9d1b88f80ca5d79b4706e3c2db88b2
Instruction ID: 1a82422647e33fa7b61feeeb806c0a83e336de17204125f9db18b583824c7950
Opcode Fuzzy Hash: 505980a62ece724dfbcd2a136f3bee5b6e9d1b88f80ca5d79b4706e3c2db88b2
Instruction Fuzzy Hash: 1661E532D0662AABCB22DEA4DD48ABE7F75FF0A350F104552FA00671D0DB30DD589BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00566BF6 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 166COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,label,000000FF,?,?,?,7532DFD0,?,00567172,?,?), ref: 00566C4C
SysFreeString.OLEAUT32(00000000), ref: 00566CB7
SysFreeString.OLEAUT32(00000000), ref: 00566D2F
SysFreeString.OLEAUT32(00000000), ref: 00566D71

Strings

feclient.dll, xrefs: 00566C9E, 00566D42, 00566D51
label, xrefs: 00566C3E
rqV, xrefs: 00566C34, 00566C5A, 00566D17
rqV, xrefs: 00566D84, 00566CF0, 00566D06, 00566CF3, 00566D8D
term, xrefs: 00566C7F
scheme, xrefs: 00566C5F

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: String$Free$Compare
String ID: feclient.dll$label$rqV$rqV$scheme$term
API String ID: 1324494773-2857531394
Opcode ID: 0669c8820170cf6bf77317c89e3e69cadffd6f7b2fe662a0ab01e000d1a4e97d
Instruction ID: cc1ae9f7d7f68c607575dc747b0a549b7f55e40bd81eeaab0ba59be7027f3bc5
Opcode Fuzzy Hash: 0669c8820170cf6bf77317c89e3e69cadffd6f7b2fe662a0ab01e000d1a4e97d
Instruction Fuzzy Hash: B4514B75A00219FBDF25DB94C858EAEBFB8FF04720F200695E511EB2A0D731AE40DB50

Uniqueness

Uniqueness Score: -1.00%

Function 005601F0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 123COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000001,00000000,00000000), ref: 00560234
GetComputerNameW.KERNEL32(?,?), ref: 0056028C

Strings

TbX, xrefs: 0056032D
dbX, xrefs: 00560345
\bX, xrefs: 00560325
8bX, xrefs: 00560205
--- logging level: %hs ---, xrefs: 0056034C
=== Logging started: %ls ===, xrefs: 005602B7
@bX, xrefs: 0056033D
HbX, xrefs: 00560335
Computer : %ls, xrefs: 005602FA
Executable: %ls v%d.%d.%d.%d, xrefs: 005602E8

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Name$ComputerFileModule
String ID: --- logging level: %hs ---$8bX$=== Logging started: %ls ===$@bX$Computer : %ls$Executable: %ls v%d.%d.%d.%d$HbX$TbX$\bX$dbX
API String ID: 2577110986-2767763382
Opcode ID: 92544456183fbabd67483afd42441423a921f96166e9da87cc52bae817a89784
Instruction ID: 7f58ba73105dd81cbcc77d987bccc82ccd39370f9685d1b747dc89fbe2c2d1a3
Opcode Fuzzy Hash: 92544456183fbabd67483afd42441423a921f96166e9da87cc52bae817a89784
Instruction Fuzzy Hash: B64186F1A0011C9BDB219F68DC899EB7BBCFB55300F0055E6F909E7141D6309E899F65

Uniqueness

Uniqueness Score: -1.00%

Function 005395AC Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,0053A63D,?,00000000,?,?,0054B049), ref: 005395C7
GetLastError.KERNEL32(?,0053A63D,?,00000000,?,?,0054B049,?,00000000,?,00000000,?,?,0054B049,?), ref: 005395D7
CloseHandle.KERNEL32(?,0054B049,00000001,00000003,000007D0,?,?,0054B049,?), ref: 005396E4

Strings

Copying, xrefs: 00539679
Failed to verify payload hash: %ls, xrefs: 0053966F
%ls payload from working path '%ls' to path '%ls', xrefs: 0053968F
cache.cpp, xrefs: 005395FB
Failed to open payload in working path: %ls, xrefs: 00539606
Failed to copy %ls to %ls, xrefs: 005396D2
Failed to move %ls to %ls, xrefs: 005396BC
Failed to verify payload signature: %ls, xrefs: 00539632
Moving, xrefs: 00539686, 0053968E

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: %ls payload from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open payload in working path: %ls$Failed to verify payload hash: %ls$Failed to verify payload signature: %ls$Moving$cache.cpp
API String ID: 2528220319-1604654059
Opcode ID: 9c98d02e55fd22f1454e48ddc4ca7dd111a856bf1cec20e9a4bc6c4fffbefa13
Instruction ID: a38cb132291f63514791ef927f706c658a60bf00c32cf8268761e4adbf00fc59
Opcode Fuzzy Hash: 9c98d02e55fd22f1454e48ddc4ca7dd111a856bf1cec20e9a4bc6c4fffbefa13
Instruction Fuzzy Hash: EF31F6B1E417257BEB212A25AC0BF2B2F5CFF85B60F014119FD15BB291D7A09D00E6E5

Uniqueness

Uniqueness Score: -1.00%

Function 00541341 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 80synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(0056B468,=SR,00000000,?,0052C06D,=SR,005252B5,00000000,?,0053763B,?,00525565,00525371,00525371,00000000,?), ref: 0054135E
GetLastError.KERNEL32(?,0052C06D,=SR,005252B5,00000000,?,0053763B,?,00525565,00525371,00525371,00000000,?,00525381,FFF9E89D,00525381), ref: 00541368
WaitForSingleObject.KERNEL32(0056B478,000000FF,?,0052C06D,=SR,005252B5,00000000,?,0053763B,?,00525565,00525371,00525371,00000000,?,00525381), ref: 005413A2
GetLastError.KERNEL32(?,0052C06D,=SR,005252B5,00000000,?,0053763B,?,00525565,00525371,00525371,00000000,?,00525381,FFF9E89D,00525381), ref: 005413AC
CloseHandle.KERNEL32(00000000,00525381,=SR,00000000,?,0052C06D,=SR,005252B5,00000000,?,0053763B,?,00525565,00525371,00525371,00000000), ref: 005413F7
CloseHandle.KERNEL32(00000000,00525381,=SR,00000000,?,0052C06D,=SR,005252B5,00000000,?,0053763B,?,00525565,00525371,00525371,00000000), ref: 00541406
CloseHandle.KERNEL32(00000000,00525381,=SR,00000000,?,0052C06D,=SR,005252B5,00000000,?,0053763B,?,00525565,00525371,00525371,00000000), ref: 00541415

Strings

Failed to set begin operation event., xrefs: 00541396
=SR, xrefs: 00541345
cabextract.cpp, xrefs: 0054138C, 005413D0
Failed to wait for thread to terminate., xrefs: 005413DA
=SR, xrefs: 00541348

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseHandle$ErrorLast$EventObjectSingleWait
String ID: =SR$=SR$Failed to set begin operation event.$Failed to wait for thread to terminate.$cabextract.cpp
API String ID: 1206859064-1959039305
Opcode ID: d53ab35bc98fa2d576f52293d0f83723ccbf94ba26dce995954cf92f7fdb29e3
Instruction ID: 1b6ccefd47877167dc1183fdc4efc9177a7a4f58d3d0fe4e49ced902e073c984
Opcode Fuzzy Hash: d53ab35bc98fa2d576f52293d0f83723ccbf94ba26dce995954cf92f7fdb29e3
Instruction Fuzzy Hash: F8210532240B009BE7305B2ADC48B977EF1FF84326F01462DE54A928A0DB75D485EA29

Uniqueness

Uniqueness Score: -1.00%

Function 00533E47 Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 220sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00533955: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,00533E61,feclient.dll,?,00000000,?,?,?,00524A0C), ref: 005339F1

Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,00524A0C,?,?,0056B478,?,00000001,00000000,00000000), ref: 00533EF8

Strings

clbcatq.dll, xrefs: 00534031
feclient.dll, xrefs: 00533E5B, 00533F08
Setup, xrefs: 00533EA5
crypt32.dll, xrefs: 00533E9E, 00533F03, 00533F0B, 00533F72, 00533FAC, 00533FED, 0053400C, 0053404A, 00534074
log, xrefs: 00533E9F
msasn1.dll, xrefs: 0053400E, 0053404F
Failed to copy log path to prefix., xrefs: 0053401A
Failed to copy full log path to prefix., xrefs: 0053405B
Failed to get current directory., xrefs: 00533EDA
Failed to open log: %ls, xrefs: 00533F74
Failed to copy log extension to extension., xrefs: 0053403D
Failed to get non-session specific TEMP folder., xrefs: 00533FA2

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseSleep
String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
API String ID: 2834455192-2673269691
Opcode ID: c04638350a93b6e47e41d49434574eeed5cbcec46d93a197164b9dbd9e59ca87
Instruction ID: 85e7c8a2bef922abb75dcbd100fffb22275cf7ada9569d5696ad44cf9042e793
Opcode Fuzzy Hash: c04638350a93b6e47e41d49434574eeed5cbcec46d93a197164b9dbd9e59ca87
Instruction Fuzzy Hash: 8E61C271A00626BBDB269F64CC4AB2B7FA8FF40350F044165F805DB181EB75EE90EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00526C5D Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 167COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000001,?,00000000,0052533D,00000000,00000001), ref: 00526C6E

Part of subcall function 005255B6: CompareStringW.KERNEL32(0000007F,00001000,?,000000FF,version.dll,000000FF,?,00000000,00000007,0052648B,0052648B,?,0052554A,?,?,00000000), ref: 005255F2
Part of subcall function 005255B6: GetLastError.KERNEL32(?,0052554A,?,?,00000000,?,00000000,0052648B,?,00527DDC,?,?,?,?,?), ref: 00525621

LeaveCriticalSection.KERNEL32(00000001,?,00000001), ref: 00526E02

Strings

Setting hidden variable '%ls', xrefs: 00526D2C
Failed to set value of variable: %ls, xrefs: 00526DEA
Unsetting variable '%ls', xrefs: 00526DBE
Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 00526E14
Setting numeric variable '%ls' to value %lld, xrefs: 00526DA3
Setting string variable '%ls' to value '%ls', xrefs: 00526D96
variable.cpp, xrefs: 00526CF1
Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 00526D79
Failed to find variable value '%ls'., xrefs: 00526C89
Failed to insert variable '%ls'., xrefs: 00526CB3
Attempt to set built-in variable value: %ls, xrefs: 00526CFC

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalSection$CompareEnterErrorLastLeaveString
String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$variable.cpp
API String ID: 2716280545-445000439
Opcode ID: 70d7b4cde5cc25cfc00c6f652eaf5368aaf880c0c608c0fabfbf05e3d768e4e6
Instruction ID: 82d0b8aa90f2fc24bb47465dd7b0abb9840476ac56c41f3236cbb083cdfa3e2d
Opcode Fuzzy Hash: 70d7b4cde5cc25cfc00c6f652eaf5368aaf880c0c608c0fabfbf05e3d768e4e6
Instruction Fuzzy Hash: 6F51C171B40239ABDB30AE18ED4AF6B7EA8FF96700F200559F8456B2C1D271DD51CAE1

Uniqueness

Uniqueness Score: -1.00%

Function 00532A60 Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 298COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,006C0064,000000FF,002C002B,000000FF,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 00532ACD

Strings

Failed to add registration action for self dependent., xrefs: 00532D9E
Failed to allocate registration action., xrefs: 00532B36
Failed to add dependents ignored from command-line., xrefs: 00532B82
Failed to create the string dictionary., xrefs: 00532B06
crypt32.dll, xrefs: 00532B18, 00532C16, 00532D0B, 00532D80
wininet.dll, xrefs: 00532D1E
Failed to check for remaining dependents during planning., xrefs: 00532C73
Failed to add registration action for dependent related bundle., xrefs: 00532DD5
Failed to add self-dependent to ignore dependents., xrefs: 00532B51
Failed to add dependent bundle provider key to ignore dependents., xrefs: 00532C37

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CompareString
String ID: Failed to add dependent bundle provider key to ignore dependents.$Failed to add dependents ignored from command-line.$Failed to add registration action for dependent related bundle.$Failed to add registration action for self dependent.$Failed to add self-dependent to ignore dependents.$Failed to allocate registration action.$Failed to check for remaining dependents during planning.$Failed to create the string dictionary.$crypt32.dll$wininet.dll
API String ID: 1825529933-1705955799
Opcode ID: e9aef39dc9319cf4c48b1c10e4a99097fa25fb765ef323779e7a6825e54ec749
Instruction ID: e7561155f4c5a298b6e1b3b0d714466717bfc347775488dfe80730206ca11d71
Opcode Fuzzy Hash: e9aef39dc9319cf4c48b1c10e4a99097fa25fb765ef323779e7a6825e54ec749
Instruction Fuzzy Hash: 25B18A70A00A2AEFCB25DF64C891BAABFA1FF44310F108569F804AB251D770DDA1DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 005249DF Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 144windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00524B5E
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00524B6F

Strings

Failed while running , xrefs: 00524B24
Failed to set registration variables., xrefs: 00524AD8
Failed to set layout directory variable to value provided from command-line., xrefs: 00524B00
Failed to set action variables., xrefs: 00524ABE
Failed to check global conditions, xrefs: 00524A43
WixBundleLayoutDirectory, xrefs: 00524AEF
Failed to create the message window., xrefs: 00524A92
Failed to open log., xrefs: 00524A12
Failed to query registration., xrefs: 00524AA8

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: MessagePostWindow
String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
API String ID: 3618638489-3051724725
Opcode ID: a2b2ad3181b9ac5f27188920ebed40263eeb7a22cedde2639242c2ed5b01cf4b
Instruction ID: 375328e09b63c0f57855a3eafd4d1a882c6159670ec4d4a11da5dbe4437c2663
Opcode Fuzzy Hash: a2b2ad3181b9ac5f27188920ebed40263eeb7a22cedde2639242c2ed5b01cf4b
Instruction Fuzzy Hash: 6541A271A40A3BBBDB269A60EC49FBABF6CFF06750F000615B804A75D0E760ED50DAD0

Uniqueness

Uniqueness Score: -1.00%

Function 0052CABE Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 144COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,?,000000FF,00525381,?,005252B5,00000000,00525381,FFF9E89D,00525381,005253B5,0052533D,?), ref: 0052CB15

Strings

Payload was not found in container: %ls, xrefs: 0052CC22
Failed to ensure directory exists, xrefs: 0052CBE7
Failed to concat file paths., xrefs: 0052CBF5
=SR, xrefs: 0052CADC, 0052CBB7
Failed to get next stream., xrefs: 0052CBFC
Failed to get directory portion of local file path, xrefs: 0052CBEE
payload.cpp, xrefs: 0052CC16
Failed to extract file., xrefs: 0052CBE0
=SR, xrefs: 0052CB77, 0052CC44
Failed to find embedded payload: %ls, xrefs: 0052CB41

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CompareString
String ID: =SR$=SR$Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$payload.cpp
API String ID: 1825529933-3505786879
Opcode ID: 17eb44f01750f49db1356a81672ef9080eb181d2c6c182f3928f714c8d981100
Instruction ID: b8a51efe393c36effc01e29c49c752e2fdbb5e8ab38cd23cbebc4a17fdec581d
Opcode Fuzzy Hash: 17eb44f01750f49db1356a81672ef9080eb181d2c6c182f3928f714c8d981100
Instruction Fuzzy Hash: 0A41BC31D00239ABCF259E84EC869AEBF75BF42710F5041A9E815BB2D2C7719D80DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0052A17D Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 138registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(000002C0,00000000,00000000,000002C0,00000000,00000000,000002C0,?,00000000,00000000,?,00000000,00000101,000002C0,000002C0,?), ref: 0052A226
RegCloseKey.ADVAPI32(00000000,00000000,00000000,000002C0,00000100,00000000,000002C0), ref: 0052A300

Strings

Failed to format key string., xrefs: 0052A1B3
Failed to set variable., xrefs: 0052A2B8
RegistrySearchExists failed: ID '%ls', HRESULT 0x%x, xrefs: 0052A2D8
Failed to query registry key value., xrefs: 0052A265
Failed to open registry key. Key = '%ls', xrefs: 0052A2C2
Registry key not found. Key = '%ls', xrefs: 0052A291
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 0052A275
Failed to format value string., xrefs: 0052A20F
search.cpp, xrefs: 0052A25B

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseQueryValue
String ID: Failed to format key string.$Failed to format value string.$Failed to open registry key. Key = '%ls'$Failed to query registry key value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchExists failed: ID '%ls', HRESULT 0x%x$search.cpp
API String ID: 3356406503-46557908
Opcode ID: cb78f17653820c7e82af77c2dc13667d92b093d71cc56eaa70c882953f3bb0eb
Instruction ID: 26d2290b8c4297d83ec82f4b916ee265fe933e03171498ec9d21573016dcd918
Opcode Fuzzy Hash: cb78f17653820c7e82af77c2dc13667d92b093d71cc56eaa70c882953f3bb0eb
Instruction Fuzzy Hash: 8A41D336E40225FBDF216A94DC0ABAEBF69FF45710F104165FD04AB1D1D7728E10E692

Uniqueness

Uniqueness Score: -1.00%

Function 0053EDFE Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 005238D4: GetProcessHeap.KERNEL32(?,000001C7,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238E5
Part of subcall function 005238D4: RtlAllocateHeap.NTDLL(00000000,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238EC

EnterCriticalSection.KERNEL32(?,00000014,00000001), ref: 0053EE1B
LeaveCriticalSection.KERNEL32(?), ref: 0053EF48

Strings

UX requested unknown approved exe with id: %ls, xrefs: 0053EE7B
Engine is active, cannot change engine state., xrefs: 0053EE36
Failed to copy the id., xrefs: 0053EEAD
Failed to copy the arguments., xrefs: 0053EEDA
EngineForApplication.cpp, xrefs: 0053EF29
Failed to post launch approved exe message., xrefs: 0053EF33

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalHeapSection$AllocateEnterLeaveProcess
String ID: Engine is active, cannot change engine state.$EngineForApplication.cpp$Failed to copy the arguments.$Failed to copy the id.$Failed to post launch approved exe message.$UX requested unknown approved exe with id: %ls
API String ID: 1367039788-528931743
Opcode ID: e4e70f04c80757e5828bfb23b16e77b56b75f416e0e86d010d0f023f325c5ac0
Instruction ID: 219ecd1559d62b9562bc198e3363408166d8bed10782c70b6615664b2f4656d5
Opcode Fuzzy Hash: e4e70f04c80757e5828bfb23b16e77b56b75f416e0e86d010d0f023f325c5ac0
Instruction Fuzzy Hash: 4031C232A40226ABEB119F64EC4AE6B7FE8FF45720F048525FD08DB291D670DD50E7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00539496 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,0053A5CE,?,00000000,?,?,0054B041), ref: 005394B1
GetLastError.KERNEL32(?,0053A5CE,?,00000000,?,?,0054B041,?,00000000,?,00000000,?,?,0054B041,?), ref: 005394BF
CloseHandle.KERNEL32(?,0054B041,00000001,00000003,000007D0,?,?,0054B041,?), ref: 0053959E

Strings

Copying, xrefs: 00539533
cache.cpp, xrefs: 005394E3
Failed to verify container hash: %ls, xrefs: 00539520
%ls container from working path '%ls' to path '%ls', xrefs: 00539549
Failed to copy %ls to %ls, xrefs: 0053958C
Failed to open container in working path: %ls, xrefs: 005394EE
Failed to move %ls to %ls, xrefs: 00539576
Moving, xrefs: 00539540, 00539548

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: %ls container from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open container in working path: %ls$Failed to verify container hash: %ls$Moving$cache.cpp
API String ID: 2528220319-1187406825
Opcode ID: 0aa7718bbf1c6cf3c60ba08c1bddb3360b5e47ef86f53ee41c83314708a5bde1
Instruction ID: 18c139e55a9355a90c6b3c448861dd20b22c96df8ed33c3ddaf0a8a9bd69c762
Opcode Fuzzy Hash: 0aa7718bbf1c6cf3c60ba08c1bddb3360b5e47ef86f53ee41c83314708a5bde1
Instruction Fuzzy Hash: DB210BB1A807257BE72219256C4AF6B3F58FF55B10F000114FD09BB2C1D2E19D40E6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00526E5A Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00526E89
LeaveCriticalSection.KERNEL32(?), ref: 00527095

Strings

Unsupported variable type., xrefs: 0052705B
Failed to read variable value type., xrefs: 00527077
Failed to read variable included flag., xrefs: 00527085
Failed to read variable value as number., xrefs: 0052704F
Failed to read variable literal flag., xrefs: 00527070
Failed to read variable name., xrefs: 0052707E
Failed to read variable count., xrefs: 00526EA9
Failed to set variable., xrefs: 00527069
Failed to set variable value., xrefs: 00527048
Failed to read variable value as string., xrefs: 00527062

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to read variable count.$Failed to read variable included flag.$Failed to read variable literal flag.$Failed to read variable name.$Failed to read variable value as number.$Failed to read variable value as string.$Failed to read variable value type.$Failed to set variable value.$Failed to set variable.$Unsupported variable type.
API String ID: 3168844106-528957463
Opcode ID: 57c50a114cb633545d1970d61a59aaa2da93e16709ddcc6cc4bb2234d2378063
Instruction ID: 44b9e833be78efe82ef7bc94e28faa308379a254206d8c98502b93ff622ef51e
Opcode Fuzzy Hash: 57c50a114cb633545d1970d61a59aaa2da93e16709ddcc6cc4bb2234d2378063
Instruction Fuzzy Hash: 23719272C0522EABCF11DEA4ED49EAEBF78FF4A710F104521B900A61D0D6719E099FA0

Uniqueness

Uniqueness Score: -1.00%

Function 005643A6 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 247fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000080,00000000,?,?,00000000,?,00000000,?,?,?), ref: 00564425
GetLastError.KERNEL32 ref: 0056443B
GetFileSizeEx.KERNEL32(00000000,?), ref: 00564486
GetLastError.KERNEL32 ref: 00564490
CloseHandle.KERNEL32(?), ref: 00564650

Strings

fileutil.cpp, xrefs: 005643C6, 0056446F, 005644B0, 00564633

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleSize
String ID: fileutil.cpp
API String ID: 3555958901-2967768451
Opcode ID: 9e59912a642ac1e02efbaf2b7e073bec303cfe515d34c342a06cf4a964478bfb
Instruction ID: 744f47604e532c6a3743019c97879965cc4a46072cb1cebf86e16ac0b3d5fd76
Opcode Fuzzy Hash: 9e59912a642ac1e02efbaf2b7e073bec303cfe515d34c342a06cf4a964478bfb
Instruction Fuzzy Hash: 4B710371A00216ABEF219E698C45B7B7EE8FF51720F114529FD16EB280E775CE408F94

Uniqueness

Uniqueness Score: -1.00%

Function 00522DE0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 198sleepfiletimeCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001,00000000,00000000), ref: 00522E7A
GetLastError.KERNEL32 ref: 00522E84
GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00522F1F
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 00522FAD
GetLastError.KERNEL32 ref: 00522FBA
Sleep.KERNEL32(00000064), ref: 00522FCC
CloseHandle.KERNEL32(?), ref: 0052302C

Strings

43u, xrefs: 00522E7A
pathutil.cpp, xrefs: 00522EA8
%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 00522F7D

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
String ID: 43u$%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$pathutil.cpp
API String ID: 3480017824-1407774293
Opcode ID: c3913dbd7ac63484fec00311d5e005f100e6d7329399cd73869c2280a8313674
Instruction ID: 8cd6d07d51cbf05113ff64634a25891103483c76ad6dd08624da97650a2d4447
Opcode Fuzzy Hash: c3913dbd7ac63484fec00311d5e005f100e6d7329399cd73869c2280a8313674
Instruction Fuzzy Hash: E6714276941239BBDB309BA4EC4DBAABBB8BF49710F0001A5F905E71D0D7749E84DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00534B96 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 122COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 00534BC9
StringFromGUID2.OLE32(?,?,00000027), ref: 00534BF8
UuidCreate.RPCRT4(?), ref: 00534C43
StringFromGUID2.OLE32(?,?,00000027), ref: 00534C6F

Strings

BurnPipe.%s, xrefs: 00534C24
Failed to allocate pipe secret., xrefs: 00534C98
pipe.cpp, xrefs: 00534C09, 00534C56
Failed to create pipe guid., xrefs: 00534BD6
Failed to allocate pipe name., xrefs: 00534C38
Failed to convert pipe guid into string., xrefs: 00534C15

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CreateFromStringUuid
String ID: BurnPipe.%s$Failed to allocate pipe name.$Failed to allocate pipe secret.$Failed to convert pipe guid into string.$Failed to create pipe guid.$pipe.cpp
API String ID: 4041566446-2510341293
Opcode ID: 13d8797df9f95249c55f10828219818125818790ba814e774873ad718f8345e8
Instruction ID: d015aa466584559a3424691c2ea7fec7da9acb44fce3643754a07c8d89223439
Opcode Fuzzy Hash: 13d8797df9f95249c55f10828219818125818790ba814e774873ad718f8345e8
Instruction Fuzzy Hash: 31418E72E0131CABDB10DBE4D949E9EBBB8BB55710F204526E909FB240E774AE44DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00525F14 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 105timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00525F3F
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 00525F53
GetLastError.KERNEL32 ref: 00525F65
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,00000000,?,00000000), ref: 00525FB8
GetLastError.KERNEL32 ref: 00525FC2

Strings

variable.cpp, xrefs: 00525F7F, 00525FDC
Failed to allocate the buffer for the Date., xrefs: 00525FA0
Failed to set variant value., xrefs: 00525FFF
Failed to get the Date., xrefs: 00525FE6
Failed to get the required buffer length for the Date., xrefs: 00525F89

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: DateErrorFormatLast$SystemTime
String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$variable.cpp
API String ID: 2700948981-3682088697
Opcode ID: b684674086e3f2c09a1c8647b4fbf4ee53efa0ec460b5a15877dfe6baeb68b84
Instruction ID: edd150484ec049ace5f2827e3bbe4a167827bdf1f63f18bc55abaf9a8aed089e
Opcode Fuzzy Hash: b684674086e3f2c09a1c8647b4fbf4ee53efa0ec460b5a15877dfe6baeb68b84
Instruction Fuzzy Hash: 83319972A4062ABADB21AAE9DC49EAF7EA8FF45710F110025FA01F71D0E6709D4497A1

Uniqueness

Uniqueness Score: -1.00%

Function 0053E82A Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 99threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,00525386,?,?), ref: 0053E84A
GetLastError.KERNEL32(?,00525386,?,?), ref: 0053E857
CreateThread.KERNEL32(00000000,00000000,0053E563,?,00000000,00000000), ref: 0053E8B0
GetLastError.KERNEL32(?,00525386,?,?), ref: 0053E8BD
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,00525386,?,?), ref: 0053E8F8
CloseHandle.KERNEL32(00000000,?,00525386,?,?), ref: 0053E917
CloseHandle.KERNEL32(?,?,00525386,?,?), ref: 0053E924

Strings

Failed to create the UI thread., xrefs: 0053E8E8
uithread.cpp, xrefs: 0053E878, 0053E8DE
Failed to create initialization event., xrefs: 0053E882

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$uithread.cpp
API String ID: 2351989216-3599963359
Opcode ID: ee63bd4e89252befc616d5a2a4386fff05ad257399dd351007d11927110f2e0c
Instruction ID: 65b03f6de42181041205f415c90a5db56f6211fc2ad40c0fc568ac016b1f837f
Opcode Fuzzy Hash: ee63bd4e89252befc616d5a2a4386fff05ad257399dd351007d11927110f2e0c
Instruction Fuzzy Hash: D8314176E40219BBEB119FA99D85AAFBFECFF08350F114126F905E3190D6709E009BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0053E3F4 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 95threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,00000000,?,?,00525386,?,?), ref: 0053E415
GetLastError.KERNEL32(?,?,00525386,?,?), ref: 0053E422
CreateThread.KERNEL32(00000000,00000000,0053E177,00000000,00000000,00000000), ref: 0053E481
GetLastError.KERNEL32(?,?,00525386,?,?), ref: 0053E48E
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,00525386,?,?), ref: 0053E4C9
CloseHandle.KERNEL32(?,?,?,00525386,?,?), ref: 0053E4DD
CloseHandle.KERNEL32(?,?,?,00525386,?,?), ref: 0053E4EA

Strings

splashscreen.cpp, xrefs: 0053E443, 0053E4AF
Failed to create modal event., xrefs: 0053E44D
Failed to create UI thread., xrefs: 0053E4B9

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create UI thread.$Failed to create modal event.$splashscreen.cpp
API String ID: 2351989216-1977201954
Opcode ID: fb4b6ec1c7e02e63e20591b464aea7c6734f2a8928738eb079767c9300c39167
Instruction ID: dd42e79f88fbdedb62906a3b8b6e7c4fbf2b9fa028fcde44bb220cd9aaba97c5
Opcode Fuzzy Hash: fb4b6ec1c7e02e63e20591b464aea7c6734f2a8928738eb079767c9300c39167
Instruction Fuzzy Hash: 69313E75D00319BAEB119BA99C45AAFBFF8FB88710F10812AFD15F3190D7744A41DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00541224 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,75332F60,?,?,005252FD,005252B5,00000000,0052533D), ref: 00541249
GetLastError.KERNEL32 ref: 0054125C
GetExitCodeThread.KERNEL32(0056B478,?), ref: 0054129E
GetLastError.KERNEL32 ref: 005412AC
ResetEvent.KERNEL32(0056B450), ref: 005412E7
GetLastError.KERNEL32 ref: 005412F1

Strings

Failed to reset operation complete event., xrefs: 00541322
cabextract.cpp, xrefs: 00541280, 005412D0, 00541315
Failed to wait for operation complete event., xrefs: 0054128D
Failed to get extraction thread exit code., xrefs: 005412DD

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$cabextract.cpp
API String ID: 2979751695-3400260300
Opcode ID: 88149bcb592328f8255cc41b79a583d462e9e90257cbfa12efde125c3a2a65dc
Instruction ID: 1ad198c5b60a747e8f6b2cede75fc8335d95b4688e80e31413ec9d44a740e4fd
Opcode Fuzzy Hash: 88149bcb592328f8255cc41b79a583d462e9e90257cbfa12efde125c3a2a65dc
Instruction Fuzzy Hash: 6F21C175740704AFEB189B3A9D19ABE7FE8FF44710F00412EF94AD61A0E774CA40AB15

Uniqueness

Uniqueness Score: -1.00%

Function 0052D5C0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?,005246F8,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00525386,?,?), ref: 0052D5CD
GetLastError.KERNEL32(?,005246F8,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00525386,?,?), ref: 0052D5DA
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 0052D612
GetLastError.KERNEL32(?,005246F8,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00525386,?,?), ref: 0052D61E

Strings

userexperience.cpp, xrefs: 0052D5FB, 0052D63F
BootstrapperApplicationCreate, xrefs: 0052D60C
Failed to create UX., xrefs: 0052D662
Failed to get BootstrapperApplicationCreate entry-point, xrefs: 0052D649
Failed to load UX DLL., xrefs: 0052D605
wininet.dll, xrefs: 0052D5F8, 0052D63C, 0052D667

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$userexperience.cpp$wininet.dll
API String ID: 1866314245-1140179540
Opcode ID: 8ea829c828b3afbea766fc3aedd361047132650e7e35b13b4fce677408363aca
Instruction ID: 17385fd40023971d92da594afd12256fa7ce6ede1799b16c48a6804a69e8574c
Opcode Fuzzy Hash: 8ea829c828b3afbea766fc3aedd361047132650e7e35b13b4fce677408363aca
Instruction Fuzzy Hash: 3511A032A40731ABEB215A69BC09B677EE4FF06761F01412AFD09E71D0DB65DC409BE4

Uniqueness

Uniqueness Score: -1.00%

Function 005391F7 Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 223COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,?,00000000,00000000,00000003,00000000,00000000), ref: 00539297
GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,000007D0,00000001), ref: 005392BB

Strings

0, xrefs: 00539357
$, xrefs: 00539396
Could not close verify handle., xrefs: 0053944E
cache.cpp, xrefs: 005392DB, 005393F3, 00539444
Failed to allocate string., xrefs: 0053932D
Failed to get file hash., xrefs: 005392E5
Could not verify file %ls., xrefs: 00539400
Failed to allocate memory, xrefs: 00539268
Failed to encode file hash., xrefs: 0053934A

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast
String ID: $$0$Could not close verify handle.$Could not verify file %ls.$Failed to allocate memory$Failed to allocate string.$Failed to encode file hash.$Failed to get file hash.$cache.cpp
API String ID: 1452528299-4263581490
Opcode ID: 6c8cad18e531613ec1554ead53d12732b2e2df597030a144c800df135e2cfef8
Instruction ID: 022dc5371dcd278468a1a89e7b1c6b52516d9d6c8f293ea2aeccbe31f8310f6b
Opcode Fuzzy Hash: 6c8cad18e531613ec1554ead53d12732b2e2df597030a144c800df135e2cfef8
Instruction Fuzzy Hash: 487162B1D00229AADF11DBA9DC45BEFBFF8BF48310F114126E914F7291E77499458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0053E31B Relevance: 16.6, APIs: 11, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0053E326
DefWindowProcW.USER32(?,00000082,?,?), ref: 0053E364
SetWindowLongW.USER32(?,000000EB,00000000), ref: 0053E371
SetWindowLongW.USER32(?,000000EB,?), ref: 0053E380
DefWindowProcW.USER32(?,?,?,?), ref: 0053E38E
CreateCompatibleDC.GDI32(?), ref: 0053E39A
SelectObject.GDI32(00000000,00000000), ref: 0053E3AB
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0053E3CD
SelectObject.GDI32(00000000,00000000), ref: 0053E3D5
DeleteDC.GDI32(00000000), ref: 0053E3D8
PostQuitMessage.USER32(00000000), ref: 0053E3E6

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Window$Long$ObjectProcSelect$CompatibleCreateDeleteMessagePostQuitStretch
String ID:
API String ID: 409979828-0
Opcode ID: 297eaf95f0e5187127472ea6b671d3f3991dc8c7a3d7c35e72e4334441ff4782
Instruction ID: 654121d7965443d6d120c40e76b49f30746f3dd2e1398cf2121ad88f831e3f14
Opcode Fuzzy Hash: 297eaf95f0e5187127472ea6b671d3f3991dc8c7a3d7c35e72e4334441ff4782
Instruction Fuzzy Hash: 24218C32204108BFEB155F68DC4DE7B3FA9FB89321F154918F616D72A0D7B19810AB61

Uniqueness

Uniqueness Score: -1.00%

Function 00539F36 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 220COMMON

Download Yara Rule

Strings

Failed to combine layout source with source., xrefs: 0053A0A0
Failed to get bundle layout directory property., xrefs: 0053A083
WixBundleLayoutDirectory, xrefs: 0053A068
Failed to combine last source with source., xrefs: 0053A00C
Failed to get current process directory., xrefs: 00539FEF
Failed to copy source path., xrefs: 0053A113
WixBundleOriginalSource, xrefs: 00539FB3
WixBundleLastUsedSource, xrefs: 00539F9D

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Find$CloseFileFirstlstrlen
String ID: Failed to combine last source with source.$Failed to combine layout source with source.$Failed to copy source path.$Failed to get bundle layout directory property.$Failed to get current process directory.$WixBundleLastUsedSource$WixBundleLayoutDirectory$WixBundleOriginalSource
API String ID: 2767606509-3003062821
Opcode ID: f4ada13ca6554a86427d63e9cdbcbb94ad1a7723fc8780856d64833f002184f8
Instruction ID: 508aef5f3edb3d83edab9430b33393ee07cfc2570822c29d6dd7aa3f72d508c2
Opcode Fuzzy Hash: f4ada13ca6554a86427d63e9cdbcbb94ad1a7723fc8780856d64833f002184f8
Instruction Fuzzy Hash: 24716E71D0022AAADF26DFA4D8499EEBFB5BF48310F100129F901F7290EB759D40DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00523083 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,00000000,00000040,00000000,00000000), ref: 005230C7
GetLastError.KERNEL32 ref: 005230D1
ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00523129
GetLastError.KERNEL32 ref: 00523133
GetFullPathNameW.KERNEL32(00000000,00000040,00000000,00000000,00000000,00000040,00000000,00000000), ref: 005231EC
GetLastError.KERNEL32 ref: 005231F6
GetFullPathNameW.KERNEL32(00000000,00000007,00000000,00000000,00000000,00000007), ref: 0052324D
GetLastError.KERNEL32 ref: 00523257

Strings

pathutil.cpp, xrefs: 005230F5

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
String ID: pathutil.cpp
API String ID: 1547313835-741606033
Opcode ID: 8ce37d99ab0741b51f42b33b46a2deb797f5521dd5529b1bb6038d8bb29efac5
Instruction ID: 285ea1059a61558621a9fd5719c67016c74c94513c3f7025dff232dc099cea54
Opcode Fuzzy Hash: 8ce37d99ab0741b51f42b33b46a2deb797f5521dd5529b1bb6038d8bb29efac5
Instruction Fuzzy Hash: 6761A136E00239EBEF219AA89C48BAE7EE8FF45750F114565ED05E7190E7398F40DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00524690 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 128windowthreadCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 005246B5
GetCurrentThreadId.KERNEL32 ref: 005246BB
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00524749

Strings

Failed to start bootstrapper application., xrefs: 00524717
engine.cpp, xrefs: 00524795
Failed to create engine for UX., xrefs: 005246D5
Failed to load UX., xrefs: 005246FE
wininet.dll, xrefs: 005246E8
Unexpected return value from message pump., xrefs: 0052479F

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Message$CurrentPeekThread
String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$engine.cpp$wininet.dll
API String ID: 673430819-2573580774
Opcode ID: 2ad7cdf0cf0e079daf042b368d1228fe04e8383e2d305f54810caa5509ded0d2
Instruction ID: 6e4de777f9826f863f895d7c483c89a722dd3ab465f467ed350b6be8a62feece
Opcode Fuzzy Hash: 2ad7cdf0cf0e079daf042b368d1228fe04e8383e2d305f54810caa5509ded0d2
Instruction Fuzzy Hash: 3641937260012ABFE7149BA4DC89EBABFACFF06314F140525F915E71C0EB34AD459BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00538CB5 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,?,00000001,80000005,?,00000000,00000000,00000000,00000003,000007D0), ref: 00538E01

Strings

Failed to secure cache path: %ls, xrefs: 00538DE4
Failed to allocate access for Users group to path: %ls, xrefs: 00538D6B
Failed to allocate access for Administrators group to path: %ls, xrefs: 00538D08
Failed to allocate access for Everyone group to path: %ls, xrefs: 00538D4A
Failed to create ACL to secure cache path: %ls, xrefs: 00538DB7
cache.cpp, xrefs: 00538DAC
Failed to allocate access for SYSTEM group to path: %ls, xrefs: 00538D29

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: FreeLocal
String ID: Failed to allocate access for Administrators group to path: %ls$Failed to allocate access for Everyone group to path: %ls$Failed to allocate access for SYSTEM group to path: %ls$Failed to allocate access for Users group to path: %ls$Failed to create ACL to secure cache path: %ls$Failed to secure cache path: %ls$cache.cpp
API String ID: 2826327444-4113288589
Opcode ID: e85f225857d739d93481a48484acd32b16a2cff877a8a16ff679c0223cbb6fce
Instruction ID: 6529ce22603dbf21f2cee4a45aff3fdf902e54450f2b09a464cd227f3841ac96
Opcode Fuzzy Hash: e85f225857d739d93481a48484acd32b16a2cff877a8a16ff679c0223cbb6fce
Instruction Fuzzy Hash: C541D271A4132AB6EB3196659C49FBB7FA8FB54B10F004465F908BB1C1DE609E48E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00549A57 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 125COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,0054ADE5,?,00000001,00000000), ref: 00549AE1
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,0054ADE5,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 00549AEB
CopyFileExW.KERNEL32(00000000,00000000,0054993C,00000000,00000020,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00549B39
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,0054ADE5,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 00549B68

Strings

apply.cpp, xrefs: 00549B0F, 00549B53, 00549B8C
copy, xrefs: 00549AAF
Failed attempt to copy payload from: '%ls' to: %ls., xrefs: 00549B9A
Failed to clear readonly bit on payload destination path: %ls, xrefs: 00549B1A
BA aborted copy of payload from: '%ls' to: %ls., xrefs: 00549B61

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFileLast$AttributesCopy
String ID: BA aborted copy of payload from: '%ls' to: %ls.$Failed attempt to copy payload from: '%ls' to: %ls.$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$copy
API String ID: 1969131206-836986073
Opcode ID: 104ec8cfd048db3f75230ca9e2d64c202aa13ecaf152d5f7ca805d92b83f4495
Instruction ID: bac8d2444f4186db7a5ed69310485754e9230f78139007db71960ef5c9509c67
Opcode Fuzzy Hash: 104ec8cfd048db3f75230ca9e2d64c202aa13ecaf152d5f7ca805d92b83f4495
Instruction Fuzzy Hash: CC31D571740216BBEB109A66DC46EBBBF9DFF45754B108129BC09E7191E760CD00D6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00566ACD Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 116COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,7532DFD0,000000FF,name,000000FF,7532DFD0,?,7532DFD0,?,7532DFD0), ref: 00566B2B
CompareStringW.KERNEL32(0000007F,00000000,000000FF,000000FF,email,000000FF), ref: 00566B48
SysFreeString.OLEAUT32(00000000), ref: 00566B86
SysFreeString.OLEAUT32(00000000), ref: 00566BCD

Strings

email, xrefs: 00566B3A
9qV, xrefs: 00566AD5, 00566AE5
uri, xrefs: 00566B56
name, xrefs: 00566B1D

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: String$CompareFree
String ID: 9qV$email$name$uri
API String ID: 3589242889-42101009
Opcode ID: a3cbd7a6b5ba8a5ccd290a24b77ba85bd64600f35c71e1f3e231bdb8d0bfe95b
Instruction ID: 80f2e2e36140751417b17ddeea4108298edf7335cbc3ae15d4a6d301ef73d856
Opcode Fuzzy Hash: a3cbd7a6b5ba8a5ccd290a24b77ba85bd64600f35c71e1f3e231bdb8d0bfe95b
Instruction Fuzzy Hash: 19412E35A05219FBDB11DB94CC55FAEBBB5FB04720F2042A5E911E72A0CB319E44DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0053E05E Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(?,00000001), ref: 0053E094
GetLastError.KERNEL32 ref: 0053E0A0
GetObjectW.GDI32(00000000,00000018,?), ref: 0053E0E7
GetCursorPos.USER32(?), ref: 0053E108
MonitorFromPoint.USER32(?,?,00000002), ref: 0053E11A
GetMonitorInfoW.USER32(00000000,?), ref: 0053E130

Strings

splashscreen.cpp, xrefs: 0053E0C4
Failed to load splash screen bitmap., xrefs: 0053E0CE
(, xrefs: 0053E127

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Monitor$BitmapCursorErrorFromInfoLastLoadObjectPoint
String ID: ($Failed to load splash screen bitmap.$splashscreen.cpp
API String ID: 2342928100-598475503
Opcode ID: 186d984d7989388019a7557def93b32043ec69d4a70302c11dc1444bd5c95ca7
Instruction ID: 16f8045ab98917c2082080e775b0f330bf709c4aeae501496a5c4ade31041086
Opcode Fuzzy Hash: 186d984d7989388019a7557def93b32043ec69d4a70302c11dc1444bd5c95ca7
Instruction Fuzzy Hash: 80313F71A002199FDB10DFB8D949A9EBBF5FB08710F148529ED04EB290EB70D945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0052C7DF Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 97fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0052CC57: CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,0052E336,000000FF,00000000,00000000,0052E336,?,?,0052DADD,?,?,?,?), ref: 0052CC82

CreateFileW.KERNEL32(E90056BA,80000000,00000005,00000000,00000003,08000000,00000000,005252BD,0056B450,00000000,005253B5,04680A79,?,005252B5,00000000,00525381), ref: 0052C84F
GetLastError.KERNEL32(?,?,?,005375F7,00525565,00525371,00525371,00000000,?,00525381,FFF9E89D,00525381,005253B5,0052533D,?,0052533D), ref: 0052C894

Strings

=SR, xrefs: 0052C86F
Failed to verify catalog signature: %ls, xrefs: 0052C88D
catalog.cpp, xrefs: 0052C8B5
Failed to open catalog in working path: %ls, xrefs: 0052C8C2
Failed to get catalog local file path, xrefs: 0052C8D2
=SR, xrefs: 0052C7E5, 0052C872
Failed to find payload for catalog file., xrefs: 0052C8D9

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CompareCreateErrorFileLastString
String ID: =SR$=SR$Failed to find payload for catalog file.$Failed to get catalog local file path$Failed to open catalog in working path: %ls$Failed to verify catalog signature: %ls$catalog.cpp
API String ID: 1774366664-1824505113
Opcode ID: 1f3d907174469ae898f6c93c5cf33328d6228ab1a9f871227ffdab1ccbfbc48e
Instruction ID: c3ca1488e9eaf0c3cbb56e4766520b0a7a454a96cf48acabd0e60515451f42fa
Opcode Fuzzy Hash: 1f3d907174469ae898f6c93c5cf33328d6228ab1a9f871227ffdab1ccbfbc48e
Instruction Fuzzy Hash: 8931D132E40625BBD7109B68EC45B5EBFA4FF06710F108229F908EB2D1E770AD509B90

Uniqueness

Uniqueness Score: -1.00%

Function 005264B6 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 93COMMON

Download Yara Rule

APIs

GetSystemWow64DirectoryW.KERNEL32(?,00000104), ref: 005264F7
GetLastError.KERNEL32 ref: 00526505
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00526546
GetLastError.KERNEL32 ref: 00526550

Strings

Failed to get 64-bit system folder., xrefs: 0052657E
Failed to get 32-bit system folder., xrefs: 0052653F
Failed to set system folder variant value., xrefs: 005265BE
variable.cpp, xrefs: 00526535, 00526574
Failed to backslash terminate system folder., xrefs: 005265A2

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: DirectoryErrorLastSystem$Wow64
String ID: Failed to backslash terminate system folder.$Failed to get 32-bit system folder.$Failed to get 64-bit system folder.$Failed to set system folder variant value.$variable.cpp
API String ID: 2634638900-1590374846
Opcode ID: 07ff9e00761a3f2e17cbffe87a85771b4c1e1eda2007185c399014ef2425d6a0
Instruction ID: 061e28eae24c76b9db7d30f7fdf08c52087b6945ce546aaa0c3416c4b4bbe1d3
Opcode Fuzzy Hash: 07ff9e00761a3f2e17cbffe87a85771b4c1e1eda2007185c399014ef2425d6a0
Instruction Fuzzy Hash: 5E21D772F4133566EB20A669AC0DBAA3EE8BF42750F110165FC08E71C0E6648E4496E1

Uniqueness

Uniqueness Score: -1.00%

Function 00534ED2 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,?,?,0056B4F0), ref: 00534EDB
GetProcessId.KERNEL32(000000FF,?,?,open,00000000,00000000,?,000000FF,?,?), ref: 00534F79
CloseHandle.KERNEL32(00000000), ref: 00534F92

Strings

runas, xrefs: 00534F39
Failed to launch elevated child process: %ls, xrefs: 00534F66
-q -%ls %ls %ls %u, xrefs: 00534F00
Failed to allocate parameters for elevated process., xrefs: 00534F14
open, xrefs: 00534F43, 00534F51
burn.elevated, xrefs: 00534EFB

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Process$CloseCurrentHandle
String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
API String ID: 2815245435-1352204306
Opcode ID: e63574956c82227ed6e82ccb693c72a46985b1b221b89694649f44825a8c2be3
Instruction ID: 92c2b4349f62802be004c019a0d2286fe70e4d26eeefdf019c6c5bd82c99a2b0
Opcode Fuzzy Hash: e63574956c82227ed6e82ccb693c72a46985b1b221b89694649f44825a8c2be3
Instruction Fuzzy Hash: 38213775D00219BB9F119F94D8858AEBFB8FF04351F10816AF814A3251D771AE60EF90

Uniqueness

Uniqueness Score: -1.00%

Function 0052671C Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(msi,DllGetVersion), ref: 00526746
GetProcAddress.KERNEL32(00000000), ref: 0052674D
GetLastError.KERNEL32 ref: 00526757

Strings

msi, xrefs: 0052673D
DllGetVersion, xrefs: 00526738
variable.cpp, xrefs: 0052677B
Failed to get msi.dll version info., xrefs: 0052679F
Failed to find DllGetVersion entry point in msi.dll., xrefs: 00526785
Failed to set variant value., xrefs: 005267C3

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: DllGetVersion$Failed to find DllGetVersion entry point in msi.dll.$Failed to get msi.dll version info.$Failed to set variant value.$msi$variable.cpp
API String ID: 4275029093-842451892
Opcode ID: 2c32f5ded0bc12bdc6a25ad7d671e91103910a25e8129069e084aeed6613349d
Instruction ID: 3fe6d8cdfbf09f6df4845e88c0125cd9d68d4e9c7867300af27cffa8f1adf2b2
Opcode Fuzzy Hash: 2c32f5ded0bc12bdc6a25ad7d671e91103910a25e8129069e084aeed6613349d
Instruction Fuzzy Hash: 48118472B40635AAE720ABB9AC45ABB7EE8FF49714F100529FD05F7180DA649D0492A1

Uniqueness

Uniqueness Score: -1.00%

Function 00521174 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 53libraryloadermemoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,0052111A,cabinet.dll,00000009,?,?,00000000), ref: 00521185
GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,0052111A,cabinet.dll,00000009,?,?,00000000), ref: 00521190
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0052119E
GetLastError.KERNEL32(?,?,?,?,0052111A,cabinet.dll,00000009,?,?,00000000), ref: 005211B9
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 005211C1
GetLastError.KERNEL32(?,?,?,?,0052111A,cabinet.dll,00000009,?,?,00000000), ref: 005211D6

Strings

SetDefaultDllDirectories, xrefs: 00521198
kernel32, xrefs: 0052118B
SetDllDirectoryW, xrefs: 005211BB

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AddressErrorLastProc$HandleHeapInformationModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 3104334766-1824683568
Opcode ID: c625a1a6a6075d5d6ac3c5548ca46abc180291aebe3e272024dd9a1fcc1f2ba5
Instruction ID: 4ba1758058bf22fb4a882b95bc9b875f32a72a35a8534010c994daad2c839450
Opcode Fuzzy Hash: c625a1a6a6075d5d6ac3c5548ca46abc180291aebe3e272024dd9a1fcc1f2ba5
Instruction Fuzzy Hash: 1201F531200625BBAB202BAAAC09DAF7F1CFF617A07004011FE01D3080EB70DA45CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 0053F3E6 Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 155COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0053F3FB
LeaveCriticalSection.KERNEL32(?), ref: 0053F576

Strings

Failed to set download URL., xrefs: 0053F4D5
UX requested unknown payload with id: %ls, xrefs: 0053F450
Failed to set download password., xrefs: 0053F524
Engine is active, cannot change engine state., xrefs: 0053F415
UX denied while trying to set download URL on embedded payload: %ls, xrefs: 0053F466
UX requested unknown container with id: %ls, xrefs: 0053F4A0
UX did not provide container or payload id., xrefs: 0053F565
Failed to set download user., xrefs: 0053F4FE

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set download URL.$Failed to set download password.$Failed to set download user.$UX denied while trying to set download URL on embedded payload: %ls$UX did not provide container or payload id.$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-2615595102
Opcode ID: b7818f593f9be729c25e523af1e51a0f98a0efc59fc69a7106529d1c4f36aa52
Instruction ID: 0cc8993130fa7166c6d9679a8beaa38485d5ff3a3adf65eaaf216e0f64a4e741
Opcode Fuzzy Hash: b7818f593f9be729c25e523af1e51a0f98a0efc59fc69a7106529d1c4f36aa52
Instruction Fuzzy Hash: 7741D272E00212BBDB219E24D809E6B7FA8FF81711F158176F804E7281EB74DD50D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0053A998 Relevance: 15.1, APIs: 2, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,000000FF,00AAC56B,?,005252B5,00000000,=SR), ref: 0053AA90
GetLastError.KERNEL32(00000000,00000000,00000000,00000000,?,000000FF,00AAC56B,?,005252B5,00000000,=SR), ref: 0053AAD4

Strings

Failed to get signer chain from authenticode certificate., xrefs: 0053AB02
cache.cpp, xrefs: 0053AA66, 0053AAB4, 0053AAF8
Failed to get provider state from authenticode certificate., xrefs: 0053AABE
Failed to verify expected payload against actual certificate chain., xrefs: 0053AB1A
Failed authenticode verification of payload: %ls, xrefs: 0053AA71
=SR, xrefs: 0053A9A8
qSRqSR, xrefs: 0053A9B1
=SR, xrefs: 0053A9AB

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast
String ID: =SR$=SR$Failed authenticode verification of payload: %ls$Failed to get provider state from authenticode certificate.$Failed to get signer chain from authenticode certificate.$Failed to verify expected payload against actual certificate chain.$cache.cpp$qSRqSR
API String ID: 1452528299-1317809438
Opcode ID: 2c2eb6ebd6ec0397c61b5c002d6152e198d4316a8c017fc7d2cb6d6b08d54115
Instruction ID: b8989b3f529bbe4bb9b19e34f45b75a73184b53451fec5e7e86435f0998c17b5
Opcode Fuzzy Hash: 2c2eb6ebd6ec0397c61b5c002d6152e198d4316a8c017fc7d2cb6d6b08d54115
Instruction Fuzzy Hash: DF4182B1E00629ABEB119BA9DD49ADFBFE8FF49310F00012AFD04F7181E770990497A5

Uniqueness

Uniqueness Score: -1.00%

Function 00565916 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 194filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(000000FF,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,00000000,00000000,00000078,00000000,000000FF,?,00000000,00000000), ref: 00565955
GetLastError.KERNEL32 ref: 00565963
VirtualAlloc.KERNEL32(00000000,00010000,00003000,00000004), ref: 005659A4
GetLastError.KERNEL32 ref: 005659B1
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00565B26
CloseHandle.KERNEL32(?), ref: 00565B35

Strings

GET, xrefs: 00565A58
dlutil.cpp, xrefs: 00565987

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLastVirtual$AllocCloseCreateFileFreeHandle
String ID: GET$dlutil.cpp
API String ID: 2028584396-3303425918
Opcode ID: fd76d4b66d8f660d86496f58e522fa5daf3377a66c2b6fe6fec9384936bc5b9a
Instruction ID: b8ac7374f7d183b5d8dc96dae6d5156b7bb4538b63b4daad45b0355ff2a09e3a
Opcode Fuzzy Hash: fd76d4b66d8f660d86496f58e522fa5daf3377a66c2b6fe6fec9384936bc5b9a
Instruction Fuzzy Hash: B0614771A4061AABEB11DFA8CC84BAE7FB9BF58361F114219FE05F3250E7709940DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00530AAE Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 00530E7E: CompareStringW.KERNEL32(00000000,00000000,feclient.dll,000000FF,00000000,000000FF,00000000,00000000,?,?,00530ACD,?,00000000,?,00000000,00000000), ref: 00530EAD

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,00000000,?,00000000,00000001,?,?,00000000,?,00000000), ref: 00530C51
GetLastError.KERNEL32 ref: 00530C5E

Strings

Failed to create syncpoint event., xrefs: 00530C8C
plan.cpp, xrefs: 00530C82
Failed to append rollback cache action., xrefs: 00530B2D
Failed to append payload cache action., xrefs: 00530C08
Failed to append package start action., xrefs: 00530AF3
Failed to append cache action., xrefs: 00530BA8

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CompareCreateErrorEventLastString
String ID: Failed to append cache action.$Failed to append package start action.$Failed to append payload cache action.$Failed to append rollback cache action.$Failed to create syncpoint event.$plan.cpp
API String ID: 801187047-2489563283
Opcode ID: f4226a8c957e737bc633e8f8f4bbba592431e3e09ada40180f819edd16b617cc
Instruction ID: 8ab8c280dfdfd6eee8e9dca30ed79838133f778e3e10159a0c6d88936b792ee3
Opcode Fuzzy Hash: f4226a8c957e737bc633e8f8f4bbba592431e3e09ada40180f819edd16b617cc
Instruction Fuzzy Hash: A2618D75500705EFDB05DF68C8A4A6ABBF9FF84310F21945AE8199B291DB30EE41EB50

Uniqueness

Uniqueness Score: -1.00%

Function 0053D01A Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 117threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,0053AB3C,?,00000000,00000000), ref: 0053D0B8
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0053D0C4
CloseHandle.KERNEL32(00000000,00000000,?,?,0053C59C,00000001,?,?,?,?,?,00000000,00000000,?,?,?), ref: 0053D145

Strings

elevation.cpp, xrefs: 0053D0E8
Failed to create elevated cache thread., xrefs: 0053D0F2
Failed to pump messages in child process., xrefs: 0053D11C
LDR, xrefs: 0053D052, 0053D0E2, 0053D0F7
^SR, xrefs: 0053D070

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseCreateErrorHandleLastThread
String ID: Failed to create elevated cache thread.$Failed to pump messages in child process.$LDR$^SR$elevation.cpp
API String ID: 747004058-2297995052
Opcode ID: d38d24960bf9c669e92bb3e411dcf4c26d7adc3b6d5fd16ed7474b0920bdef23
Instruction ID: 6e2a3aeef413d97fd93052a5359e6cfdfbae530d844e44865a77d54cd927385d
Opcode Fuzzy Hash: d38d24960bf9c669e92bb3e411dcf4c26d7adc3b6d5fd16ed7474b0920bdef23
Instruction Fuzzy Hash: E041B3B5E01219AF9B05DFA9D8859EEBBF8FF48350F10412AF918E7340D774A9418BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0053473A Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 115fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,?,00000008,?,00000000,?,00000000,00000000,?,00000000,@GR,?,?,00000000,?,00000000), ref: 00534765
GetLastError.KERNEL32 ref: 00534772
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,00000000), ref: 0053481B
GetLastError.KERNEL32 ref: 00534825

Strings

pipe.cpp, xrefs: 005347CF, 005347E6, 00534849
Failed to read data for message., xrefs: 00534853
Failed to read message from pipe., xrefs: 005347F0
Failed to allocate data for message., xrefs: 005347D9

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$pipe.cpp
API String ID: 1948546556-3912962418
Opcode ID: 9253d41b3b898cf14ed6a224a9671726d34434ad728763d66cf601368157a882
Instruction ID: 5efd0ed7c73dd62e2c14bb3d9862ea9e386b73357ea2375f5f36c541744f6b85
Opcode Fuzzy Hash: 9253d41b3b898cf14ed6a224a9671726d34434ad728763d66cf601368157a882
Instruction Fuzzy Hash: 1931C571A4022ABBEB109F65DC45BAAFF68FF05751F108125F804E6180D774AE41DFD1

Uniqueness

Uniqueness Score: -1.00%

Function 005351E9 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 90synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0002BF20,?,F0000003,00000000,00000000,?,00000000,00000000,00000000,00525386,00000000,00000000,?,00000000), ref: 00535292
GetLastError.KERNEL32(?,?,?,00524B5B,?,?,00000000,?,?,?,?,?,?,0056B490,?,?), ref: 0053529D

Strings

Failed to wait for child process exit., xrefs: 005352CB
Failed to post terminate message to child process., xrefs: 0053527D
Failed to write restart to message buffer., xrefs: 00535235
pipe.cpp, xrefs: 005352C1
Failed to post terminate message to child process cache thread., xrefs: 00535261
Failed to write exit code to message buffer., xrefs: 0053520D

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: Failed to post terminate message to child process cache thread.$Failed to post terminate message to child process.$Failed to wait for child process exit.$Failed to write exit code to message buffer.$Failed to write restart to message buffer.$pipe.cpp
API String ID: 1211598281-2161881128
Opcode ID: 2ab1d6eec4c8af6e3cf797af47f00c74d9218081fc21ad759ad827c12b32030d
Instruction ID: 71d4df8926cd8fd7b1d96d412943e980ce5e2f2decec20cd920fadd608a1d8ee
Opcode Fuzzy Hash: 2ab1d6eec4c8af6e3cf797af47f00c74d9218081fc21ad759ad827c12b32030d
Instruction Fuzzy Hash: 1721F836940B29BBDB125AA49C05E9FBFA8FF00321F114311F914B6190E7319E50FBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00538E92 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 88fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000101,?,00539CFF,00000003,000007D0,00000003,?,000007D0), ref: 00538EAC
GetLastError.KERNEL32(?,00539CFF,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000000,-00000004), ref: 00538EB9
CloseHandle.KERNEL32(00000000,?,00539CFF,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000000), ref: 00538F80

Strings

Failed to verify catalog signature of payload: %ls, xrefs: 00538F47
Failed to verify signature of payload: %ls, xrefs: 00538F28
cache.cpp, xrefs: 00538EEF
Failed to open payload at path: %ls, xrefs: 00538EFC
Failed to verify hash of payload: %ls, xrefs: 00538F6B

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$cache.cpp
API String ID: 2528220319-2757871984
Opcode ID: 46904d1735f85668535f9c015d0d273423a1c8a3be971f69cc659c4db405a10b
Instruction ID: caea62d07dc4170df3f53ca33102f8a298dfd61e300ce21f4dacea5726f86aaa
Opcode Fuzzy Hash: 46904d1735f85668535f9c015d0d273423a1c8a3be971f69cc659c4db405a10b
Instruction Fuzzy Hash: 8321E536640B297BDB261A689C49B7B7F16BF04770F144211FC14A6190DB759CA0EBD1

Uniqueness

Uniqueness Score: -1.00%

Function 005269B8 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00526A03
GetLastError.KERNEL32 ref: 00526A0D
GetVolumePathNameW.KERNEL32(?,?,00000104), ref: 00526A51
GetLastError.KERNEL32 ref: 00526A5B

Strings

Failed to get volume path name., xrefs: 00526A89
Failed to get windows directory., xrefs: 00526A3B
variable.cpp, xrefs: 00526A31, 00526A7F
Failed to set variant value., xrefs: 00526AA5

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast$DirectoryNamePathVolumeWindows
String ID: Failed to get volume path name.$Failed to get windows directory.$Failed to set variant value.$variable.cpp
API String ID: 124030351-4026719079
Opcode ID: ee7b67719bf87ac4bfd2458b98784d9cbce156901d502500f6a7e56487cc6f7f
Instruction ID: 7088006cd20e219223e8ed122a73bfa687876ac3c7e3be81120bfc7636b0577f
Opcode Fuzzy Hash: ee7b67719bf87ac4bfd2458b98784d9cbce156901d502500f6a7e56487cc6f7f
Instruction Fuzzy Hash: 2521F372E00338ABEB20A6A89C49F9B7AECAF81710F014166FD05F3181E7749D8486A5

Uniqueness

Uniqueness Score: -1.00%

Function 0053AB3C Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 0053AB53
GetLastError.KERNEL32 ref: 0053AB5D
CoInitializeEx.OLE32(00000000,00000000), ref: 0053AB9C
CoUninitialize.OLE32(?,0053C4F4,?,?), ref: 0053ABD9

Strings

elevation.cpp, xrefs: 0053AB81
Failed to set elevated cache pipe into thread local storage for logging., xrefs: 0053AB8B
Failed to initialize COM., xrefs: 0053ABA8
Failed to pump messages in child process., xrefs: 0053ABC7

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorInitializeLastUninitializeValue
String ID: Failed to initialize COM.$Failed to pump messages in child process.$Failed to set elevated cache pipe into thread local storage for logging.$elevation.cpp
API String ID: 876858697-113251691
Opcode ID: 009aa6ed8dfc414a54922fad31090cf4c34c236fe5730a2067908601153a34be
Instruction ID: 1cfa13895ca654a901370ab8cece3b6d84815f5f6fca9d08159e40b230865251
Opcode Fuzzy Hash: 009aa6ed8dfc414a54922fad31090cf4c34c236fe5730a2067908601153a34be
Instruction Fuzzy Hash: EF112972A41235BBA7211B69AC09DABFF98FF15B60F014116FD04F3250EBB49D40A7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00525BF0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 54registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00560E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00565699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00560E52

RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00525C77

Strings

+, xrefs: 00525BFD
CommonFilesDir, xrefs: 00525C03, 00525C33, 00525C42
Failed to open Windows folder key., xrefs: 00525C29
ProgramFilesDir, xrefs: 00525BF8
SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 00525C14
Failed to read folder path for '%ls'., xrefs: 00525C43
Failed to ensure path was backslash terminated., xrefs: 00525C61

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseOpen
String ID: +$CommonFilesDir$Failed to ensure path was backslash terminated.$Failed to open Windows folder key.$Failed to read folder path for '%ls'.$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
API String ID: 47109696-3209209246
Opcode ID: c355122efb09558e03096e7065cad8d475b97984ceb63b0d44d00061a96c595c
Instruction ID: 2bf1a518db570dde1fd6dd50843ff063d4e34b2d55eca90f68c36d5ff3f24e99
Opcode Fuzzy Hash: c355122efb09558e03096e7065cad8d475b97984ceb63b0d44d00061a96c595c
Instruction Fuzzy Hash: 8201D632E44638B7CB226A54AD06E9FBF78FF92760F100165F800B7190F6718E4096A0

Uniqueness

Uniqueness Score: -1.00%

Function 0054A024 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 172COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,?,00000001,00000000,?), ref: 0054A0F1
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 0054A0FB

Strings

Failed attempt to download URL: '%ls' to: '%ls', xrefs: 0054A1D8
download, xrefs: 0054A0BB
apply.cpp, xrefs: 0054A11F
:, xrefs: 0054A174
Failed to clear readonly bit on payload destination path: %ls, xrefs: 0054A12A

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: :$Failed attempt to download URL: '%ls' to: '%ls'$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$download
API String ID: 1799206407-1905830404
Opcode ID: 729dc5ced94167531300e62f637aa911ec9bb015820c0c36c57baa1a4e9315d7
Instruction ID: 16515517a8f95dd89d0ab81893f66e0c62bc673bf7e4348698a0716f220801db
Opcode Fuzzy Hash: 729dc5ced94167531300e62f637aa911ec9bb015820c0c36c57baa1a4e9315d7
Instruction Fuzzy Hash: 5E51A071A40219AFEB51DFA8C845AEBBFB9FF44714F108459E809EB251E371DE40CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00566DA8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 159COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,7532DFD0,000000FF,type,000000FF,?,7532DFD0,7532DFD0,7532DFD0), ref: 00566DFE
SysFreeString.OLEAUT32(00000000), ref: 00566E49
SysFreeString.OLEAUT32(00000000), ref: 00566EC5
SysFreeString.OLEAUT32(00000000), ref: 00566F11

Strings

type, xrefs: 00566DF0
url, xrefs: 00566E11

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: String$Free$Compare
String ID: type$url
API String ID: 1324494773-1247773906
Opcode ID: 913d766b69b23b3bfefadf1ba45f3bbfa574a825dd166debf5614e94caac5590
Instruction ID: a75b173b61a754bed8fbfeb8e06db2b60ce2c6ce3998a4ae98a1ab357821ff8e
Opcode Fuzzy Hash: 913d766b69b23b3bfefadf1ba45f3bbfa574a825dd166debf5614e94caac5590
Instruction Fuzzy Hash: DD514C75901219FFCF15DBA4C858EAEBFB8BF04711F1442A9E811EB2A0D731AE44DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0056837F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 156COMMON

Download Yara Rule

APIs

Part of subcall function 005238D4: GetProcessHeap.KERNEL32(?,000001C7,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238E5
Part of subcall function 005238D4: RtlAllocateHeap.NTDLL(00000000,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238EC

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000010,00000001,00000000,00000000,00000000,?,?,00548E1F,000002C0,00000100), ref: 005683AD
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF,?,?,00548E1F,000002C0,00000100,000002C0,000002C0,00000100,000002C0,00000410), ref: 005683C8

Strings

apuputil.cpp, xrefs: 00568463
application, xrefs: 005683BA
type, xrefs: 005683EF
http://appsyndication.org/2006/appsyn, xrefs: 005683A0

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: application$apuputil.cpp$http://appsyndication.org/2006/appsyn$type
API String ID: 2664528157-4206478990
Opcode ID: d360785dac79fe08213539902f16005d422127d090dd41bc64c0b63d15df58ae
Instruction ID: 99f8dfc94fb2c9c9754135e3bcd4d6a318199a84d3236b7ff67c8b2dc9abb312
Opcode Fuzzy Hash: d360785dac79fe08213539902f16005d422127d090dd41bc64c0b63d15df58ae
Instruction Fuzzy Hash: 8E51AB31604212BBEF209F14CC85F2A7FA5BF54764F208218F966AB2D1DF74E940CB10

Uniqueness

Uniqueness Score: -1.00%

Function 0056635A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 005663B7
DeleteFileW.KERNEL32(00000000,00000000,00000000,?,?,00000078,000000FF,00000000,?,?,?,00000078,000000FF,?,?,00000078), ref: 005664AE
CloseHandle.KERNEL32(000000FF,00000000,00000000,?,?,00000078,000000FF,00000000,?,?,?,00000078,000000FF,?,?,00000078), ref: 005664BD

Strings

dlutil.cpp, xrefs: 005663DB
Burn, xrefs: 005663A6
WiX\Burn, xrefs: 005663F5
DownloadTimeout, xrefs: 005663F0

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseDeleteErrorFileHandleLast
String ID: Burn$DownloadTimeout$WiX\Burn$dlutil.cpp
API String ID: 3522763407-1704223933
Opcode ID: ae7ee59c83c072772fc61995600120c4091a268ed041d0a03b849ffbf4b7bbbc
Instruction ID: 23855157b3550cd613ecd9fc00adc33e050b0a77451beeb1cb9ccd3142fa36ea
Opcode Fuzzy Hash: ae7ee59c83c072772fc61995600120c4091a268ed041d0a03b849ffbf4b7bbbc
Instruction Fuzzy Hash: 16512B72940219BBDF129FA4CC85EAEBFB9FF48711F004155FA04E7190EB358A55DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00530419 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 133registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,?,00000000,?), ref: 0053054A
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,?,00000000,?), ref: 00530559

Part of subcall function 00560AD5: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,00530491,?,00000000,00020006), ref: 00560AFA

Strings

Failed to open registration key., xrefs: 00530591
Failed to update resume mode., xrefs: 0053052E
%ls.RebootRequired, xrefs: 00530467
Failed to write volatile reboot required registry key., xrefs: 00530495
Failed to delete registration key: %ls, xrefs: 005304F8

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Close$Create
String ID: %ls.RebootRequired$Failed to delete registration key: %ls$Failed to open registration key.$Failed to update resume mode.$Failed to write volatile reboot required registry key.
API String ID: 359002179-2517785395
Opcode ID: a25ec6f724060b8fd6f16cb82dca01faf53b9f118843cab2a7580c626b89a09a
Instruction ID: cbacec3b74a1302979f90fa546cb87df09e0dd87bdbbada28bb1d17158e07045
Opcode Fuzzy Hash: a25ec6f724060b8fd6f16cb82dca01faf53b9f118843cab2a7580c626b89a09a
Instruction Fuzzy Hash: 7E419232900719FBDF22AEA4EC0AEAF7FB9FF80310F145469F945620A1D7719A50EB51

Uniqueness

Uniqueness Score: -1.00%

Function 0056143C Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 123stringregistryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,00000000,BundleUpgradeCode,?,00020006,00000000,?,?,?,00000001), ref: 00561479
lstrlenW.KERNEL32(?,00000000,00000000,?,00000000,00000001,00000000,00000000,BundleUpgradeCode,?,00020006,00000000,?,?,?,00000001), ref: 005614F1
lstrlenW.KERNEL32(?,?,?,?,00000001), ref: 005614FD
RegSetValueExW.ADVAPI32(00020006,?,00000000,00000007,00000000,?,00000000,?,?,00000000,00000001,00000000,00000000,BundleUpgradeCode,?,00020006), ref: 0056153D

Strings

BundleUpgradeCode, xrefs: 00561442
@dX, xrefs: 00561456
regutil.cpp, xrefs: 00561565

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: lstrlen$Value
String ID: @dX$BundleUpgradeCode$regutil.cpp
API String ID: 198323757-2063460865
Opcode ID: b256596313853feacf0c87a88afbf2897a0e294791a62009f1b6354c5f65981d
Instruction ID: 1f18ab56c430589f81768a3c07bead088d324373210b24fefeb2c276812b15fe
Opcode Fuzzy Hash: b256596313853feacf0c87a88afbf2897a0e294791a62009f1b6354c5f65981d
Instruction Fuzzy Hash: 6041C332A0062AAFCF11DFA89885AAEBFA9BF54710F150169FD02E7251DB30DD518BD4

Uniqueness

Uniqueness Score: -1.00%

Function 0052F69D Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 0052F7CD
RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 0052F7DA

Strings

Failed to read Resume value., xrefs: 0052F763
Failed to open registration key., xrefs: 0052F736
Failed to format pending restart registry key to read., xrefs: 0052F6D1
%ls.RebootRequired, xrefs: 0052F6BA
Resume, xrefs: 0052F741

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: 149474eea73aa0fc9263877a3b55f8114962b88e4217ac63a9bbd42fd208233f
Instruction ID: ea55c9ea1d18f18898088627d7ccfcac20547bb02334f1c651a268b54e7e775f
Opcode Fuzzy Hash: 149474eea73aa0fc9263877a3b55f8114962b88e4217ac63a9bbd42fd208233f
Instruction Fuzzy Hash: 42415636940139EFCB119F98F8419ADBFB5FF06310F198576E815AB291D3719E40DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0053A7FA Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 111COMMON

Download Yara Rule

Strings

Failed to set last source., xrefs: 0053A8EA
Failed to determine length of source path., xrefs: 0053A82A
Failed to determine length of relative path., xrefs: 0053A847
Failed to trim source folder., xrefs: 0053A88F
WixBundleLastUsedSource, xrefs: 0053A899, 0053A89F, 0053A8DB

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID:
String ID: Failed to determine length of relative path.$Failed to determine length of source path.$Failed to set last source.$Failed to trim source folder.$WixBundleLastUsedSource
API String ID: 0-660234312
Opcode ID: 242eebe01a6a5d949a6514f2d5aa10e5e5d16b820592ad4d04264aa3a4004adf
Instruction ID: 9c1fe4c1c87c5f923afbacf301200a2e1148a1c134b536e60a0adcacdbfe0daf
Opcode Fuzzy Hash: 242eebe01a6a5d949a6514f2d5aa10e5e5d16b820592ad4d04264aa3a4004adf
Instruction Fuzzy Hash: 6E31E832D0022ABBDF219A94DC49EAEBF79BF45720F104265F824B71D1EA308E41E791

Uniqueness

Uniqueness Score: -1.00%

Function 0054D677 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 106comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00580A84,00000000,00000017,00580A94,?,?,00000000,00000000,?,?,?,?,?,0054DCAE,00000000,00000000), ref: 0054D6AF

Strings

WixBurn, xrefs: 0054D6DA
Failed to set BITS job to foreground., xrefs: 0054D730
Failed to create IBackgroundCopyManager., xrefs: 0054D6BB
Failed to set progress timeout., xrefs: 0054D719
Failed to create BITS job., xrefs: 0054D6E9
Failed to set notification flags for BITS job., xrefs: 0054D701

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CreateInstance
String ID: Failed to create BITS job.$Failed to create IBackgroundCopyManager.$Failed to set BITS job to foreground.$Failed to set notification flags for BITS job.$Failed to set progress timeout.$WixBurn
API String ID: 542301482-468763447
Opcode ID: e010a23eb4c4548b8a58ea8c6554a2156d615ca4bce27c8fe235220716e18a49
Instruction ID: b62675e3c4127f3384f6473cffc9d77c2b0ff0c0a99cca9b8cc96b1c9df8caf0
Opcode Fuzzy Hash: e010a23eb4c4548b8a58ea8c6554a2156d615ca4bce27c8fe235220716e18a49
Instruction Fuzzy Hash: DE318D31B4021AAF9B15DBA8C855EAFBFB4FF48B14B110559ED05EB390CA30AC058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00565C68 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 98fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,?,?,?,?,?,WiX\Burn,DownloadTimeout,00000078), ref: 00565CB2
GetLastError.KERNEL32 ref: 00565CBF
ReadFile.KERNEL32(00000000,00000008,00000008,?,00000000), ref: 00565D06
CloseHandle.KERNEL32(00000000,dlutil.cpp,000000C8,00000000), ref: 00565D6E

Strings

dlutil.cpp, xrefs: 00565CE3, 00565D5E
%ls.R, xrefs: 00565C86

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastRead
String ID: %ls.R$dlutil.cpp
API String ID: 2136311172-657863730
Opcode ID: 8540a6b74be5d3ecae7e4f7623f9e6b4c6a57342f1c4d1b5d3657ddc3e23e57d
Instruction ID: 98a94e9c5f5fbb16d4cf214a39209947b81870fd8e9e2c019194eebe100e3e5e
Opcode Fuzzy Hash: 8540a6b74be5d3ecae7e4f7623f9e6b4c6a57342f1c4d1b5d3657ddc3e23e57d
Instruction Fuzzy Hash: 9C31C472A40624ABFB209B68CC49B6A7EF8FF45721F114219FE05EB2D0E7709D41D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0054D12C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 92synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,753330B0,00000000,?,?,?,?,0054D439,?), ref: 0054D145
ReleaseMutex.KERNEL32(?,?,?,?,0054D439,?), ref: 0054D161
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0054D1A4
ReleaseMutex.KERNEL32(?), ref: 0054D1BB
SetEvent.KERNEL32(?), ref: 0054D1C4

Strings

Failed to get message from netfx chainer., xrefs: 0054D1E5
Failed to send files in use message from netfx chainer., xrefs: 0054D20A

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait$Event
String ID: Failed to get message from netfx chainer.$Failed to send files in use message from netfx chainer.
API String ID: 2608678126-3424578679
Opcode ID: 5690d5d84bcdce8e8f002b365f13c0d6f7f323f8899116c98af385db0180083a
Instruction ID: f9392aea8762ed32832910be764fcbfa4c4e4833b5155af4df764f21a9cb04fb
Opcode Fuzzy Hash: 5690d5d84bcdce8e8f002b365f13c0d6f7f323f8899116c98af385db0180083a
Instruction Fuzzy Hash: F431D231900609AFCB129FA8CC08EEEBFF5FF44324F108665F925A72A1C775D9449BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0056082D Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 0056089A
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 005608A4
CloseHandle.KERNEL32(?,?,?,?,?,00000000,00000000,00000000), ref: 005608ED
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 005608FA

Strings

D, xrefs: 00560882
"%ls" %ls, xrefs: 00560863
procutil.cpp, xrefs: 005608C8

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastProcess
String ID: "%ls" %ls$D$procutil.cpp
API String ID: 161867955-2732225242
Opcode ID: 89c287a75f194aa9215b16bab84000e845339e680ba8fcc5c73ce82ccd1483e4
Instruction ID: 664248ad0707bb6c28758fa253538da579ce3d5006c79cffc88f3455eb033fdb
Opcode Fuzzy Hash: 89c287a75f194aa9215b16bab84000e845339e680ba8fcc5c73ce82ccd1483e4
Instruction Fuzzy Hash: 75212A7190021AAFEB10EFE8C9449AFBBB9FF04354F10002AEA05B7291D7705E54DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00529B3F Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 86COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,00000100), ref: 00529B72
GetLastError.KERNEL32 ref: 00529B81

Strings

File search: %ls, did not find path: %ls, xrefs: 00529BD5
Failed to set variable., xrefs: 00529C07
Failed to format variable string., xrefs: 00529B65
Failed get to file attributes. '%ls', xrefs: 00529BC0
search.cpp, xrefs: 00529BB3

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: Failed get to file attributes. '%ls'$Failed to format variable string.$Failed to set variable.$File search: %ls, did not find path: %ls$search.cpp
API String ID: 1799206407-2053429945
Opcode ID: c952380203999a61badc1a1646ccee9108a23aebf8503d1fd3112c2ae7bb2eb5
Instruction ID: e2eebfb5e8f976458344d124f661695d3258b773b91ceaf30ac645f8ca47966f
Opcode Fuzzy Hash: c952380203999a61badc1a1646ccee9108a23aebf8503d1fd3112c2ae7bb2eb5
Instruction Fuzzy Hash: 4C212732E40239BBDB116AA4ED06A6EBF69FF56310F104225F800F72D0E7709E50D6E1

Uniqueness

Uniqueness Score: -1.00%

Function 0053CCF4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,000493E0,00000000,?,?,0053D134,00000000,?,?,0053C59C,00000001,?,?,?,?,?), ref: 0053CD06
GetLastError.KERNEL32(?,?,0053D134,00000000,?,?,0053C59C,00000001,?,?,?,?,?,00000000,00000000,?), ref: 0053CD10
GetExitCodeThread.KERNEL32(00000001,?,?,?,0053D134,00000000,?,?,0053C59C,00000001,?,?,?,?,?,00000000), ref: 0053CD4C
GetLastError.KERNEL32(?,?,0053D134,00000000,?,?,0053C59C,00000001,?,?,?,?,?,00000000,00000000,?), ref: 0053CD56

Strings

elevation.cpp, xrefs: 0053CD34, 0053CD7A
Failed to get cache thread exit code., xrefs: 0053CD84
Failed to wait for cache thread to terminate., xrefs: 0053CD3E

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$elevation.cpp
API String ID: 3686190907-1954264426
Opcode ID: 849711cff531991f00bdb451f556e6bde84c3cd44f0aefabdf103ec8ff64727d
Instruction ID: e04e85b769e3a91bf9e73dffb78e1e4a46e5a249d5304838bf274e43a863019b
Opcode Fuzzy Hash: 849711cff531991f00bdb451f556e6bde84c3cd44f0aefabdf103ec8ff64727d
Instruction Fuzzy Hash: CB01D872B407346BBB206B79AD09B5B7ED8FF05790F014125FD09F7190E7A58E00A2E5

Uniqueness

Uniqueness Score: -1.00%

Function 005367B0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 52synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,?,00536CFB,@GR,?,00000000,?,00000000,00000001), ref: 005367BD
GetLastError.KERNEL32(?,00536CFB,@GR,?,00000000,?,00000000,00000001), ref: 005367C7
GetExitCodeThread.KERNEL32(00000001,00000000,?,00536CFB,@GR,?,00000000,?,00000000,00000001), ref: 00536806
GetLastError.KERNEL32(?,00536CFB,@GR,?,00000000,?,00000000,00000001), ref: 00536810

Strings

Failed to get cache thread exit code., xrefs: 00536841
Failed to wait for cache thread to terminate., xrefs: 005367F8
core.cpp, xrefs: 005367EB, 00536834

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$core.cpp
API String ID: 3686190907-2546940223
Opcode ID: e6b6eb36832a84ea15ba7fbad4db3974c53c7d380c619205578db288f8f17c61
Instruction ID: 9d64ba73e7e56711644f3eeef9426f12b7c762880c5a243e118452be77c9d721
Opcode Fuzzy Hash: e6b6eb36832a84ea15ba7fbad4db3974c53c7d380c619205578db288f8f17c61
Instruction Fuzzy Hash: C3016170340305BBFB189B65ED1AB7E7BE5FB04710F10812DB90AD61E0EB758E50AA18

Uniqueness

Uniqueness Score: -1.00%

Function 0053F586 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 118COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0053F59B
LeaveCriticalSection.KERNEL32(?), ref: 0053F6A8

Strings

UX requested unknown payload with id: %ls, xrefs: 0053F607
Engine is active, cannot change engine state., xrefs: 0053F5B5
Failed to set source path for payload., xrefs: 0053F637
Failed to set source path for container., xrefs: 0053F68D
UX requested unknown container with id: %ls, xrefs: 0053F667
UX denied while trying to set source on embedded payload: %ls, xrefs: 0053F61D

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set source path for container.$Failed to set source path for payload.$UX denied while trying to set source on embedded payload: %ls$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-4121889706
Opcode ID: 2c2ecd149fd9cdb24f62d8abea75850256b978dd0dc0f57511c21980b172780a
Instruction ID: c7032f3ca3d33566868eb334d37ad80d66c86dba13e135f2fe571cd4cdb00fe4
Opcode Fuzzy Hash: 2c2ecd149fd9cdb24f62d8abea75850256b978dd0dc0f57511c21980b172780a
Instruction Fuzzy Hash: FA31D472E40622BB8B219B58DC4BD5F7FA8FF95720F158126F804EB260DB74ED4097A1

Uniqueness

Uniqueness Score: -1.00%

Function 005270D4 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 99stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 005270E7

Strings

Failed to append characters., xrefs: 00527173
[]{}, xrefs: 00527111
Failed to append escape sequence., xrefs: 0052717A
[\%c], xrefs: 00527146
Failed to format escape sequence., xrefs: 00527181
Failed to copy string., xrefs: 0052719B
Failed to allocate buffer for escaped string., xrefs: 005270FE

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: lstrlen
String ID: Failed to allocate buffer for escaped string.$Failed to append characters.$Failed to append escape sequence.$Failed to copy string.$Failed to format escape sequence.$[\%c]$[]{}
API String ID: 1659193697-3250950999
Opcode ID: c016094f8b1f0957fa2365cfa670ebe98f7c623da30cd6217e8cc55a2d1970e5
Instruction ID: e9256bce73e323181efd08bc1bd6d999f044a7482b0e16a0ac66fd655bae5291
Opcode Fuzzy Hash: c016094f8b1f0957fa2365cfa670ebe98f7c623da30cd6217e8cc55a2d1970e5
Instruction Fuzzy Hash: 0321D93294863ABADB119694AC06BAFBE6CBF56711F200156F800B71C1DB746E50D294

Uniqueness

Uniqueness Score: -1.00%

Function 005459B0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 207COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,0056B4F0,000000FF,feclient.dll,000000FF,00000000,00000000,?,?,?,0054659B,?,00000001,?,0056B490), ref: 00545A19

Strings

Failed to copy target product code., xrefs: 00545B4C
feclient.dll, xrefs: 00545A0F, 00545B39
Failed to plan action for target product., xrefs: 00545AC4
Failed to insert execute action., xrefs: 00545A6E
Failed grow array of ordered patches., xrefs: 00545AB2

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CompareString
String ID: Failed grow array of ordered patches.$Failed to copy target product code.$Failed to insert execute action.$Failed to plan action for target product.$feclient.dll
API String ID: 1825529933-3477540455
Opcode ID: 46dcae733a78a542f0d569739c98c39594bd943cb500b0393b72f1d4303ed250
Instruction ID: c21d14d431d3d27439aedd49f7c2c4a6e2f4d91f1b76c3881163bc8705777552
Opcode Fuzzy Hash: 46dcae733a78a542f0d569739c98c39594bd943cb500b0393b72f1d4303ed250
Instruction Fuzzy Hash: CD8136B560075A9FCB15CF59C884AAA7BA5FF08328F158A69FC158B352E730EC51CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00549039 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 171COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,00000000,00000100,00000000,?,?,?,00536F20,000000B8,0000001C,00000100), ref: 00549068
CompareStringW.KERNEL32(00000000,00000001,?,000000FF,0056B4A8,000000FF,?,?,?,00536F20,000000B8,0000001C,00000100,00000100,00000100,000000B0), ref: 00549101

Strings

comres.dll, xrefs: 00549187
Failed to initialize update bundle., xrefs: 005491A9
detect.cpp, xrefs: 00549163
BA aborted detect forward compatible bundle., xrefs: 0054916D

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CompareString
String ID: BA aborted detect forward compatible bundle.$Failed to initialize update bundle.$comres.dll$detect.cpp
API String ID: 1825529933-439563586
Opcode ID: 39bbf533fce29197d5aee2679a2169678f47ddb540d91e37fa304b5749441de5
Instruction ID: 52c57417404bcd403c58532d7f9b5436a5ee17e14cd24f57725f5f5f24e8d5bf
Opcode Fuzzy Hash: 39bbf533fce29197d5aee2679a2169678f47ddb540d91e37fa304b5749441de5
Instruction Fuzzy Hash: D9518071600216BFDF15DF64CC8AAABBBAAFF09324B104664F819DA195D731EC60DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0053D206 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,?,00000001,0056B4F0,?,00000001,000000FF,?,?,757A95A0,00000000,00000001,00000000,?,005372F3), ref: 0053D32F

Strings

elevation.cpp, xrefs: 0053D23A
Failed to create pipe name and client token., xrefs: 0053D270
Failed to elevate., xrefs: 0053D311
Failed to create pipe and cache pipe., xrefs: 0053D28C
UX aborted elevation requirement., xrefs: 0053D244
Failed to connect to elevated child process., xrefs: 0053D318

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseHandle
String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$elevation.cpp
API String ID: 2962429428-3003415917
Opcode ID: 0894c5d9d44414e20bb79d44edaaf78eb3c74ee7901bed798e5f7d3f074f246e
Instruction ID: de886b0a27e48824901dbf3ad68fd06d0c4788f2a17a032b3734dc35e9eff316
Opcode Fuzzy Hash: 0894c5d9d44414e20bb79d44edaaf78eb3c74ee7901bed798e5f7d3f074f246e
Instruction Fuzzy Hash: E4316B72A447267BE725A660BC4AFAFAF7CFF05720F100515F905A71C1DA61EE0092F5

Uniqueness

Uniqueness Score: -1.00%

Function 0056041B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0058B60C,00000000,?,?,?,00525407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 0056042B
CreateFileW.KERNEL32(40000000,00000001,00000000,00000002,00000080,00000000,?,00000000,?,?,?,0058B604,?,00525407,00000000,Setup), ref: 005604CC
GetLastError.KERNEL32(?,00525407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 005604DC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00525407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 00560515

Part of subcall function 00522DE0: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00522F1F

LeaveCriticalSection.KERNEL32(0058B60C,?,?,0058B604,?,00525407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 0056056E

Strings

logutil.cpp, xrefs: 005604FA

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
String ID: logutil.cpp
API String ID: 4111229724-3545173039
Opcode ID: 2d10b52e2f624b027913d86359744dbfcdc4fa3fa37d87cd69923e844d5f9df4
Instruction ID: ce94afe6ac12e15bedfd8a1a040f1709bd50afb25c967a8e2da10b9f849f3342
Opcode Fuzzy Hash: 2d10b52e2f624b027913d86359744dbfcdc4fa3fa37d87cd69923e844d5f9df4
Instruction Fuzzy Hash: D9313071A0122ABFEB21AF659C85A6B3E6CFF20751F001125FE01B71A1E771CD94EB90

Uniqueness

Uniqueness Score: -1.00%

Function 0052F2DC Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 109stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00524013: CreateDirectoryW.KERNELBASE(0052533D,005253B5,00000000,00000000,?,00539EE4,00000000,00000000,0052533D,00000000,005252B5,00000000,?,=SR,0052D4AC,=SR), ref: 00524021
Part of subcall function 00524013: GetLastError.KERNEL32(?,00539EE4,00000000,00000000,0052533D,00000000,005252B5,00000000,?,=SR,0052D4AC,=SR,00000000,00000000), ref: 0052402F

lstrlenA.KERNEL32(0056B4F0,00000000,00000094,00000000,00000094,?,?,00530328,swidtag,00000094,?,0056B508,00530328,00000000,?,00000000), ref: 0052F368

Part of subcall function 00564C67: CreateFileW.KERNEL32(0056B4F0,40000000,00000001,00000000,00000002,00000080,00000000,00530328,00000000,?,0052F37F,?,00000080,0056B4F0,00000000), ref: 00564C7F
Part of subcall function 00564C67: GetLastError.KERNEL32(?,0052F37F,?,00000080,0056B4F0,00000000,?,00530328,?,00000094,?,?,?,?,?,00000000), ref: 00564C8C

Strings

swidtag, xrefs: 0052F328
Failed to format tag folder path., xrefs: 0052F3CE
Failed to allocate regid file path., xrefs: 0052F3C0
Failed to create regid folder: %ls, xrefs: 0052F3B0
Failed to write tag xml to file: %ls, xrefs: 0052F3A6
Failed to allocate regid folder path., xrefs: 0052F3C7

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CreateErrorLast$DirectoryFilelstrlen
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to create regid folder: %ls$Failed to format tag folder path.$Failed to write tag xml to file: %ls$swidtag
API String ID: 583680227-1201533908
Opcode ID: f2445071baed3e90fd95226257b455fc4de0129b28a4e0d9f0e4c35c9c929c50
Instruction ID: 50e5af835917158bbcb329e71d32581d13c330ad6e0c7a428224e80568968832
Opcode Fuzzy Hash: f2445071baed3e90fd95226257b455fc4de0129b28a4e0d9f0e4c35c9c929c50
Instruction Fuzzy Hash: 0B318D32D01639BBCF11EE94FC45A9DBFB4BF05710F108576E904AA290E7719E90AB90

Uniqueness

Uniqueness Score: -1.00%

Function 00527203 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 92COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,?,?,0052583F,000002C0,000002C0,00000000,00000100,00000001,00000000,000002C0,00000002), ref: 00527215
LeaveCriticalSection.KERNEL32(00000000,00000000,00000002,00000000,?,?,?,0052583F,000002C0,000002C0,00000000,00000100,00000001,00000000,000002C0,00000002), ref: 005272F4

Strings

Failed to format value '%ls' of variable: %ls, xrefs: 005272BE
Failed to get unformatted string., xrefs: 00527285
Failed to get value as string for variable: %ls, xrefs: 005272E3
*****, xrefs: 005272B0, 005272BD
Failed to get variable: %ls, xrefs: 00527256

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: *****$Failed to format value '%ls' of variable: %ls$Failed to get unformatted string.$Failed to get value as string for variable: %ls$Failed to get variable: %ls
API String ID: 3168844106-2873099529
Opcode ID: 14da83645e30adcf0e8565efec3a21eaf9f0a1f690fcafb602732a375314dec7
Instruction ID: 8046463e73d1c50bb76ecf9145232470b4ea622a9569c5b1e91ee78cd745e764
Opcode Fuzzy Hash: 14da83645e30adcf0e8565efec3a21eaf9f0a1f690fcafb602732a375314dec7
Instruction Fuzzy Hash: 3D31B13690463EFBCF229A50DC09BAE7F64FF1A320F104125F81466590D731AE90DBC5

Uniqueness

Uniqueness Score: -1.00%

Function 00538BE5 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

InitializeAcl.ADVAPI32(?,00000008,00000002,0000001A,00000000,?,00000000,00000000,?,?,00000000,00000000,?,?,-00000004,00000000), ref: 00538C30
GetLastError.KERNEL32(?,?,?,00000001), ref: 00538C3A
SetFileAttributesW.KERNEL32(?,00000080,?,00000001,20000004,00000000,00000000,?,00000000,00000003,000007D0,?,00000000,00000000,?,?), ref: 00538C9A

Strings

cache.cpp, xrefs: 00538C5E
Failed to initialize ACL., xrefs: 00538C68
Failed to allocate administrator SID., xrefs: 00538C16

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AttributesErrorFileInitializeLast
String ID: Failed to allocate administrator SID.$Failed to initialize ACL.$cache.cpp
API String ID: 669721577-1117388985
Opcode ID: abf63596f3fc74f616222bad7c09ff06e090f008139b04cd45882a2183b5dc13
Instruction ID: ff2c5c44f1ad3d29dd65a9155825f6818f6a3081a10647995347293065c5c0a8
Opcode Fuzzy Hash: abf63596f3fc74f616222bad7c09ff06e090f008139b04cd45882a2183b5dc13
Instruction Fuzzy Hash: EE210072E45318BBEB109E999C89FABBFA9FF44710F114125FD04FB180EA705E40A6A0

Uniqueness

Uniqueness Score: -1.00%

Function 0052410D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000000,00000000,?,00000000,crypt32.dll,?,?,00533ED4,00000001,feclient.dll,?,00000000,?,?,?,00524A0C), ref: 00524148
GetLastError.KERNEL32(?,?,00533ED4,00000001,feclient.dll,?,00000000,?,?,?,00524A0C,?,?,0056B478,?,00000001), ref: 00524154
GetCurrentDirectoryW.KERNEL32(00000000,?,?,00000000,?,?,00533ED4,00000001,feclient.dll,?,00000000,?,?,?,00524A0C,?), ref: 0052418F
GetLastError.KERNEL32(?,?,00533ED4,00000001,feclient.dll,?,00000000,?,?,?,00524A0C,?,?,0056B478,?,00000001), ref: 00524199

Strings

dirutil.cpp, xrefs: 005241BD
crypt32.dll, xrefs: 00524111

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CurrentDirectoryErrorLast
String ID: crypt32.dll$dirutil.cpp
API String ID: 152501406-1104880720
Opcode ID: c8e552a6296fe5257d57c5a7c9ea4cc52c77f1ee9c71fe6cd22b9de8b5e18d22
Instruction ID: a9bd719a35ac882325fa71a7c01bea3b3c9e212a1f5b7a328bdf6246f13de9d4
Opcode Fuzzy Hash: c8e552a6296fe5257d57c5a7c9ea4cc52c77f1ee9c71fe6cd22b9de8b5e18d22
Instruction Fuzzy Hash: E411DA76A00737ABA7209AA99C84667BEDCFF15790B110135FD04E7290E771CC90DAE0

Uniqueness

Uniqueness Score: -1.00%

Function 00529A6D Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,?,0052A7A9,00000100,000002C0,000002C0,00000100), ref: 00529AA6
GetLastError.KERNEL32(?,0052A7A9,00000100,000002C0,000002C0,00000100), ref: 00529AB1

Strings

Failed to set directory search path variable., xrefs: 00529AE1
Failed to format variable string., xrefs: 00529A91
Failed while searching directory search: %ls, for path: %ls, xrefs: 00529B06
Directory search: %ls, did not find path: %ls, reason: 0x%x, xrefs: 00529B1C

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: Directory search: %ls, did not find path: %ls, reason: 0x%x$Failed to format variable string.$Failed to set directory search path variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1799206407-2966038646
Opcode ID: 04a793f06bd6d3b306483796ee5cbb1a812f6a650d2c63b2edc2fee3b0c742a7
Instruction ID: 5023c3a1d1c98f02a061bbe77a52f70e2a5fdfe29f0fcf639eed608a6c9aef11
Opcode Fuzzy Hash: 04a793f06bd6d3b306483796ee5cbb1a812f6a650d2c63b2edc2fee3b0c742a7
Instruction Fuzzy Hash: A611F636941235BBDB126698FD06E9EBF25FF56320F200125FC00672E0D7724E50A6D1

Uniqueness

Uniqueness Score: -1.00%

Function 00529C39 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,?,0052A781,00000100,000002C0,000002C0,?,000002C0,00000100), ref: 00529C72
GetLastError.KERNEL32(?,0052A781,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 00529C7D

Strings

Failed while searching file search: %ls, for path: %ls, xrefs: 00529CAA
File search: %ls, did not find path: %ls, xrefs: 00529CE0
Failed to set variable to file search path., xrefs: 00529CD4
Failed to format variable string., xrefs: 00529C5D

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: Failed to format variable string.$Failed to set variable to file search path.$Failed while searching file search: %ls, for path: %ls$File search: %ls, did not find path: %ls
API String ID: 1799206407-3425311760
Opcode ID: c82994a4b5c42ccaf047a4a6d122601b4b5b52e2c212319008179fc29ca4ac73
Instruction ID: caadbc7e7477a6ac2ddfaf9c4ca68cea5c50d373c02453a21a763193fc0f5312
Opcode Fuzzy Hash: c82994a4b5c42ccaf047a4a6d122601b4b5b52e2c212319008179fc29ca4ac73
Instruction Fuzzy Hash: CD110536940135B6DF122694AE47A9EBFA5FF52320F200115FC10B72E1D7714E50B7D1

Uniqueness

Uniqueness Score: -1.00%

Function 005409B8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00540A25
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00540A37
SetFileTime.KERNEL32(?,?,?,?), ref: 00540A4A
CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00540616,?,?), ref: 00540A59

Strings

cabextract.cpp, xrefs: 005409F4
Invalid operation for this state., xrefs: 005409FE

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Time$File$CloseDateHandleLocal
String ID: Invalid operation for this state.$cabextract.cpp
API String ID: 609741386-1751360545
Opcode ID: 00c519df462ab37a6b290260f546bf86a7cf4b51449e1741765843484c1c733f
Instruction ID: 4becbeb50d61876d9ff8cdb80147651e87c0b470f79223f8c0aaa03a86390580
Opcode Fuzzy Hash: 00c519df462ab37a6b290260f546bf86a7cf4b51449e1741765843484c1c733f
Instruction Fuzzy Hash: 5721C07280021AAB87109FADDC488EABFBCFF04724B24521AF965D75D0C770DA52DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00568803 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 69timeCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0056884C
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00568874
GetLastError.KERNEL32 ref: 0056887E

Strings

feclient.dll, xrefs: 00568814
QdV, xrefs: 00568803
inetutil.cpp, xrefs: 0056889F

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLastTime$FileSystem
String ID: QdV$feclient.dll$inetutil.cpp
API String ID: 1528435940-3248997316
Opcode ID: bc690a47009d525bcd8abc4cf45a06b9100dda8b032908a66e9db8b8ae2db82a
Instruction ID: 387553664ba713479229e834dfa26d343583be953960326209e96f21ed781431
Opcode Fuzzy Hash: bc690a47009d525bcd8abc4cf45a06b9100dda8b032908a66e9db8b8ae2db82a
Instruction Fuzzy Hash: EE116372A01229ABE710DBBD8D44BBBBBECEF58250F110526EE05F7150E6648D4497E1

Uniqueness

Uniqueness Score: -1.00%

Function 00529908 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 57COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 0052997F

Strings

Failed to get Condition inner text., xrefs: 0052994F
Condition, xrefs: 0052991A
Failed to select condition node., xrefs: 00529936
=SR, xrefs: 00529908
Failed to copy condition string from BSTR, xrefs: 00529969

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: FreeString
String ID: =SR$Condition$Failed to copy condition string from BSTR$Failed to get Condition inner text.$Failed to select condition node.
API String ID: 3341692771-2199050854
Opcode ID: 68f3150c3030f168fb7d3b22299e5c4e20c42dee51ef9f05eb6818feee4deff1
Instruction ID: 0cc7101a908c20afc121a4a64591d77d8a9576c0b4741692158db6c1056389d2
Opcode Fuzzy Hash: 68f3150c3030f168fb7d3b22299e5c4e20c42dee51ef9f05eb6818feee4deff1
Instruction Fuzzy Hash: 99118232E40238BBDB259B50DD05FAD7F68BF02720F104558F800B7290DB719E90E690

Uniqueness

Uniqueness Score: -1.00%

Function 00526644 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 0052667D
GetLastError.KERNEL32 ref: 00526687

Strings

43u, xrefs: 0052667D
Failed to get temp path., xrefs: 005266B5
variable.cpp, xrefs: 005266AB
Failed to set variant value., xrefs: 005266D1

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLastPathTemp
String ID: 43u$Failed to get temp path.$Failed to set variant value.$variable.cpp
API String ID: 1238063741-175756145
Opcode ID: 74fa1c2ade8dfd938ea125db2a30632a821545c6fa433bc7d3005e58452dd104
Instruction ID: cd6306ce83672a0b64f4d5cbe5b6f34aa578843b9a838e7fc69b277307f716e4
Opcode Fuzzy Hash: 74fa1c2ade8dfd938ea125db2a30632a821545c6fa433bc7d3005e58452dd104
Instruction Fuzzy Hash: 1B01DB71E41339A7E710EBA86C0ABAA7BD8BF05710F100165FD04F71C1EA709E0497E5

Uniqueness

Uniqueness Score: -1.00%

Function 00569555 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMON

Download Yara Rule

Strings

KERNEL32.DLL, xrefs: 0056956F
ReleaseSRWLockExclusive, xrefs: 00569594
AcquireSRWLockExclusive, xrefs: 00569584

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: e790d4d6ea75a5ddc5d2cd10fe9b915162ef7c3a5de9f8028b1d159ea4d945f4
Instruction ID: 66efe1d2a72852a7b0ffb40cf5e673e1664b133eb2b0781aaaffa413cebb0c69
Opcode Fuzzy Hash: e790d4d6ea75a5ddc5d2cd10fe9b915162ef7c3a5de9f8028b1d159ea4d945f4
Instruction Fuzzy Hash: 570181752423219B6F726E755C845AB2ECCFE71711310552AE913E7290D771C88AE7E0

Uniqueness

Uniqueness Score: -1.00%

Function 005609BB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00525D8F,00000000), ref: 005609CF
GetProcAddress.KERNEL32(00000000), ref: 005609D6
GetLastError.KERNEL32(?,?,?,00525D8F,00000000), ref: 005609ED

Strings

kernel32, xrefs: 005609C7
IsWow64Process, xrefs: 005609C0
procutil.cpp, xrefs: 00560A0E

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: IsWow64Process$kernel32$procutil.cpp
API String ID: 4275029093-1586155540
Opcode ID: e9b3e7cf008785a8af25913e1d08c1b59f84ed8774425a23edf77d4268434222
Instruction ID: 373f5913a8da539323a5fb83745e65ba1b557fb0f70400b734eb5fa0720bcbd8
Opcode Fuzzy Hash: e9b3e7cf008785a8af25913e1d08c1b59f84ed8774425a23edf77d4268434222
Instruction Fuzzy Hash: 67F06871A00325ABAB20AFE9DC0996B7F98FF14791B004155FD05E7280EB75CE44D7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00565D7F Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 159stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 00565E3D
lstrlenW.KERNEL32(?), ref: 00565E55

Strings

dlutil.cpp, xrefs: 00565EDB
QdV, xrefs: 00565D7F
msasn1.dll, xrefs: 00565DC2, 00565EE8

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: lstrlen
String ID: QdV$dlutil.cpp$msasn1.dll
API String ID: 1659193697-2611989811
Opcode ID: e1ff897df7d404bb1d7f8084643fc3656c6f5de68c686e87b1459544ca094a6f
Instruction ID: e2ca0d41442f10b60fb00bcf15d7da9e8d93fedf53c15bed1a26e133fc72e5d0
Opcode Fuzzy Hash: e1ff897df7d404bb1d7f8084643fc3656c6f5de68c686e87b1459544ca094a6f
Instruction Fuzzy Hash: 8951A072941615ABDF119FA58C889AFBFBDFF88750F054065FE01A7250EB318E41D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0053F6B8 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0053F6D0
LeaveCriticalSection.KERNEL32(?,?), ref: 0053F81D

Strings

Failed to set update bundle., xrefs: 0053F7F3
Failed to recreate command-line for update bundle., xrefs: 0053F79C
update\%ls, xrefs: 0053F72E
Failed to default local update source, xrefs: 0053F742

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to default local update source$Failed to recreate command-line for update bundle.$Failed to set update bundle.$update\%ls
API String ID: 3168844106-1266646976
Opcode ID: 409f82c9c1cf9bf3feb28ab052457abbcef4ca465c422ada09c68e2b0ce8effc
Instruction ID: 40252efd7d122b6603f75b555e7d48d6578bfab79901054ea36496344c872dc5
Opcode Fuzzy Hash: 409f82c9c1cf9bf3feb28ab052457abbcef4ca465c422ada09c68e2b0ce8effc
Instruction Fuzzy Hash: 7441693194021AFFDF168F94DC4AEAABBA4FF04310F0182B5F908A7161E771AD60DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00538AA3 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 122sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0,00000000,00000000), ref: 00538B0F

Strings

Failed to get %hs package cache root directory., xrefs: 00538B70
per-user, xrefs: 00538B67, 00538BA8
Failed to get old %hs package cache root directory., xrefs: 00538BB1
per-machine, xrefs: 00538B62, 00538B6F, 00538BA3, 00538BB0
Failed to calculate cache path., xrefs: 00538ACC

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Sleep
String ID: Failed to calculate cache path.$Failed to get %hs package cache root directory.$Failed to get old %hs package cache root directory.$per-machine$per-user
API String ID: 3472027048-398165853
Opcode ID: d6cccfa95ea9ae829b7feed5d5db4fc8e5f8d6b707595755d1c0ecf20ba58d78
Instruction ID: 49eaf7b4232021d52c3eda939b3b132008aaa17eab5bbda72d9d4301f0663cd2
Opcode Fuzzy Hash: d6cccfa95ea9ae829b7feed5d5db4fc8e5f8d6b707595755d1c0ecf20ba58d78
Instruction Fuzzy Hash: 8F3105B2A4032ABBEB15AA649C56FBFFF6CFF40710F104429FD09E7191DA748D00A291

Uniqueness

Uniqueness Score: -1.00%

Function 0053E705 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 0053E734
SetWindowLongW.USER32(?,000000EB,00000000), ref: 0053E743
SetWindowLongW.USER32(?,000000EB,?), ref: 0053E757
DefWindowProcW.USER32(?,?,?,?), ref: 0053E767
GetWindowLongW.USER32(?,000000EB), ref: 0053E781
PostQuitMessage.USER32(00000000), ref: 0053E7DE

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: 4f438d4a240ca6370efd7938ed0d95815932eed2c27fa02433ef70cd853514f4
Instruction ID: 59169624bdd207620c59d38a722aa692741daf2bd38c5ac8fc892d79924fa6d3
Opcode Fuzzy Hash: 4f438d4a240ca6370efd7938ed0d95815932eed2c27fa02433ef70cd853514f4
Instruction Fuzzy Hash: 0021A132204119BFEB115FA8DC49E6A3FA9FF95350F144914F906EB2A0D771DD50EB60

Uniqueness

Uniqueness Score: -1.00%

Function 0053C59C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 163synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(?), ref: 0053C5E4
CloseHandle.KERNEL32(?), ref: 0053C5EC

Strings

elevation.cpp, xrefs: 0053C788
Failed to save state., xrefs: 0053C661
Unexpected elevated message sent to child process, msg: %u, xrefs: 0053C794

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseHandleMutexRelease
String ID: Failed to save state.$Unexpected elevated message sent to child process, msg: %u$elevation.cpp
API String ID: 4207627910-1576875097
Opcode ID: 22686f235a2a8a7d6461a62559a8f13fa3cf6159fcb3affc2574a474f7890e11
Instruction ID: 7577d73d38d62e575fbf52e0dc6d8bb465f12b44c8eb22fa2e97082c0fe76ff0
Opcode Fuzzy Hash: 22686f235a2a8a7d6461a62559a8f13fa3cf6159fcb3affc2574a474f7890e11
Instruction Fuzzy Hash: 9661B57A100514EFCB225F94CD45C66BFB2FF49310B15C959FAA9AA632C732E921EF40

Uniqueness

Uniqueness Score: -1.00%

Function 005610C5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 149registrystringCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 005610ED
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,00536EF3,00000100,000000B0,00000088,00000410,000002C0), ref: 00561126
lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 0056121A

Strings

BundleUpgradeCode, xrefs: 005610CC
regutil.cpp, xrefs: 00561161

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: QueryValue$lstrlen
String ID: BundleUpgradeCode$regutil.cpp
API String ID: 3790715954-1648651458
Opcode ID: 05aaeb6e1b1e21002fc680731e73cb0f11551eb6c21fa83b95994b170ea5d951
Instruction ID: ced4dcec72cafab948011ad3a5e4e9a221a9f667f94c7ca00675be8da411b79b
Opcode Fuzzy Hash: 05aaeb6e1b1e21002fc680731e73cb0f11551eb6c21fa83b95994b170ea5d951
Instruction Fuzzy Hash: A941D135A0061AAFDB21CFAAC884ABEBBB9FF45710F194169ED05EB210D730DD01DB94

Uniqueness

Uniqueness Score: -1.00%

Function 005661FA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005647D3: SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,00538564,00000000,00000000,00000000,00000000,00000000), ref: 005647EB
Part of subcall function 005647D3: GetLastError.KERNEL32(?,?,?,00538564,00000000,00000000,00000000,00000000,00000000), ref: 005647F5

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00565AC5,?,?,?,?,?,?,?,00010000,?), ref: 00566263
WriteFile.KERNEL32(000000FF,00000008,00000008,?,00000000,000000FF,00000000,00000000,00000000,00000000,?,00565AC5,?,?,?,?), ref: 005662B5
GetLastError.KERNEL32(?,00565AC5,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 005662FB
GetLastError.KERNEL32(?,00565AC5,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 00566321

Strings

dlutil.cpp, xrefs: 00566345

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFileLast$Write$Pointer
String ID: dlutil.cpp
API String ID: 133221148-2067379296
Opcode ID: b8bc27e58dad3c692a919a20280b65abad492ea4f74164c2f8a53348f1fcc590
Instruction ID: 729e59e4d56c0ee63d8133dca41235fe1326df456a4b557f33bfe91f3907d659
Opcode Fuzzy Hash: b8bc27e58dad3c692a919a20280b65abad492ea4f74164c2f8a53348f1fcc590
Instruction Fuzzy Hash: C1416D72A00219BFEB118E98CD58BAA7FA8FF04355F140225FD04E7190D771DD64DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00522436 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,0055FEE7,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0055FEE7,?,00000000,00000000), ref: 0052247C
GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0055FEE7,?,00000000,00000000,0000FDE9), ref: 00522488

Part of subcall function 00523B51: GetProcessHeap.KERNEL32(00000000,000001C7,?,005221DC,000001C7,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 00523B59
Part of subcall function 00523B51: HeapSize.KERNEL32(00000000,?,005221DC,000001C7,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 00523B60

Strings

strutil.cpp, xrefs: 005224AC

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: strutil.cpp
API String ID: 3662877508-3612885251
Opcode ID: 05786b0c2a3412a0a4780ca576026ad94ee511145870e2faab5bcdc8ca7d0ee8
Instruction ID: b2d1d60be54af936ee543195423ace7e2be83fe959b878a79a322657a47e9717
Opcode Fuzzy Hash: 05786b0c2a3412a0a4780ca576026ad94ee511145870e2faab5bcdc8ca7d0ee8
Instruction Fuzzy Hash: E331C535300229BFFF10AE68AC84AB63AD9FF56364F108229F915DB1D0EB65CC4097A0

Uniqueness

Uniqueness Score: -1.00%

Function 0054AAE8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract all payloads from container: %ls, xrefs: 0054AB9C
Failed to extract payload: %ls from container: %ls, xrefs: 0054ABE3
Failed to skip the extraction of payload: %ls from container: %ls, xrefs: 0054ABEF
Failed to open container: %ls., xrefs: 0054AB2A

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: Failed to extract all payloads from container: %ls$Failed to extract payload: %ls from container: %ls$Failed to open container: %ls.$Failed to skip the extraction of payload: %ls from container: %ls
API String ID: 1214770103-3891707333
Opcode ID: 5020dedba7d668d63d92a58765bd100832464e4d7f2a1e3740d95c75781de003
Instruction ID: 191b644a429148f9380cbc4f0b080c55ccf16068c161a20f7c49fb55e12f6b83
Opcode Fuzzy Hash: 5020dedba7d668d63d92a58765bd100832464e4d7f2a1e3740d95c75781de003
Instruction Fuzzy Hash: C431C332C8022ABBCF229AE4DC46ECE7F69FF15314F204665FD21A7191E7319950EB91

Uniqueness

Uniqueness Score: -1.00%

Function 005640C8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

MoveFileExW.KERNEL32(00000003,00000001,00000000,00000000,00000101,?,00564203,00000003,00000001,00000001,000007D0,00000003,00000000,?,00539E5F,00000000), ref: 005640ED
GetLastError.KERNEL32(00000001,?,00564203,00000003,00000001,00000001,000007D0,00000003,00000000,?,00539E5F,00000000,000007D0,00000001,00000001,00000003), ref: 005640FC
MoveFileExW.KERNEL32(00000003,00000001,000007D0,00000001,00000000,?,00564203,00000003,00000001,00000001,000007D0,00000003,00000000,?,00539E5F,00000000), ref: 0056417F
GetLastError.KERNEL32(?,00564203,00000003,00000001,00000001,000007D0,00000003,00000000,?,00539E5F,00000000,000007D0,00000001,00000001,00000003,000007D0), ref: 00564189

Strings

fileutil.cpp, xrefs: 005641A7

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastMove
String ID: fileutil.cpp
API String ID: 55378915-2967768451
Opcode ID: 9b628fc595a695e5d4543c0ffbf4cece7eb226f1655a37d73cb48b9da7864189
Instruction ID: 79c7f97e67a9a09e193f2f8a209edf8c90e8f6c6bfb301a31f4f27e882a824f3
Opcode Fuzzy Hash: 9b628fc595a695e5d4543c0ffbf4cece7eb226f1655a37d73cb48b9da7864189
Instruction Fuzzy Hash: E521E136A00336ABEB211E689C4567F7E99FFA27A1F020126FC05E7190D7748DD1DAE0

Uniqueness

Uniqueness Score: -1.00%

Function 00564212 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 95registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00564315: FindFirstFileW.KERNEL32(00548FFA,?,000002C0,00000000,00000000), ref: 00564350
Part of subcall function 00564315: FindClose.KERNEL32(00000000), ref: 0056435C

RegCloseKey.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,wininet.dll), ref: 00564305

Part of subcall function 00560E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00565699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00560E52

Part of subcall function 005610C5: RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 005610ED
Part of subcall function 005610C5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,00536EF3,00000100,000000B0,00000088,00000410,000002C0), ref: 00561126

Strings

SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00564244
PendingFileRenameOperations, xrefs: 00564270
crypt32.dll, xrefs: 0056423D
\, xrefs: 0056428E

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseFindQueryValue$FileFirstOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager$\$crypt32.dll
API String ID: 3397690329-3978359083
Opcode ID: de41c250eb9c2fd4fd9cfb4e873e1c77e092ffd8f59c918e200e0014848c2d43
Instruction ID: 9726a03455bdf6a9cbd7f71cbbb30e57cb4940cf04449d51ee8fb99a53be6a55
Opcode Fuzzy Hash: de41c250eb9c2fd4fd9cfb4e873e1c77e092ffd8f59c918e200e0014848c2d43
Instruction Fuzzy Hash: C931BC39A0021AABDF21AFD5CC91ABEBFB9FF00750F64816AF900A7151D7319A80CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0052EEF9 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92registryCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000001,000000FF,?,000000FF,00000001,PackageVersion,00000001,?,005304CB,00000001,00000001,00000001,005304CB,00000000), ref: 0052EF70
RegCloseKey.ADVAPI32(00000000,00000001,PackageVersion,00000001,?,005304CB,00000001,00000001,00000001,005304CB,00000000,00000001,00000002,005304CB,00000001), ref: 0052EF87

Strings

Failed to remove update registration key: %ls, xrefs: 0052EFB4
Failed to format key for update registration., xrefs: 0052EF26
PackageVersion, xrefs: 0052EF51

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseCompareString
String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
API String ID: 446873843-3222553582
Opcode ID: 089e7da955e88098129d002b761a9ca7af4a6898d6ae803eb2a64820ce626520
Instruction ID: 4a3235d0725979596d23449336a2fa1a82db1b704c0de02f133c4fe867dbf3e6
Opcode Fuzzy Hash: 089e7da955e88098129d002b761a9ca7af4a6898d6ae803eb2a64820ce626520
Instruction Fuzzy Hash: B221B432A41229BBDB219AA4ED4AE9FBFB8FF42711F114175F914A71D0E7309E40D690

Uniqueness

Uniqueness Score: -1.00%

Function 00548B73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00560E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00565699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00560E52

CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,?,000000FF,00000000,00000000,00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4), ref: 00548BF7
RegCloseKey.ADVAPI32(00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4,?,?,?,0052F66B,00000001,00000100,000001B4,00000000), ref: 00548C45

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00548B94
Failed to open uninstall registry key., xrefs: 00548BBA
Failed to enumerate uninstall key for related bundles., xrefs: 00548C56

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseCompareOpenString
String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 2817536665-2531018330
Opcode ID: bda2d2d0e4ff46b93b169e31c2a95ee753bb5619d4620439dbd0158b82f71249
Instruction ID: c6811faf27f990fc420d1d7d89f3615133dfba4a7196a41ab9edfc06f3424de9
Opcode Fuzzy Hash: bda2d2d0e4ff46b93b169e31c2a95ee753bb5619d4620439dbd0158b82f71249
Instruction Fuzzy Hash: DA21A236941119FEDB255A94CC89FFEBF79FB00324F244664F810AB090CB750E90E690

Uniqueness

Uniqueness Score: -1.00%

Function 00563F04 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,00524CB6,00000000,?,?,00000000,?,00564012,00000000,00524CB6,00000000,00000000,?,005383E2,?,?), ref: 00563F1E
GetLastError.KERNEL32(?,00564012,00000000,00524CB6,00000000,00000000,?,005383E2,?,?,00000001,00000003,000007D0,?,?,?), ref: 00563F2C
CopyFileW.KERNEL32(00000000,00524CB6,00000000,00524CB6,00000000,?,00564012,00000000,00524CB6,00000000,00000000,?,005383E2,?,?,00000001), ref: 00563F92
GetLastError.KERNEL32(?,00564012,00000000,00524CB6,00000000,00000000,?,005383E2,?,?,00000001,00000003,000007D0,?,?,?), ref: 00563F9C

Strings

fileutil.cpp, xrefs: 00563FBA

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CopyErrorFileLast
String ID: fileutil.cpp
API String ID: 374144340-2967768451
Opcode ID: e92d8a95e5002f2cb0bc9ee279408518efd9419fcf472bdf8283fe2274370ff2
Instruction ID: a880f795fa5871be9b1b77960c6c70b9795affbce82154e117c5917434016539
Opcode Fuzzy Hash: e92d8a95e5002f2cb0bc9ee279408518efd9419fcf472bdf8283fe2274370ff2
Instruction Fuzzy Hash: A5210836E442329AEB201E694C4877BFEA8FF50BA0F160526FC05DB150DB69CE4193E1

Uniqueness

Uniqueness Score: -1.00%

Function 005631C7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 005631DD
SysAllocString.OLEAUT32(?), ref: 005631F9
VariantClear.OLEAUT32(?), ref: 00563280
SysFreeString.OLEAUT32(00000000), ref: 0056328B

Strings

xmlutil.cpp, xrefs: 00563210

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: xmlutil.cpp
API String ID: 760788290-1270936966
Opcode ID: ce546786c335171c55ac53e8a6b2421d580e869e91194ca199aed03b7120da9e
Instruction ID: 5f066cb96151ef56bf11d561dfcdfe605623ccb7872a84536f38433653020f6d
Opcode Fuzzy Hash: ce546786c335171c55ac53e8a6b2421d580e869e91194ca199aed03b7120da9e
Instruction Fuzzy Hash: C4219679A00219EFDB20DB98C858EAE7FB8BF85711F154168F905E7210D731DE44DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0054D047 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 005238D4: GetProcessHeap.KERNEL32(?,000001C7,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238E5
Part of subcall function 005238D4: RtlAllocateHeap.NTDLL(00000000,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238EC

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0054D0DC
ReleaseMutex.KERNEL32(?), ref: 0054D10A
SetEvent.KERNEL32(?), ref: 0054D113

Strings

Failed to allocate buffer., xrefs: 0054D08B
NetFxChainer.cpp, xrefs: 0054D081

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Heap$AllocateEventMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate buffer.$NetFxChainer.cpp
API String ID: 944053411-3611226795
Opcode ID: 2ca947f13021656f7d8fe6ec1ea18bb0d33b7254278d0bcbd225403c442b63df
Instruction ID: fb7fc9660e860cdca80b3156cd189f0280da6c2f9104a7115c771899ba7420f1
Opcode Fuzzy Hash: 2ca947f13021656f7d8fe6ec1ea18bb0d33b7254278d0bcbd225403c442b63df
Instruction Fuzzy Hash: AE21E5B560030ABFDB109F68DC48A99BBF5FF48314F108629F924A7391C775E994CB60

Uniqueness

Uniqueness Score: -1.00%

Function 005255B6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00001000,?,000000FF,version.dll,000000FF,?,00000000,00000007,0052648B,0052648B,?,0052554A,?,?,00000000), ref: 005255F2
GetLastError.KERNEL32(?,0052554A,?,?,00000000,?,00000000,0052648B,?,00527DDC,?,?,?,?,?), ref: 00525621

Strings

version.dll, xrefs: 005255E4
Failed to compare strings., xrefs: 0052564F
variable.cpp, xrefs: 00525645

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CompareErrorLastString
String ID: Failed to compare strings.$variable.cpp$version.dll
API String ID: 1733990998-4228644734
Opcode ID: 262ff44aa9c85fecc4b8a11b579b5496625efd5b923694bd648f90f2cf938443
Instruction ID: 5f8d0599ccbc347de4acc5462df4d34093c3a8b7e2642de8d0312f714440cd26
Opcode Fuzzy Hash: 262ff44aa9c85fecc4b8a11b579b5496625efd5b923694bd648f90f2cf938443
Instruction Fuzzy Hash: 9A21FC32640625ABD7148FACDC44A69BFA4FF4A760F610319F815EB2D0E671ED018790

Uniqueness

Uniqueness Score: -1.00%

Function 005657BF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

QueryServiceConfigW.ADVAPI32(00000000,00000000,00000000,?,00000001,00000000,?,?,005468CE,00000000,?), ref: 005657D5
GetLastError.KERNEL32(?,?,005468CE,00000000,?,?,?,?,?,?,?,?,?,00546CE1,?,?), ref: 005657E3

Part of subcall function 005238D4: GetProcessHeap.KERNEL32(?,000001C7,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238E5
Part of subcall function 005238D4: RtlAllocateHeap.NTDLL(00000000,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238EC

QueryServiceConfigW.ADVAPI32(00000000,00000000,?,?,?,00000001,?,?,005468CE,00000000,?), ref: 0056581D
GetLastError.KERNEL32(?,?,005468CE,00000000,?,?,?,?,?,?,?,?,?,00546CE1,?,?), ref: 00565827

Strings

svcutil.cpp, xrefs: 00565806, 00565848

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ConfigErrorHeapLastQueryService$AllocateProcess
String ID: svcutil.cpp
API String ID: 355237494-1746323212
Opcode ID: 3eee57fcca304ffb4936172f1b76acc31f87fafa4ab8502488d3f8d2ac7d9950
Instruction ID: 3ea791f46df214f532ca3621e8dd9334f8d3761c028046b14e71cc3765b1177d
Opcode Fuzzy Hash: 3eee57fcca304ffb4936172f1b76acc31f87fafa4ab8502488d3f8d2ac7d9950
Instruction Fuzzy Hash: 2321D876A80625BBEB205A6A8D08B9B7EDCFF557A0F210115FD04EB550EB65CE0097E0

Uniqueness

Uniqueness Score: -1.00%

Function 0052999B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,00000100), ref: 005299CE
GetLastError.KERNEL32 ref: 005299D9

Strings

Failed to set variable., xrefs: 00529A4E
Failed to format variable string., xrefs: 005299C1
Failed while searching directory search: %ls, for path: %ls, xrefs: 00529A16

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: Failed to format variable string.$Failed to set variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1799206407-402580132
Opcode ID: 49868bf7d941a5b6c2e2d4ec588a75033eeade1ff88888b2de8e085702f8245a
Instruction ID: 505e0b0d2fab741e0c967019349b4700c0daca6db86fc02299d24f26c3783383
Opcode Fuzzy Hash: 49868bf7d941a5b6c2e2d4ec588a75033eeade1ff88888b2de8e085702f8245a
Instruction Fuzzy Hash: F621D732E41235B7DB119AA8EC45BAEBF65FF56320F208319F810A72D0D7715E9096D1

Uniqueness

Uniqueness Score: -1.00%

Function 005408F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0054095F
GetLastError.KERNEL32 ref: 00540969

Strings

Unexpected call to CabWrite()., xrefs: 00540923
Failed to write during cabinet extraction., xrefs: 00540997
cabextract.cpp, xrefs: 0054098D

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$cabextract.cpp
API String ID: 442123175-3111339858
Opcode ID: be4025cf2560562cb6299c8da3f2cef232d1d4af4c28be0f0bec10c4d323111e
Instruction ID: 3a2838138075a10571c6669622250d2d57f279e8220e47e7fe7fe1ca3f61219f
Opcode Fuzzy Hash: be4025cf2560562cb6299c8da3f2cef232d1d4af4c28be0f0bec10c4d323111e
Instruction Fuzzy Hash: 94219D76600204AFEB04DF6DDD84EAA7BE9FF88724F114159FE08C7296D671DA00DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00534880 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,005351A4), ref: 005348CC

Strings

pipe.cpp, xrefs: 00534904
Failed to write message type to pipe., xrefs: 0053490E
Failed to allocate message to write., xrefs: 005348AB

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: FileWrite
String ID: Failed to allocate message to write.$Failed to write message type to pipe.$pipe.cpp
API String ID: 3934441357-1996674626
Opcode ID: 4f2154549b94a796ec5d7e3a806dbc0d1702db8ada2a695b080d8084eafa38e0
Instruction ID: 725ed4d9ed52b3e400756821f49cd51ed25e700c95fc0bac863c59405bdaf438
Opcode Fuzzy Hash: 4f2154549b94a796ec5d7e3a806dbc0d1702db8ada2a695b080d8084eafa38e0
Instruction Fuzzy Hash: 4B119D72900219BBEB119F95ED09B9FBFA9FF40350F114126F804A3150D770AE50EAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00565BBF Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 67timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00565D7F: lstrlenW.KERNEL32(?), ref: 00565E3D
Part of subcall function 00565D7F: lstrlenW.KERNEL32(?), ref: 00565E55

Part of subcall function 005688BE: GetLastError.KERNEL32(?,?,QdV,00565C11,feclient.dll,clbcatq.dll,0056B508,0056B4F0,HEAD,00000000,0056B4D8,QdV,00000000,?,?,00000000), ref: 005688E8

GetSystemTimeAsFileTime.KERNEL32(0056B478,feclient.dll,0056B478,feclient.dll,clbcatq.dll,0056B508,0056B4F0,HEAD,00000000,0056B4D8,QdV,00000000,?,?,00000000,00000000), ref: 00565C3D

Strings

clbcatq.dll, xrefs: 00565C0A
feclient.dll, xrefs: 00565C0B, 00565C2B, 00565C4F
QdV, xrefs: 00565BE2
HEAD, xrefs: 00565BEE

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Timelstrlen$ErrorFileLastSystem
String ID: HEAD$QdV$clbcatq.dll$feclient.dll
API String ID: 451455982-3688691825
Opcode ID: d4408f2edf9ca66e574c84b17bd029cc9df5f997d159c1b1f8cb230437b74ef2
Instruction ID: 02cb10f143c07faf555b5601cb8645d014d10d137e06be62ba71053860f613be
Opcode Fuzzy Hash: d4408f2edf9ca66e574c84b17bd029cc9df5f997d159c1b1f8cb230437b74ef2
Instruction Fuzzy Hash: 0F218E7690160DABDB02DFA4CD80DEEBBB9FF89354F104265F904A3210EB319E509BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00538003 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 005238D4: GetProcessHeap.KERNEL32(?,000001C7,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238E5
Part of subcall function 005238D4: RtlAllocateHeap.NTDLL(00000000,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238EC

CreateWellKnownSid.ADVAPI32(00000000,00000000,00000000,00000000,00000044,00000001,00000000,00000000,?,?,00538C10,0000001A,00000000,?,00000000,00000000), ref: 0053804C
GetLastError.KERNEL32(?,?,00538C10,0000001A,00000000,?,00000000,00000000,?,?,00000000,00000000,?,?,-00000004,00000000), ref: 00538056

Strings

Failed to allocate memory for well known SID., xrefs: 00538034
cache.cpp, xrefs: 0053802A, 0053807A
Failed to create well known SID., xrefs: 00538084

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Heap$AllocateCreateErrorKnownLastProcessWell
String ID: Failed to allocate memory for well known SID.$Failed to create well known SID.$cache.cpp
API String ID: 2186923214-2110050797
Opcode ID: abb96391b77c1cc2fbc9a388795890799e4acac90f78f70017a66a41d2efd839
Instruction ID: f01604892ae97fd147321056839b3184b18c3ec2565ebbd22ba950718aa77a3d
Opcode Fuzzy Hash: abb96391b77c1cc2fbc9a388795890799e4acac90f78f70017a66a41d2efd839
Instruction Fuzzy Hash: 60012F726417257AE73466796C0EE6B6F9DFF81B60F114016FD08EB180EEB58E41A2E0

Uniqueness

Uniqueness Score: -1.00%

Function 0054DB67 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000003E8,000004FF), ref: 0054DB95
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0054DBBF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0054DD8F,00000000,?,?,?,00000001,00000000), ref: 0054DBC7

Strings

Failed while waiting for download., xrefs: 0054DBF5
bitsengine.cpp, xrefs: 0054DBEB

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLastMessageMultipleObjectsPeekWait
String ID: Failed while waiting for download.$bitsengine.cpp
API String ID: 435350009-228655868
Opcode ID: b13a62c5f762138a00897a3f53d171a405ebe65255aa5955ffb2b4e8fe95a240
Instruction ID: b9210dbb0b5896fca6beaf14f108d098124e63a8a33b16839e398f3d351d6780
Opcode Fuzzy Hash: b13a62c5f762138a00897a3f53d171a405ebe65255aa5955ffb2b4e8fe95a240
Instruction Fuzzy Hash: 8711E533B413297BE7209AA99C49EEB7FACFB45720F010125FD05E71C0D6A59D4486F4

Uniqueness

Uniqueness Score: -1.00%

Function 00563B4A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00563B98
GetLastError.KERNEL32(?,?,00000000), ref: 00563BA2
CloseHandle.KERNEL32(?,?,?,00000000), ref: 00563BD5

Strings

<, xrefs: 00563B8A
shelutil.cpp, xrefs: 00563BC3

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseErrorExecuteHandleLastShell
String ID: <$shelutil.cpp
API String ID: 3023784893-3991740012
Opcode ID: 1976e413def52ba6eb7ec31a7c49853b39cdbf60b1adee9cdfd8b721589e6d08
Instruction ID: 7b777157362a6ca30dc8246b08f57fdbb2897a14e1801652ca4d3967be68c5b4
Opcode Fuzzy Hash: 1976e413def52ba6eb7ec31a7c49853b39cdbf60b1adee9cdfd8b721589e6d08
Instruction Fuzzy Hash: 7F11D3B5E01219ABDB10DFA9D844A8EBBF8FF08350F10412AFD09E7250E7759A04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00525E0B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000010), ref: 00525E39
GetLastError.KERNEL32 ref: 00525E43

Strings

Failed to get computer name., xrefs: 00525E71
variable.cpp, xrefs: 00525E67
Failed to set variant value., xrefs: 00525E8A

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ComputerErrorLastName
String ID: Failed to get computer name.$Failed to set variant value.$variable.cpp
API String ID: 3560734967-484636765
Opcode ID: a3e02c981a5a7c83e47027f0e7af3e49e02d691b8a2585f8262e966b0ab16ebe
Instruction ID: a59bf04082ede2c7feba5a362fd8ea4f7bc8b08875abf1b03d2a985137f0360d
Opcode Fuzzy Hash: a3e02c981a5a7c83e47027f0e7af3e49e02d691b8a2585f8262e966b0ab16ebe
Instruction Fuzzy Hash: 6D01A932A40628ABE710EBA89C05AEF7BECFF49710F110156FD05F7180EA759E0897E1

Uniqueness

Uniqueness Score: -1.00%

Function 00525D71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 56COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 00525D83

Part of subcall function 005609BB: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00525D8F,00000000), ref: 005609CF
Part of subcall function 005609BB: GetProcAddress.KERNEL32(00000000), ref: 005609D6
Part of subcall function 005609BB: GetLastError.KERNEL32(?,?,?,00525D8F,00000000), ref: 005609ED

Part of subcall function 00563BF7: SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00563C24

Strings

variable.cpp, xrefs: 00525DAD
Failed to get 64-bit folder., xrefs: 00525DCD
Failed to get shell folder., xrefs: 00525DB7
Failed to set variant value., xrefs: 00525DE7

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AddressCurrentErrorFolderHandleLastModulePathProcProcess
String ID: Failed to get 64-bit folder.$Failed to get shell folder.$Failed to set variant value.$variable.cpp
API String ID: 2084161155-3906113122
Opcode ID: 9a98b87498097e85fe221d0fafc90f92440e8f8683006a9f54cbb45847162ff8
Instruction ID: 1060b0e5e210e383cc13a5e27ad66d775610bcb1842eae1e1464add72dcc481f
Opcode Fuzzy Hash: 9a98b87498097e85fe221d0fafc90f92440e8f8683006a9f54cbb45847162ff8
Instruction Fuzzy Hash: BD018E32941639B7DF12A694EC0EBAE7E68BF02760F204165F800B71D1EBB49F40E790

Uniqueness

Uniqueness Score: -1.00%

Function 00564038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00564315: FindFirstFileW.KERNEL32(00548FFA,?,000002C0,00000000,00000000), ref: 00564350
Part of subcall function 00564315: FindClose.KERNEL32(00000000), ref: 0056435C

SetFileAttributesW.KERNEL32(00548FFA,00000080,00000000,00548FFA,000000FF,00000000,?,?,00548FFA), ref: 00564067
GetLastError.KERNEL32(?,?,00548FFA), ref: 00564071
DeleteFileW.KERNEL32(00548FFA,00000000,00548FFA,000000FF,00000000,?,?,00548FFA), ref: 00564090
GetLastError.KERNEL32(?,?,00548FFA), ref: 0056409A

Strings

fileutil.cpp, xrefs: 005640B4

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: File$ErrorFindLast$AttributesCloseDeleteFirst
String ID: fileutil.cpp
API String ID: 3967264933-2967768451
Opcode ID: 01d6873dd61017c79350a940819da40f35a3eafac4232277f59f053a24be76a9
Instruction ID: e32145724cc92405719959cf2f7bb384b9cbbe3bcbfd6f41647e92d6ebc46c92
Opcode Fuzzy Hash: 01d6873dd61017c79350a940819da40f35a3eafac4232277f59f053a24be76a9
Instruction Fuzzy Hash: F1019231A01735B7EB216AA98D0CB5B7ED8FF01770F004212FD05EB190D7628E40AAE5

Uniqueness

Uniqueness Score: -1.00%

Function 0054D7CC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0054D7E1
LeaveCriticalSection.KERNEL32(?), ref: 0054D826
SetEvent.KERNEL32(?,?,?,?), ref: 0054D83A

Strings

Failure while sending progress during BITS job modification., xrefs: 0054D815
Failed to get state during job modification., xrefs: 0054D7FA

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get state during job modification.$Failure while sending progress during BITS job modification.
API String ID: 3094578987-1258544340
Opcode ID: 0e89d9d55cb3485647ee0dcef779a7b21d695a7539e9f142da571227fddeb3d0
Instruction ID: e07720e1b747cd34a392aec968b239125c0f46277aa83be8c050e12a98470a92
Opcode Fuzzy Hash: 0e89d9d55cb3485647ee0dcef779a7b21d695a7539e9f142da571227fddeb3d0
Instruction Fuzzy Hash: A9019E32A00625BBDB119B55D849AAEBBBCFF58734B004219E804E7640D770FD48DBE4

Uniqueness

Uniqueness Score: -1.00%

Function 0054DA45 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000008,?,00000000,00000000,00000000,?,0054DBB5), ref: 0054DA59
LeaveCriticalSection.KERNEL32(00000008,?,0054DBB5), ref: 0054DA9E
SetEvent.KERNEL32(?,?,0054DBB5), ref: 0054DAB2

Strings

Failed to get BITS job state., xrefs: 0054DA72
Failure while sending progress., xrefs: 0054DA8D

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get BITS job state.$Failure while sending progress.
API String ID: 3094578987-2876445054
Opcode ID: 6d0f48fdffd49b5d15315dd2170bd2568b18e0067e9424020859f23a37dd2b7f
Instruction ID: 4994d1569cbaf1665edc50b60efd3303b4959522c4b408447e2ab1392716b3f1
Opcode Fuzzy Hash: 6d0f48fdffd49b5d15315dd2170bd2568b18e0067e9424020859f23a37dd2b7f
Instruction Fuzzy Hash: 7A012872504616BBC711DB5AD849DAEBFB8FF54325B000256F909E3210D770ED44D7E4

Uniqueness

Uniqueness Score: -1.00%

Function 0054D5AF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000008,00000000,00000000,?,0054DD19,?,?,?,?,?,00000001,00000000,?), ref: 0054D5C9
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,0054DD19,?,?,?,?,?,00000001,00000000,?), ref: 0054D5D4
GetLastError.KERNEL32(?,0054DD19,?,?,?,?,?,00000001,00000000,?), ref: 0054D5E1

Strings

Failed to create BITS job complete event., xrefs: 0054D60F
bitsengine.cpp, xrefs: 0054D605

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CreateCriticalErrorEventInitializeLastSection
String ID: Failed to create BITS job complete event.$bitsengine.cpp
API String ID: 3069647169-3441864216
Opcode ID: 409ba26bdb93dafbb0a001376bcd1972173d9b5a6206fe5164d82d5ff37bc6d3
Instruction ID: 66e124032e6c5253f90f89fd82c2ac8b73729fe0c1771613e7a47978cf9698d5
Opcode Fuzzy Hash: 409ba26bdb93dafbb0a001376bcd1972173d9b5a6206fe5164d82d5ff37bc6d3
Instruction Fuzzy Hash: 38017172601726BBE710AF6AD805A87BFE8FF49760B014126FD09D7680E7B0D855CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 0052D39D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00536E4B,000000B8,00000000,?,00000000,757A95A0), ref: 0052D3AC
InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 0052D3BB
LeaveCriticalSection.KERNEL32(000000D0,?,00536E4B,000000B8,00000000,?,00000000,757A95A0), ref: 0052D3D0

Strings

userexperience.cpp, xrefs: 0052D3E9
Engine active cannot be changed because it was already in that state., xrefs: 0052D3F3

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalSection$CompareEnterExchangeInterlockedLeave
String ID: Engine active cannot be changed because it was already in that state.$userexperience.cpp
API String ID: 3376869089-1544469594
Opcode ID: 58214c3428c6c9f7c9fe849722dc39ccdefe5ccb10744bf686e7ef8b7a8a0adb
Instruction ID: 227b517ffd2e0ff8f81b264900e970bdc6a8fe0a5baa7bb759edabe898e8ba1e
Opcode Fuzzy Hash: 58214c3428c6c9f7c9fe849722dc39ccdefe5ccb10744bf686e7ef8b7a8a0adb
Instruction Fuzzy Hash: A5F0AF723003196BA710AEAAEC88D977BBCFFD6765B00442AF505C3280DBB4F9458770

Uniqueness

Uniqueness Score: -1.00%

Function 00561B28 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 00561B53
GetLastError.KERNEL32(?,005248D4,00000001,?,?,0052444C,?,?,?,?,0052535E,?,?,?,?), ref: 00561B62

Strings

srclient.dll, xrefs: 00561B31
SRSetRestorePointW, xrefs: 00561B48
srputil.cpp, xrefs: 00561B83

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: SRSetRestorePointW$srclient.dll$srputil.cpp
API String ID: 199729137-398595594
Opcode ID: a343896a43504b6c1098d096cb9eeb56a80a79f809f2f9b958b081e1259faa45
Instruction ID: 18b89f60eb429af764fc567806be6274a6291ddc9166d2ee6b3e4d11b71dc4c3
Opcode Fuzzy Hash: a343896a43504b6c1098d096cb9eeb56a80a79f809f2f9b958b081e1259faa45
Instruction Fuzzy Hash: FEF0D636A41A3697F72126BA9C0977A6D84FB10760F094221EC01F72B1FB65CC4097ED

Uniqueness

Uniqueness Score: -1.00%

Function 00554897 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00554848,00000000,?,005547E8,00000000,00587CF8,0000000C,0055493F,00000000,00000002), ref: 005548B7
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005548CA
FreeLibrary.KERNEL32(00000000,?,?,?,00554848,00000000,?,005547E8,00000000,00587CF8,0000000C,0055493F,00000000,00000002), ref: 005548ED

Strings

CorExitProcess, xrefs: 005548C2
mscoree.dll, xrefs: 005548B0

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2f7307502c57f673aeeedfec38df6b721d7d4b11a78ffd34e08a00d53262111d
Instruction ID: 98de8a9c49704024d1951471d866a2d233634c3f6df9b45bd194e340c632e82c
Opcode Fuzzy Hash: 2f7307502c57f673aeeedfec38df6b721d7d4b11a78ffd34e08a00d53262111d
Instruction Fuzzy Hash: A0F04F34A00208FBDB119BA4DC19BAEBFB8FF44716F004169FC05E2290DB704E99EB90

Uniqueness

Uniqueness Score: -1.00%

Function 0055C9BD Relevance: 7.7, APIs: 5, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,0055D132,?,00000000,?,00000000,00000000), ref: 0055C9FF
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 0055CABB
WriteFile.KERNEL32(?,?,00000000,0055D132,00000000,?,?,?,?,?,?,?,?,?,0055D132,?), ref: 0055CADA
WriteFile.KERNEL32(?,?,00000001,0055D132,00000000,?,?,?,?,?,?,?,?,?,0055D132,?), ref: 0055CB13

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleMultiWide
String ID:
API String ID: 977765425-0
Opcode ID: a3c5e604827878484c2cdc95fa8ef56d56ad16981b7e989c401129b08e0dc6f4
Instruction ID: 7d9787eb5710f0085e17bbed8e2ed5d56f421c5f65e6f8d85ecd60e4459ee663
Opcode Fuzzy Hash: a3c5e604827878484c2cdc95fa8ef56d56ad16981b7e989c401129b08e0dc6f4
Instruction Fuzzy Hash: 43518F71A002499FDB10CFA8DC95AEEBFF8FF19311F14411AE955E7291E7309949CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00539080 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 005391C2

Part of subcall function 00565587: GetLastError.KERNEL32(?,?,00539133,?,00000003,00000000,?), ref: 005655A6

Strings

Failed to find expected public key in certificate chain., xrefs: 00539183
cache.cpp, xrefs: 005391E6
Failed to get certificate public key identifier., xrefs: 005391F0
Failed to read certificate thumbprint., xrefs: 005391B6

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to find expected public key in certificate chain.$Failed to get certificate public key identifier.$Failed to read certificate thumbprint.$cache.cpp
API String ID: 1452528299-3408201827
Opcode ID: 9f2bd38eb95008461c7724dcfaca54c55da6f27dafc4afc92a6738255f6ec8db
Instruction ID: f690dff0a793650b087da8306775a156b3f71c5ff3a8e33308e6329fccab409f
Opcode Fuzzy Hash: 9f2bd38eb95008461c7724dcfaca54c55da6f27dafc4afc92a6738255f6ec8db
Instruction Fuzzy Hash: 764142B1E00216AFDB10DFA9D849AAABBF9BF08750F004125F905F7251D774ED44DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0056937F Relevance: 7.6, APIs: 5, Instructions: 119registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00560E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00565699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00560E52

RegCloseKey.ADVAPI32(00000001,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019,00000001,00000000,00000000,00020019,00000000,00000001), ref: 00569457
RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019), ref: 00569492
RegCloseKey.ADVAPI32(00000001,00000001,00020019,00000000,00000000,00000000,00000000), ref: 005694AE
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000), ref: 005694BB
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000), ref: 005694C8

Part of subcall function 00560B49: RegCloseKey.ADVAPI32(00000000), ref: 00560CA0

Part of subcall function 00560E9B: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00569444,00000001), ref: 00560EB3

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Close$InfoOpenQuery
String ID:
API String ID: 796878624-0
Opcode ID: 302414c4047f2a447c7c6bfd1384511f2e5e00d4d8a3ec84233ed553b751d397
Instruction ID: 75fb8465239162d54447ea032408d3edd097b7b9be855445578b3ee17938a6a0
Opcode Fuzzy Hash: 302414c4047f2a447c7c6bfd1384511f2e5e00d4d8a3ec84233ed553b751d397
Instruction Fuzzy Hash: 34410872C01229FFDF22AF99CD819AEFF79FF04761B11416AE90077125CB324E51AA91

Uniqueness

Uniqueness Score: -1.00%

Function 005288DE Relevance: 7.6, APIs: 5, Instructions: 118stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,00528A9E,005295E7,?,005295E7,?,?,005295E7,?,?), ref: 005288FE
lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,00528A9E,005295E7,?,005295E7,?,?,005295E7,?,?), ref: 00528906
CompareStringW.KERNEL32(0000007F,?,?,?,?,00000000,?,00000000,00000000,?,?,00528A9E,005295E7,?,005295E7,?), ref: 00528955
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,00528A9E,005295E7,?,005295E7,?), ref: 005289B7
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,00528A9E,005295E7,?,005295E7,?), ref: 005289E4

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CompareString$lstrlen
String ID:
API String ID: 1657112622-0
Opcode ID: da0a6ee1025838013d39456779e6df7dd848d51c380ab997bcc631516f301827
Instruction ID: 7c8f650d341421187d1d917fa7ddea8afd30519f07ec94315d939a784dd7e28e
Opcode Fuzzy Hash: da0a6ee1025838013d39456779e6df7dd848d51c380ab997bcc631516f301827
Instruction Fuzzy Hash: C3317572602129BFDF218F98EC48ABE3F6AFF4A360F144415F95997250CA7189D0DB92

Uniqueness

Uniqueness Score: -1.00%

Function 005221BC Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(8007139F,00000000,?,?,00000000,00000000,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 00522202
GetLastError.KERNEL32(?,00000000,00000000,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 0052220E

Part of subcall function 00523B51: GetProcessHeap.KERNEL32(00000000,000001C7,?,005221DC,000001C7,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 00523B59
Part of subcall function 00523B51: HeapSize.KERNEL32(00000000,?,005221DC,000001C7,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 00523B60

Strings

strutil.cpp, xrefs: 00522232

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: strutil.cpp
API String ID: 3662877508-3612885251
Opcode ID: 23e7ad7604e5abea22aa36a937e1d85cb9412c12934692fdbd3be06d41f45233
Instruction ID: b33da71eebc5e8fdf3a4fd1d3f497ad5df6f9e318e09505fd74fa865c24e80f5
Opcode Fuzzy Hash: 23e7ad7604e5abea22aa36a937e1d85cb9412c12934692fdbd3be06d41f45233
Instruction Fuzzy Hash: BC31D73A600236FBEB149A69AC44A677F99FF56360F114225FC15DB2E0EA62CC41D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0052738E Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005252B5,WixBundleOriginalSource,?,?,0053A41D,005253B5,WixBundleOriginalSource,=SR,0058AA90,?,00000000,0052533D,?,00537587,?,?), ref: 0052739A
LeaveCriticalSection.KERNEL32(005252B5,005252B5,00000000,00000000,?,?,0053A41D,005253B5,WixBundleOriginalSource,=SR,0058AA90,?,00000000,0052533D,?,00537587), ref: 00527401

Strings

Failed to get value as string for variable: %ls, xrefs: 005273F0
Failed to get value of variable: %ls, xrefs: 005273D4
WixBundleOriginalSource, xrefs: 00527396

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as string for variable: %ls$Failed to get value of variable: %ls$WixBundleOriginalSource
API String ID: 3168844106-30613933
Opcode ID: 29ded4ee7e361d93080de984809a349a6773fa7692216a104af50acdbc6fa6ae
Instruction ID: b2d8a833178874b08cb5d0e4597d962cb87b92de30eec61e5f6947d715461295
Opcode Fuzzy Hash: 29ded4ee7e361d93080de984809a349a6773fa7692216a104af50acdbc6fa6ae
Instruction Fuzzy Hash: D7018C3298413DBBCB11DE54DC09A9E3F64BF29760F208425FC18AA2A0D6359E50A7D1

Uniqueness

Uniqueness Score: -1.00%

Function 0054CEF5 Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,00000000,?,00000000,?,0054CEEB,00000000), ref: 0054CF10
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,0054CEEB,00000000), ref: 0054CF1C
CloseHandle.KERNEL32(0056B508,00000000,?,00000000,?,0054CEEB,00000000), ref: 0054CF29
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,0054CEEB,00000000), ref: 0054CF36
UnmapViewOfFile.KERNEL32(0056B4D8,00000000,?,0054CEEB,00000000), ref: 0054CF45

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseHandle$FileUnmapView
String ID:
API String ID: 260491571-0
Opcode ID: 7514b69cd7c2083f47c62aa1938cd5b4add8487d4468168b72734634d008f0e2
Instruction ID: 84214fc1c4184342a81acc22e51120b309d6b9a124abe2427da1ecb9027744c2
Opcode Fuzzy Hash: 7514b69cd7c2083f47c62aa1938cd5b4add8487d4468168b72734634d008f0e2
Instruction Fuzzy Hash: 41012876405B15AFCB305F55D890856FFEAFF90319314C83ED29652421C375A884DF40

Uniqueness

Uniqueness Score: -1.00%

Function 005679CC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 005238D4: GetProcessHeap.KERNEL32(?,000001C7,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238E5
Part of subcall function 005238D4: RtlAllocateHeap.NTDLL(00000000,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238EC

SysFreeString.OLEAUT32(00000000), ref: 00567B2C
SysFreeString.OLEAUT32(00000000), ref: 00567B37
SysFreeString.OLEAUT32(00000000), ref: 00567B42

Strings

atomutil.cpp, xrefs: 005679FF

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: atomutil.cpp
API String ID: 2724874077-4059165915
Opcode ID: 61fa6e6c53952f1584e514567367fc63fd16fa3a0375d47375a14a4515824e99
Instruction ID: a190c0fbbb401048e601637713a5a202b588fe3e0e583c46da12d047c9a11717
Opcode Fuzzy Hash: 61fa6e6c53952f1584e514567367fc63fd16fa3a0375d47375a14a4515824e99
Instruction Fuzzy Hash: 50514371E0522EAFDB11DFA4C844F6EBBB8BF48758F150554E905AB260EB70DE00DB90

Uniqueness

Uniqueness Score: -1.00%

Function 005685CB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 005686D8
GetLastError.KERNEL32 ref: 005686E2

Strings

clbcatq.dll, xrefs: 005685E9, 005685F4
timeutil.cpp, xrefs: 00568706

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Time$ErrorFileLastSystem
String ID: clbcatq.dll$timeutil.cpp
API String ID: 2781989572-961924111
Opcode ID: 1b817680d3d3b36868178c743af9473990ec911c2a67f964c1dfbe51fa1ac983
Instruction ID: 3191bd5004371f50d38538955cc10257b4d3e529eaa6722fa4050ab5f5959c79
Opcode Fuzzy Hash: 1b817680d3d3b36868178c743af9473990ec911c2a67f964c1dfbe51fa1ac983
Instruction Fuzzy Hash: 0041C575A40216B6EB209BB8CC85BBF7FB9FFA0701F144619B901A7190DD35DE0483A5

Uniqueness

Uniqueness Score: -1.00%

Function 005635A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(000002C0), ref: 005635BE
SysAllocString.OLEAUT32(?), ref: 005635CE
VariantClear.OLEAUT32(?), ref: 005636AF

Strings

xmlutil.cpp, xrefs: 005635E6

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Variant$AllocClearInitString
String ID: xmlutil.cpp
API String ID: 2213243845-1270936966
Opcode ID: 3ea2a13d2c6c0ee1a0544ffbb186cd89ab98548957ff8c9175cc999e2f9b9401
Instruction ID: 83840d2122375aec926af1ebcb4b1de945fcd9bf4185b1cdf7cc04bc10af8f8e
Opcode Fuzzy Hash: 3ea2a13d2c6c0ee1a0544ffbb186cd89ab98548957ff8c9175cc999e2f9b9401
Instruction Fuzzy Hash: 4F415775A0061AABCB119F69C888EAABBB8FF45710F1545A5FD05EB311DB34DD008B91

Uniqueness

Uniqueness Score: -1.00%

Function 00560D1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00548BD8), ref: 00560D77
RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00548BD8,00000000), ref: 00560D99
RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000003,?,?,00548BD8,00000000,00000000,00000000), ref: 00560DF1

Strings

regutil.cpp, xrefs: 00560DC1

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Enum$InfoQuery
String ID: regutil.cpp
API String ID: 73471667-955085611
Opcode ID: 6bba02b819de4332b84c44d7cb3af357543834aa909a2736e06aab942a3aeed6
Instruction ID: dfd42ae026003a8f4a03591d82f07e199514227bf8684419267a42877586c0ba
Opcode Fuzzy Hash: 6bba02b819de4332b84c44d7cb3af357543834aa909a2736e06aab942a3aeed6
Instruction Fuzzy Hash: 383194B6901129FFEB218A998D84EABBFACFF14350F114566BD04E7190E7319E10D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 005678C5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 005238D4: GetProcessHeap.KERNEL32(?,000001C7,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238E5
Part of subcall function 005238D4: RtlAllocateHeap.NTDLL(00000000,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238EC

SysFreeString.OLEAUT32(00000000), ref: 005679AA
SysFreeString.OLEAUT32(?), ref: 005679B5
SysFreeString.OLEAUT32(00000000), ref: 005679C0

Strings

atomutil.cpp, xrefs: 005678F2

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: atomutil.cpp
API String ID: 2724874077-4059165915
Opcode ID: 7c458792c2b2c0f2a3b288580a0f002251fff28298848401b35ef5249a5c3004
Instruction ID: ee4315711b3a592e968b321ce7b177172a3745f53658f0e018f18265c3e75d3a
Opcode Fuzzy Hash: 7c458792c2b2c0f2a3b288580a0f002251fff28298848401b35ef5249a5c3004
Instruction Fuzzy Hash: 3F318572D0562DBBDB12ABA4CC45EAEBFE8FF49714F0545A1E900AB250D770DD00DB90

Uniqueness

Uniqueness Score: -1.00%

Function 005488CF Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00560E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00565699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00560E52

RegCloseKey.ADVAPI32(00000000,00000000,00000088,00000000,000002C0,00000410,00020019,00000000,000002C0,00000000,?,?,?,00548C14,00000000,00000000), ref: 0054898C

Strings

Failed to ensure there is space for related bundles., xrefs: 0054893F
Failed to open uninstall key for potential related bundle: %ls, xrefs: 005488FB
Failed to initialize package from related bundle id: %ls, xrefs: 00548972

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
API String ID: 47109696-1717420724
Opcode ID: 78ebeb779742046ea98afb94d6ee86302f0842c318d84fd19dc9a19f187a9aaf
Instruction ID: bf169d395702734398742add9a584d1ca040ac7052fb23bc8cb078af44d8fc37
Opcode Fuzzy Hash: 78ebeb779742046ea98afb94d6ee86302f0842c318d84fd19dc9a19f187a9aaf
Instruction Fuzzy Hash: FD21AF32940A1AFBDB129E84CC06BFEBF68FF04718F144155F910A6150DB719E20FB91

Uniqueness

Uniqueness Score: -1.00%

Function 00533955 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00560E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00565699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00560E52

RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,00533E61,feclient.dll,?,00000000,?,?,?,00524A0C), ref: 005339F1

Part of subcall function 00560F6E: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00560FE4
Part of subcall function 00560F6E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 0056101F

Strings

feclient.dll, xrefs: 0053395A
SOFTWARE\Policies\Microsoft\Windows\Installer, xrefs: 00533966
Logging, xrefs: 00533983

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer$feclient.dll
API String ID: 1586453840-3596319545
Opcode ID: 9e73d56d5f420f3830ee1e529d9696ed7d53c85b83b5bc364c958b255a48e7ea
Instruction ID: 8c7375bca144591ed29c8476d16a19c916a74d4feed12f7a8a1e34cab66b0f62
Opcode Fuzzy Hash: 9e73d56d5f420f3830ee1e529d9696ed7d53c85b83b5bc364c958b255a48e7ea
Instruction Fuzzy Hash: 21119073A40208FBDB218E95DD46BBEBFB8FB40B51F404066E505AB0A0E6B19F81E750

Uniqueness

Uniqueness Score: -1.00%

Function 00560658 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62filestringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00000000,00000000,00000000,?,?,0055FF0B,?,?,00000000,00000000,0000FDE9), ref: 0056066A
WriteFile.KERNEL32(FFFFFFFF,00000000,00000000,00000000,00000000,?,?,0055FF0B,?,?,00000000,00000000,0000FDE9), ref: 005606A6
GetLastError.KERNEL32(?,?,0055FF0B,?,?,00000000,00000000,0000FDE9), ref: 005606B0

Strings

logutil.cpp, xrefs: 005606E0

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: logutil.cpp
API String ID: 606256338-3545173039
Opcode ID: 818098794f49876bbb035759ac989f10030fc62f32ae34ff4d456e81a6517785
Instruction ID: 97326919cd3f62416dc107b9c167ebfc19a083986e4f58b94d927a3b1dd3d4bb
Opcode Fuzzy Hash: 818098794f49876bbb035759ac989f10030fc62f32ae34ff4d456e81a6517785
Instruction Fuzzy Hash: 7E11C272A01225ABA7109AAADC48EAFBFACFBD5760B000215FD05E7180E770AD10D7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00521209 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,00525137,00000000,?), ref: 00521247
GetLastError.KERNEL32(?,?,?,00525137,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00521251

Strings

apputil.cpp, xrefs: 00521272
ignored , xrefs: 00521216

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ArgvCommandErrorLastLine
String ID: apputil.cpp$ignored
API String ID: 3459693003-568828354
Opcode ID: 9e1b07ea9dd250c2abddd85dd7b31848b29a711ba0bb802bdf95720f0d58f40b
Instruction ID: 47da967c49c10a7b3db535ae4245e41a38dae28bd29c6110885acb267bb24dcf
Opcode Fuzzy Hash: 9e1b07ea9dd250c2abddd85dd7b31848b29a711ba0bb802bdf95720f0d58f40b
Instruction Fuzzy Hash: 53119D75A00629EB9B10DB99D804DAFBFA8FF65750B110155FC05E7250E7309E40DAA0

Uniqueness

Uniqueness Score: -1.00%

Function 0054CF56 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000002,00000000,?,?,0054D1DC,00000000,00000000,00000000,?), ref: 0054CF66
ReleaseMutex.KERNEL32(?,?,0054D1DC,00000000,00000000,00000000,?), ref: 0054CFED

Part of subcall function 005238D4: GetProcessHeap.KERNEL32(?,000001C7,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238E5
Part of subcall function 005238D4: RtlAllocateHeap.NTDLL(00000000,?,00522284,000001C7,00000001,80004005,8007139F,?,?,0056015F,8007139F,?,00000000,00000000,8007139F), ref: 005238EC

Strings

Failed to allocate memory for message data, xrefs: 0054CFB5
NetFxChainer.cpp, xrefs: 0054CFAB

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Heap$AllocateMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate memory for message data$NetFxChainer.cpp
API String ID: 2993511968-1624333943
Opcode ID: c2a2e2f0e20f257d752fe581f3d811753a38e1b743579aba0ef434420cd45e4b
Instruction ID: 8564c800d3a28ee78a7f844cf13a55d5a7d7a05bfb7fd3cfe1dffcda4bc26111
Opcode Fuzzy Hash: c2a2e2f0e20f257d752fe581f3d811753a38e1b743579aba0ef434420cd45e4b
Instruction Fuzzy Hash: 5E11BFB1300216BFDB04DF28D894E9ABFA5FF4A324F104168F9159B3A1C771AC20CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00521F78 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(000011FF,00525386,?,00000000,00000000,00000000,?,80070656,?,?,?,0053E50B,00000000,00525386,00000000,80070656), ref: 00521FAA
GetLastError.KERNEL32(?,?,?,0053E50B,00000000,00525386,00000000,80070656,?,?,00533F6B,00525386,?,80070656,00000001,crypt32.dll), ref: 00521FB7
LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,0053E50B,00000000,00525386,00000000,80070656,?,?,00533F6B,00525386), ref: 00521FFE

Strings

strutil.cpp, xrefs: 00521FDB

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: strutil.cpp
API String ID: 1365068426-3612885251
Opcode ID: 1ade7c7d5cc62c3ae94f2b571fa8cc94a89269a77015dd0cde437a2cf8ce68fb
Instruction ID: 647d1faff622c2091a772597afd9968593e89736cd9e2357769abe33fd5591d3
Opcode Fuzzy Hash: 1ade7c7d5cc62c3ae94f2b571fa8cc94a89269a77015dd0cde437a2cf8ce68fb
Instruction Fuzzy Hash: 2F113C76900229BBEB159F98DD09AEB7EA8FF09350F00416AFD11E3190E7714E50DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00564C67 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(0056B4F0,40000000,00000001,00000000,00000002,00000080,00000000,00530328,00000000,?,0052F37F,?,00000080,0056B4F0,00000000), ref: 00564C7F
GetLastError.KERNEL32(?,0052F37F,?,00000080,0056B4F0,00000000,?,00530328,?,00000094,?,?,?,?,?,00000000), ref: 00564C8C
CloseHandle.KERNEL32(00000000,00000000,?,0052F37F,?,0052F37F,?,00000080,0056B4F0,00000000,?,00530328,?,00000094), ref: 00564CE0

Strings

fileutil.cpp, xrefs: 00564CB0

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: fileutil.cpp
API String ID: 2528220319-2967768451
Opcode ID: def53d5e2668912c5ef0eff3b77709f25d3841de12924b48e301b671a52c4c49
Instruction ID: d17a84ead871b12c58d4961f8ab7a492c37e0acd991e24e3cdb5ad00c3e3f3d8
Opcode Fuzzy Hash: def53d5e2668912c5ef0eff3b77709f25d3841de12924b48e301b671a52c4c49
Instruction Fuzzy Hash: 16018F367426256BFB215E699C09F5B3E95FB81BB0F014211FE24EB2E0C7719C51EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00564840 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000080,00000001,00000000,00000003,00000080,00000000,000002C0,00000000,?,00548A30,00000000,00000088,000002C0,BundleCachePath,00000000), ref: 00564874
GetLastError.KERNEL32(?,00548A30,00000000,00000088,000002C0,BundleCachePath,00000000,000002C0,BundleVersion,000000B8,000002C0,EngineVersion,000002C0,000000B0), ref: 00564881

Strings

fileutil.cpp, xrefs: 00564855, 005648A5

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: fileutil.cpp
API String ID: 1214770103-2967768451
Opcode ID: cfea8843608e9cb4f57ea56c31585eea56d87d86509d2ebe858e64f1c79ff00b
Instruction ID: 86885c50f162a7072fba2acac1aea3104a3a4d3a2e108abccd85801188bec0c8
Opcode Fuzzy Hash: cfea8843608e9cb4f57ea56c31585eea56d87d86509d2ebe858e64f1c79ff00b
Instruction Fuzzy Hash: 23018636640220B6F72127A9AC0DF6B2E98FB55B70F114221FE05FB1D0C6A54D4557E4

Uniqueness

Uniqueness Score: -1.00%

Function 005469A8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(005468BA,00000001,?,00000001,00000000,?,?,?,?,?,?,005468BA,00000000), ref: 005469D0
GetLastError.KERNEL32(?,?,?,?,?,?,005468BA,00000000), ref: 005469DA

Strings

Failed to stop wusa service., xrefs: 00546A08
msuengine.cpp, xrefs: 005469FE

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ControlErrorLastService
String ID: Failed to stop wusa service.$msuengine.cpp
API String ID: 4114567744-2259829683
Opcode ID: 18a26eafd725af928ccdde156769e954840ce78435af83d454f1b1f5afb445bc
Instruction ID: 125cc920613e5b5c1ccf12a94bb37ba2339264c7acc2b22ec1867fe75ed855d9
Opcode Fuzzy Hash: 18a26eafd725af928ccdde156769e954840ce78435af83d454f1b1f5afb445bc
Instruction Fuzzy Hash: 8101D072740224A7E7109779AC09BEB7BF4FF49710F014129FD04F7180DA749D4592E5

Uniqueness

Uniqueness Score: -1.00%

Function 0053EA72 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009002,00000000,?), ref: 0053EA9A
GetLastError.KERNEL32 ref: 0053EAA4

Strings

Failed to post elevate message., xrefs: 0053EAD2
EngineForApplication.cpp, xrefs: 0053EAC8

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post elevate message.
API String ID: 2609174426-4098423239
Opcode ID: 368448304194f821baaa2cab13921f3bc4704ac4ce07ebd97559c611253f4142
Instruction ID: d940725aaa3bc0e891fbf9b8202f8e50716440bd268ff756a4fc29c0838f9b2b
Opcode Fuzzy Hash: 368448304194f821baaa2cab13921f3bc4704ac4ce07ebd97559c611253f4142
Instruction Fuzzy Hash: 24F0C236740331ABE7205A58AC0EA973BC4FB05760F118225FE19EB1D1E7258C4196D5

Uniqueness

Uniqueness Score: -1.00%

Function 0052D7CF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,BootstrapperApplicationDestroy), ref: 0052D7F6
FreeLibrary.KERNEL32(?,?,005247D1,00000000,?,?,00525386,?,?), ref: 0052D805
GetLastError.KERNEL32(?,005247D1,00000000,?,?,00525386,?,?), ref: 0052D80F

Strings

BootstrapperApplicationDestroy, xrefs: 0052D7EE

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AddressErrorFreeLastLibraryProc
String ID: BootstrapperApplicationDestroy
API String ID: 1144718084-3186005537
Opcode ID: ba303738902272ef412b51d5d4ffcdc8174a4ed0442f8160f9a9f21f355e27a5
Instruction ID: b00ca59bc57f5ea75f644ded823bf20e281db36c0a3e0f0964118b5076d01ab4
Opcode Fuzzy Hash: ba303738902272ef412b51d5d4ffcdc8174a4ed0442f8160f9a9f21f355e27a5
Instruction Fuzzy Hash: F3F049362007109FE7205F6AEC08A67BBF9FF91362B01C52EE466C3560D775E844DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00563C58 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(Microsoft.Update.AutoUpdate,^SR,?,00000000,0052535E,?,?,?), ref: 00563C7F
CoCreateInstance.OLE32(00000000,00000000,00000001,00586F3C,?), ref: 00563C97

Strings

^SR, xrefs: 00563C6F, 00563C76, 00563C79
Microsoft.Update.AutoUpdate, xrefs: 00563C7A

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID: Microsoft.Update.AutoUpdate$^SR
API String ID: 2151042543-3577246098
Opcode ID: 8c278edff595e27ed370ce381a7f50573e021ca3ecb0510363d6e864919ae0a4
Instruction ID: 48436ff590299aea6496f51d31ff2f554b961fb813e1359dd7d4371344c3ffae
Opcode Fuzzy Hash: 8c278edff595e27ed370ce381a7f50573e021ca3ecb0510363d6e864919ae0a4
Instruction Fuzzy Hash: ADF03071700208BBEB00EBA8DD05AEBBBB8EB58710F500465EE01F7150E670AE0897A2

Uniqueness

Uniqueness Score: -1.00%

Function 0053F086 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 0053F09B
GetLastError.KERNEL32 ref: 0053F0A5

Strings

Failed to post plan message., xrefs: 0053F0D3
EngineForApplication.cpp, xrefs: 0053F0C9

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post plan message.
API String ID: 2609174426-2952114608
Opcode ID: 39fe69ce07faddcaed43e7d4cd989a77a5495549e4d1d7df51d81356c76b4289
Instruction ID: 690cf09f6bb965ad97d67080844ddae96c3f817ab4fe7e9be0fa30d3c870760e
Opcode Fuzzy Hash: 39fe69ce07faddcaed43e7d4cd989a77a5495549e4d1d7df51d81356c76b4289
Instruction Fuzzy Hash: FFF0A0327403316AE7202AAAAC0DE877FC8FF45BA0F018021FD0DEB1A1D6658C40D6E4

Uniqueness

Uniqueness Score: -1.00%

Function 0053F194 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009005,?,00000000), ref: 0053F1A9
GetLastError.KERNEL32 ref: 0053F1B3

Strings

Failed to post shutdown message., xrefs: 0053F1E1
EngineForApplication.cpp, xrefs: 0053F1D7

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post shutdown message.
API String ID: 2609174426-188808143
Opcode ID: 9939c83d226e7c1e009b703ed36368d5a183e4d7b326b73bc7c20b75554097db
Instruction ID: ba2cf5b7f61ca97a8eeb7a1a1bc2ad30809f02339c3ba99113fcb93cc5b695d9
Opcode Fuzzy Hash: 9939c83d226e7c1e009b703ed36368d5a183e4d7b326b73bc7c20b75554097db
Instruction Fuzzy Hash: 84F0A032B403356AA7206AAAAC0DE8B7FC8FF45BA0F024025FD08E7191E6658D40D7E4

Uniqueness

Uniqueness Score: -1.00%

Function 0054051A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(0056B468,00000000,?,0054145A,?,00000000,?,0052C121,?,005252FD,?,005373B2,?,?,005252FD,?), ref: 00540524
GetLastError.KERNEL32(?,0054145A,?,00000000,?,0052C121,?,005252FD,?,005373B2,?,?,005252FD,?,0052533D,00000001), ref: 0054052E

Strings

Failed to set begin operation event., xrefs: 0054055C
cabextract.cpp, xrefs: 00540552

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$cabextract.cpp
API String ID: 3848097054-4159625223
Opcode ID: 27515bd7c3423c69ec54ce40aa9220de68006a84e7387ed64516a22db90e4a6b
Instruction ID: 9f9782bbacadce26dc06e0728f255e0d75229f413807eca537530abdb5e67266
Opcode Fuzzy Hash: 27515bd7c3423c69ec54ce40aa9220de68006a84e7387ed64516a22db90e4a6b
Instruction Fuzzy Hash: 88F05C33A0073067A72066797C09ADB3EC8EF44760F010035FD08E7080E6648D4092E9

Uniqueness

Uniqueness Score: -1.00%

Function 0053E978 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009003,00000000,?), ref: 0053E98D
GetLastError.KERNEL32 ref: 0053E997

Strings

Failed to post apply message., xrefs: 0053E9C5
EngineForApplication.cpp, xrefs: 0053E9BB

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post apply message.
API String ID: 2609174426-1304321051
Opcode ID: 465df4c52ccbaff3a0da9023804f6e6fb7b9b144afdf5c7e5b7c1be0fd1a4628
Instruction ID: 804ac83326e74f46095ccf2c4012fea8439370274f424307bb5dd38f91933a04
Opcode Fuzzy Hash: 465df4c52ccbaff3a0da9023804f6e6fb7b9b144afdf5c7e5b7c1be0fd1a4628
Instruction Fuzzy Hash: F4F0A0327403316AE7202AA9AC0DE877FC8FF45BA0F024026FD08EB191D6658D40E6E4

Uniqueness

Uniqueness Score: -1.00%

Function 0053EA09 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009000,00000000,?), ref: 0053EA1E
GetLastError.KERNEL32 ref: 0053EA28

Strings

Failed to post detect message., xrefs: 0053EA56
EngineForApplication.cpp, xrefs: 0053EA4C

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post detect message.
API String ID: 2609174426-598219917
Opcode ID: 86dc99863a3318b697c65f25d51f31f0eb7687f7804871d141ae90f7c64426a7
Instruction ID: cbd3ac366f8e40e38c702939ad3ccbffa5346070a0f298daae69687c771401d3
Opcode Fuzzy Hash: 86dc99863a3318b697c65f25d51f31f0eb7687f7804871d141ae90f7c64426a7
Instruction Fuzzy Hash: E6F0A032B403316BE7206AA9AC0DF877FC8FF45BA0F014121FD08EB191D6659E40D6E4

Uniqueness

Uniqueness Score: -1.00%

Function 00524E9C Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00000000,?,0052545F,?,?,?,?,?,?), ref: 00524EF6
DeleteCriticalSection.KERNEL32(?,?,?,00000000,?,0052545F,?,?,?,?,?,?), ref: 00524F0A
TlsFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0052545F,?,?), ref: 00524FF9
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0052545F,?,?), ref: 00525000

Part of subcall function 00521160: LocalFree.KERNEL32(?,?,00524EB3,?,00000000,?,0052545F,?,?,?,?,?,?), ref: 0052116A

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalDeleteFreeSection$CloseHandleLocal
String ID:
API String ID: 3671900028-0
Opcode ID: 45cc5babd7cc577d1c6b808d697a79c8e8d2387cc1fddb6faf683fadbc7dac0d
Instruction ID: d9688e6fca56d222123b12a47ae23995114f39f660fd6a91c157dd3b07395808
Opcode Fuzzy Hash: 45cc5babd7cc577d1c6b808d697a79c8e8d2387cc1fddb6faf683fadbc7dac0d
Instruction Fuzzy Hash: 2441AAB1500B166BDA20EBB4E88DF9B7BECBF45341F440929B65AD3191EB34F544CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00565F0F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00565F82
GetLastError.KERNEL32 ref: 00565FD1

Strings

HhX, xrefs: 00565F66
dlutil.cpp, xrefs: 00565FA6, 00565FF5

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast
String ID: HhX$dlutil.cpp
API String ID: 1452528299-1663735170
Opcode ID: c0d5acf725fca790162759ba6f664db7b19508b08f98a4339695d95ef5f884fb
Instruction ID: 6aa0db80966a22efed816cb77ec16fcaf9bf02ab99bfe03254248b101abef40a
Opcode Fuzzy Hash: c0d5acf725fca790162759ba6f664db7b19508b08f98a4339695d95ef5f884fb
Instruction Fuzzy Hash: AA31A472900725BBEB219EA99C48B6BBEE8FF44760F120125FD05E7150E735CD40A7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00563119 Relevance: 6.1, APIs: 4, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 0056312C
VariantInit.OLEAUT32(?), ref: 00563138
VariantClear.OLEAUT32(?), ref: 005631AC
SysFreeString.OLEAUT32(00000000), ref: 005631B7

Part of subcall function 0056336E: SysAllocString.OLEAUT32(?), ref: 00563383

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: String$AllocVariant$ClearFreeInit
String ID:
API String ID: 347726874-0
Opcode ID: 0cb16c1eeadac7fd8a44fb7f8e0056e324d5d074c49843cb266cb18a38794d7c
Instruction ID: a9046c50351ff7e52b25b1635935379d7c5fc3dc4fb784850056ffbf645fd18e
Opcode Fuzzy Hash: 0cb16c1eeadac7fd8a44fb7f8e0056e324d5d074c49843cb266cb18a38794d7c
Instruction Fuzzy Hash: 25213A31A01219AFCB24DFA9C848EAEBBB8FF45711F14055CE901DB220DB31DE45DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00524B80 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0052F7F7: RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,00524B9F,?,?,00000001), ref: 0052F847

CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000001,00000000,?,?,?), ref: 00524C06

Part of subcall function 0056082D: CreateProcessW.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 0056089A
Part of subcall function 0056082D: GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 005608A4
Part of subcall function 0056082D: CloseHandle.KERNEL32(?,?,?,?,?,00000000,00000000,00000000), ref: 005608ED
Part of subcall function 0056082D: CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 005608FA

Strings

Unable to get resume command line from the registry, xrefs: 00524BA5
Failed to get current process path., xrefs: 00524BC4
Failed to re-launch bundle process after RunOnce: %ls, xrefs: 00524BF0

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Close$Handle$CreateErrorLastProcess
String ID: Failed to get current process path.$Failed to re-launch bundle process after RunOnce: %ls$Unable to get resume command line from the registry
API String ID: 1572399834-642631345
Opcode ID: d1ecddbe435c57c3846998f15f2c422442f84985fee5487e15e8acc9b5c394ff
Instruction ID: 2aa612c8c15519d9d6efed5179ef60166551ae5ca139f6643ca7a43386bbb16f
Opcode Fuzzy Hash: d1ecddbe435c57c3846998f15f2c422442f84985fee5487e15e8acc9b5c394ff
Instruction Fuzzy Hash: 26113076D01529FB8F22AB98ED058AEFFB8FF95711B1041A6F905B3150D7718A80EF80

Uniqueness

Uniqueness Score: -1.00%

Function 00551670 Relevance: 6.1, APIs: 4, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,00000FA0,0058AE4C,?,?,00551617,00000FA0,0058AE4C,00000000,?,?,005517BC,00000008,InitializeCriticalSectionEx), ref: 005516A8
GetLastError.KERNEL32(?,00551617,00000FA0,0058AE4C,00000000,?,?,005517BC,00000008,InitializeCriticalSectionEx,00580D5C,InitializeCriticalSectionEx,00000000,?,0055155E,0058AE4C), ref: 005516B4
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,00551617,00000FA0,0058AE4C,00000000,?,?,005517BC,00000008,InitializeCriticalSectionEx,00580D5C,InitializeCriticalSectionEx,00000000), ref: 005516C2

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 4c5b2b028820a68d0a329c0f1fc51e0c0d855fca3236cfd59fafcc91ae972856
Instruction ID: ea662fbcd8e396c75abde464798a7f45563e38395615034f8eb365e6cf597c26
Opcode Fuzzy Hash: 4c5b2b028820a68d0a329c0f1fc51e0c0d855fca3236cfd59fafcc91ae972856
Instruction Fuzzy Hash: 08012831301A279BD7210B799C64B273F98BF157A2B140B26FD06D7580DB20C809C6EC

Uniqueness

Uniqueness Score: -1.00%

Function 0054E513 Relevance: 6.1, APIs: 4, Instructions: 53timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 0054E547
GetCurrentThreadId.KERNEL32 ref: 0054E556
GetCurrentProcessId.KERNEL32 ref: 0054E55F
QueryPerformanceCounter.KERNEL32(?), ref: 0054E56C

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 2fd486c6d340ac45876481a6293563824abbd77dccb664596f902e9ca50dbaf1
Instruction ID: 0cc9f575116967fb835f76a39543571d9d8483fe66241a4f0a1a4e2d9aa23862
Opcode Fuzzy Hash: 2fd486c6d340ac45876481a6293563824abbd77dccb664596f902e9ca50dbaf1
Instruction Fuzzy Hash: 69119175D01108EBEF14CBB8D9596EEBBF8FB18314F51446AD802E7250EB308A489B50

Uniqueness

Uniqueness Score: -1.00%

Function 00558731 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,005588D5,00000000,00000000,?,005586D8,005588D5,00000000,00000000,00000000,?,005588D5,00000006,FlsSetValue), ref: 00558763
GetLastError.KERNEL32(?,005586D8,005588D5,00000000,00000000,00000000,?,005588D5,00000006,FlsSetValue,00582208,00582210,00000000,00000364,?,00556130), ref: 0055876F
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,005586D8,005588D5,00000000,00000000,00000000,?,005588D5,00000006,FlsSetValue,00582208,00582210,00000000), ref: 0055877D

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: e15a0820712d923c4fcfeed4f082b56f2020c1b9dad38d90246b9aed47f772ef
Instruction ID: 77beb6d31b74b16d73f7be2e500b81d83c91ae73f61024bbcbb0a0c0ee6926ff
Opcode Fuzzy Hash: e15a0820712d923c4fcfeed4f082b56f2020c1b9dad38d90246b9aed47f772ef
Instruction Fuzzy Hash: 3701F736221226ABD7214A699C58A7B3F98FF59BA27340621FD16F3140DF22D809C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 0052730C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00527318
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 0052737F

Strings

Failed to get value as numeric for variable: %ls, xrefs: 0052736E
Failed to get value of variable: %ls, xrefs: 00527352

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as numeric for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-4270472870
Opcode ID: 234650fdae0567f205e8300d1b35be8db5c1e73c8cbb948de8358142aca93cde
Instruction ID: f1076c973d9cb408026036a85c662ac4bf1dde17942677f5fcb49c63c9c99330
Opcode Fuzzy Hash: 234650fdae0567f205e8300d1b35be8db5c1e73c8cbb948de8358142aca93cde
Instruction Fuzzy Hash: 0E018C3294512DBBCB11DB54EC09A9E3F29BF2A720F008560FD04AB260C2359A50ABD0

Uniqueness

Uniqueness Score: -1.00%

Function 00527481 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0052748D
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 005274F4

Strings

Failed to get value of variable: %ls, xrefs: 005274C7
Failed to get value as version for variable: %ls, xrefs: 005274E3

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as version for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-1851729331
Opcode ID: cdaac840a43b143d1e12b0038654484856363448cf96fc0771006e579e9339ee
Instruction ID: 1e17e5750759d867cbddbebf13971c3042b28bd15ad6fe1cdf09b68763287960
Opcode Fuzzy Hash: cdaac840a43b143d1e12b0038654484856363448cf96fc0771006e579e9339ee
Instruction Fuzzy Hash: 4B015E3294413DBBCF12AA44EC05A9E3F68BF1A725F108125FD14AA260D3369E50E7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00527410 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000006,?,00529752,00000000,?,00000000,00000000,00000000,?,00529590,00000000,?,00000000,00000000), ref: 0052741C
LeaveCriticalSection.KERNEL32(00000000,00000000,00000000,00000000,?,00529752,00000000,?,00000000,00000000,00000000,?,00529590,00000000,?,00000000), ref: 00527472

Strings

Failed to get value of variable: %ls, xrefs: 00527442
Failed to copy value of variable: %ls, xrefs: 00527461

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to copy value of variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-2936390398
Opcode ID: a3b97fc4c45be693161d4f23ebffe248679f0b4c3c14492187a6827999538420
Instruction ID: 08fcc6b57aa5f7ab282cdfeb9e703fc6a5c8e171f1e8e1fbba67e0eacc9163ee
Opcode Fuzzy Hash: a3b97fc4c45be693161d4f23ebffe248679f0b4c3c14492187a6827999538420
Instruction Fuzzy Hash: 85F0693294012DBBCF12AF54DC0999E7F28BF1A360F008120FD04AA260D2329A20ABD4

Uniqueness

Uniqueness Score: -1.00%

Function 005688BE Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,QdV,00565C11,feclient.dll,clbcatq.dll,0056B508,0056B4F0,HEAD,00000000,0056B4D8,QdV,00000000,?,?,00000000), ref: 005688E8

Strings

feclient.dll, xrefs: 005688C3
QdV, xrefs: 005688BE
inetutil.cpp, xrefs: 00568903

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLast
String ID: QdV$feclient.dll$inetutil.cpp
API String ID: 1452528299-3248997316
Opcode ID: afb381d2c139917b1251b8caa13d984409f1731e73d0dff649f6c9cfaff50b43
Instruction ID: ff58a2b607b9e695197f6ac8059f215ac92f13f459593fd0c452576ee1d090b3
Opcode Fuzzy Hash: afb381d2c139917b1251b8caa13d984409f1731e73d0dff649f6c9cfaff50b43
Instruction Fuzzy Hash: DEF04F72601229ABE7109B95DC09FABBBACFB05751F018256FD01E7240EBB09A4497E1

Uniqueness

Uniqueness Score: -1.00%

Function 00564661 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00560E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00565699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00560E52

RegCloseKey.ADVAPI32(00000000,80000002,SYSTEM\CurrentControlSet\Control\Session Manager,00000003,?,00000000,00000000,00000101), ref: 005647C2

Strings

SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00564672
PendingFileRenameOperations, xrefs: 005646B2, 0056479A

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-3023217399
Opcode ID: 6c59aab7b827a0546f87b908a441a5195b2f6681318e69038044f9e002f0c74e
Instruction ID: c5da2379a3e92fea29806d2b24e3c1768d13e461b7d814231181ad89feda261b
Opcode Fuzzy Hash: 6c59aab7b827a0546f87b908a441a5195b2f6681318e69038044f9e002f0c74e
Instruction Fuzzy Hash: 77417E75E00219EBCF20DF94C9859AEBFB9FF56B10F2140A9E500AB211DB719E52DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00560B49 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 00560CA0

Part of subcall function 00560E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00565699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00560E52

Strings

regutil.cpp, xrefs: 00560C8D

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseOpen
String ID: regutil.cpp
API String ID: 47109696-955085611
Opcode ID: 718f57e027b40fff44d18414be8e5ee25466beba9f38af9ee9e0640174db8540
Instruction ID: 589b305b2dccdd91b00fe19d67a56a14fed86a19ced507a8bf0d51fbb195527f
Opcode Fuzzy Hash: 718f57e027b40fff44d18414be8e5ee25466beba9f38af9ee9e0640174db8540
Instruction Fuzzy Hash: 8C41D332D41229FBEF215AA4CD04BAFBFA4BB44311F119369ED05AB1E0D7758E50EB80

Uniqueness

Uniqueness Score: -1.00%

Function 00560F6E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00560FE4
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 0056101F

Strings

regutil.cpp, xrefs: 00561057

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: QueryValue
String ID: regutil.cpp
API String ID: 3660427363-955085611
Opcode ID: a277f9a06f42e335eaec94cb7c5f4e8483b34917ee4649e7eea2ea6d8fe36618
Instruction ID: d630feb704e4bff31454618465fb8a6d64666355c05ef6ad75061d8dc488b4f8
Opcode Fuzzy Hash: a277f9a06f42e335eaec94cb7c5f4e8483b34917ee4649e7eea2ea6d8fe36618
Instruction Fuzzy Hash: 02419D31D0162AEBDF209E94C888ABEBFB9FF45320F144169ED14A7251DB318E51DB90

Uniqueness

Uniqueness Score: -1.00%

Function 005565D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0056B508,00000000,00000006,00000001,comres.dll,?,00000000,?,00000000,?,?,00000000,00000006,?,comres.dll,?), ref: 005566A3
GetLastError.KERNEL32 ref: 005566BF

Strings

comres.dll, xrefs: 0055664A, 00556698, 005566D4

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID: comres.dll
API String ID: 203985260-246242247
Opcode ID: 80d5ef1d96d66f03a5598256b823acd68f3dcdec047eb39567912ee35708c989
Instruction ID: 34174b66d338dca00f128c89a7901ad36b21f8c02df2e9bc569e277247eb0b61
Opcode Fuzzy Hash: 80d5ef1d96d66f03a5598256b823acd68f3dcdec047eb39567912ee35708c989
Instruction Fuzzy Hash: 88312C70600296ABCB216F54D8A9BAB7FB8BF52752F940127FC1447191DB308D48C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00568E07 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00568CFB: lstrlenW.KERNEL32(00000100,?,?,00569098,000002C0,00000100,00000100,00000100,?,?,?,00547B40,?,?,000001BC,00000000), ref: 00568D1B

RegCloseKey.ADVAPI32(00000000,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,0056B4F0,wininet.dll,?), ref: 00568F07
RegCloseKey.ADVAPI32(?,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,0056B4F0,wininet.dll,?), ref: 00568F14

Part of subcall function 00560E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00565699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00560E52

Part of subcall function 00560D1C: RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00548BD8), ref: 00560D77
Part of subcall function 00560D1C: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00548BD8,00000000), ref: 00560D99

Strings

wininet.dll, xrefs: 00568E7C, 00568EC9

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Close$EnumInfoOpenQuerylstrlen
String ID: wininet.dll
API String ID: 2680864210-3354682871
Opcode ID: ae316dfc6ed12625e65b89644224d9b506cc8dc8c6e70e043c1c4b3c2d7ceb1f
Instruction ID: 3a46de5cb7f3bcc8d5f0fc4f4bcc28e668abdc76d7522d9d697211f804c40ab1
Opcode Fuzzy Hash: ae316dfc6ed12625e65b89644224d9b506cc8dc8c6e70e043c1c4b3c2d7ceb1f
Instruction Fuzzy Hash: 2F310976C0112AAFCF21AF94C9448AFFF79FF44350B5542A9E91177221DB364E50EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00569220 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00568CFB: lstrlenW.KERNEL32(00000100,?,?,00569098,000002C0,00000100,00000100,00000100,?,?,?,00547B40,?,?,000001BC,00000000), ref: 00568D1B

RegCloseKey.ADVAPI32(00000000,00000000,?,00000000,00000000,00000000), ref: 00569305
RegCloseKey.ADVAPI32(00000001,00000000,?,00000000,00000000,00000000), ref: 0056931F

Part of subcall function 00560AD5: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,00530491,?,00000000,00020006), ref: 00560AFA

Part of subcall function 00561392: RegSetValueExW.ADVAPI32(00020006,00020006,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,0052F1C2,00000000,?,00020006), ref: 005613C5

Part of subcall function 00561392: RegDeleteValueW.ADVAPI32(00020006,00020006,00000000,?,?,0052F1C2,00000000,?,00020006,?,00020006,00020006,00000000,?,?,?), ref: 005613F5

Part of subcall function 00561344: RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,?,0052F11A,00000005,Resume,?,?,?,00000002,00000000), ref: 00561359

Strings

%ls\%ls, xrefs: 00569281

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Value$Close$CreateDeletelstrlen
String ID: %ls\%ls
API String ID: 3924016894-2125769799
Opcode ID: 186e21dd8c57c5ce1e4f52c8eb9938a06d71c763387d97fb9fe33360321f2138
Instruction ID: 0daec63c4bedab481ba989a8a8ffa05d34eb458c34797e383435c173ac4e39a5
Opcode Fuzzy Hash: 186e21dd8c57c5ce1e4f52c8eb9938a06d71c763387d97fb9fe33360321f2138
Instruction Fuzzy Hash: 96311872C0152EBBDF129F94CD848AEBFB9FF44350B04456AE901B3221D7318E20AB90

Uniqueness

Uniqueness Score: -1.00%

Function 00561392 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(00020006,00020006,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,0052F1C2,00000000,?,00020006), ref: 005613C5
RegDeleteValueW.ADVAPI32(00020006,00020006,00000000,?,?,0052F1C2,00000000,?,00020006,?,00020006,00020006,00000000,?,?,?), ref: 005613F5

Strings

regutil.cpp, xrefs: 00561429

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Value$Delete
String ID: regutil.cpp
API String ID: 1738766685-955085611
Opcode ID: eef40e172bccf0dae763f9f7c7d8709c0f85a2091175394366b944029ecfb1ef
Instruction ID: e93a8d35af92c93282762efbc9ce6875b2edcc69f6ee5a78d07fb4b32234dc95
Opcode Fuzzy Hash: eef40e172bccf0dae763f9f7c7d8709c0f85a2091175394366b944029ecfb1ef
Instruction Fuzzy Hash: 1911CA32E00636BBEF219E658C04BBB7AA9FF04751F054221FD00EB1A0E761CD1097D4

Uniqueness

Uniqueness Score: -1.00%

Function 0052DCA5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF,IGNOREDEPENDENCIES,00000000,?,?,0054744B,00000000,IGNOREDEPENDENCIES,00000000,?,0056B508), ref: 0052DCF6

Strings

IGNOREDEPENDENCIES, xrefs: 0052DCAD
Failed to copy the property value., xrefs: 0052DD2A

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CompareString
String ID: Failed to copy the property value.$IGNOREDEPENDENCIES
API String ID: 1825529933-1412343224
Opcode ID: 540a616fd2832459b1850130283212ae69dec1c430c24741d6c41c93121087bc
Instruction ID: b1101306322ca59e692d88640e85e4acd626c49830c8005f0e70a3dd197d4c37
Opcode Fuzzy Hash: 540a616fd2832459b1850130283212ae69dec1c430c24741d6c41c93121087bc
Instruction Fuzzy Hash: C711A332604225AFDB144F44EC85F697BB5FF56320F254575EE189B2D1C7B09C50DAA0

Uniqueness

Uniqueness Score: -1.00%

Function 005654F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(20000004,00000000,00000000,00000000,00000000,00000000,?,?,00538C90,?,00000001,20000004,00000000,00000000,?,00000000), ref: 00565527
SetNamedSecurityInfoW.ADVAPI32(00000000,?,000007D0,00000003,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00538C90,?), ref: 00565542

Strings

aclutil.cpp, xrefs: 00565565

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: InfoNamedSecuritySleep
String ID: aclutil.cpp
API String ID: 2352087905-2159165307
Opcode ID: 94e6f0e25b127cb3b59e6c6a1fa12eace77e0203e37036ecc01ec6c5da924328
Instruction ID: 58847b7a9381f82b067044280531bd93d458089578b273b3cec442e6690b92bc
Opcode Fuzzy Hash: 94e6f0e25b127cb3b59e6c6a1fa12eace77e0203e37036ecc01ec6c5da924328
Instruction Fuzzy Hash: 26018233840529BBDF229E98DD08ECE7E66FF94760F010115FD05A7120E6318E60E790

Uniqueness

Uniqueness Score: -1.00%

Function 005355BD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 005355D9
CoUninitialize.OLE32(?,00000000,?,?,?,?,?,?,?), ref: 00535633

Strings

Failed to initialize COM on cache thread., xrefs: 005355E5

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: InitializeUninitialize
String ID: Failed to initialize COM on cache thread.
API String ID: 3442037557-3629645316
Opcode ID: 4dac0f13e01fcb1969fe3a19a4eb9d1cfe94ca1d540e53874602bf3d30c3c0d8
Instruction ID: 749ee2838821b01be88dc6af3f703d35739ed9f09ef503ab4af4164d9d61a81e
Opcode Fuzzy Hash: 4dac0f13e01fcb1969fe3a19a4eb9d1cfe94ca1d540e53874602bf3d30c3c0d8
Instruction Fuzzy Hash: CF018072600619BFD7058FA9DC84DD6FBACFF08354F408126FA09C7221EB71AE549BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0052155F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(0000007F,00000000,00000000,00536EF3,00000000,00536EF3,00000000,00000000,00536EF3,00000000,00000000,00000000,?,00522326,00000000,00000000), ref: 005215A3
GetLastError.KERNEL32(?,00522326,00000000,00000000,00536EF3,00000200,?,0056516B,00000000,00536EF3,00000000,00536EF3,00000000,00000000,00000000), ref: 005215AD

Strings

strutil.cpp, xrefs: 005215D1

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorLastString
String ID: strutil.cpp
API String ID: 3728238275-3612885251
Opcode ID: b7cbb1cf8b8f7d402c955966e506d84ec5931af650e6a80eb0e309bf41d65ece
Instruction ID: 1e4bc4e5154eff641168dab75f88f5159a7541f48076b69129399b3ddd18aa82
Opcode Fuzzy Hash: b7cbb1cf8b8f7d402c955966e506d84ec5931af650e6a80eb0e309bf41d65ece
Instruction Fuzzy Hash: 0201D232600A3577AB219A9A9C44E577EA9FF967A0F010121FE15EB190DA20CC10DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00563803 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 00563849
SysFreeString.OLEAUT32(00000000), ref: 0056387C

Strings

xmlutil.cpp, xrefs: 00563819, 00563860

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: String$AllocFree
String ID: xmlutil.cpp
API String ID: 344208780-1270936966
Opcode ID: d825b9bf221d779fc812f89a5c9c0e554f8b784579e66cac6e8170e3153da45d
Instruction ID: d5fbfa9840be5bfbdd14677bdc78d8f8862d8ed77f5c41e906474787f56f393c
Opcode Fuzzy Hash: d825b9bf221d779fc812f89a5c9c0e554f8b784579e66cac6e8170e3153da45d
Instruction Fuzzy Hash: 5A018F75741219ABEF211A589C08EBA3AD8FF85761F544439FE05EB340C7B8CE4197A1

Uniqueness

Uniqueness Score: -1.00%

Function 0056388A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 005638D0
SysFreeString.OLEAUT32(00000000), ref: 00563903

Strings

xmlutil.cpp, xrefs: 005638A0, 005638E7

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: String$AllocFree
String ID: xmlutil.cpp
API String ID: 344208780-1270936966
Opcode ID: e941ca8223ca4e06e8f65413c5ad88030fc802122771b0bc8f22e907079ee191
Instruction ID: 794ee8d02ccf01873b2277a9ab2c91a67a074957c5c2c36b865de37fdc6a5f84
Opcode Fuzzy Hash: e941ca8223ca4e06e8f65413c5ad88030fc802122771b0bc8f22e907079ee191
Instruction Fuzzy Hash: 06018F76B41219BBEB205A589C08FBB3ED8FF857A1F140429FD05AB340C7B8CE005BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00563AC9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00560E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00565699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00560E52

RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,0056396A,?), ref: 00563B3A

Strings

EnableLUA, xrefs: 00563B0C
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00563AE4

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseOpen
String ID: EnableLUA$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
API String ID: 47109696-3551287084
Opcode ID: bf98483750bea9dd8886aca41836f69ee8492bab6e7f9bd7dabee5933f892199
Instruction ID: 8df47c3e234cecbab78d5002bb722012ecfc59975870a044ceef7714c9781341
Opcode Fuzzy Hash: bf98483750bea9dd8886aca41836f69ee8492bab6e7f9bd7dabee5933f892199
Instruction Fuzzy Hash: C8018F32910238EBD710AAA4C80ABEEFFACFB14721F2401A5E900B7161E7755F50E7D4

Uniqueness

Uniqueness Score: -1.00%

Function 00566754 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 005667B3

Part of subcall function 005685CB: SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 005686D8
Part of subcall function 005685CB: GetLastError.KERNEL32 ref: 005686E2

Strings

clbcatq.dll, xrefs: 00566780
atomutil.cpp, xrefs: 005667A1

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Time$ErrorFileFreeLastStringSystem
String ID: atomutil.cpp$clbcatq.dll
API String ID: 211557998-3749116663
Opcode ID: 53663844cb6302c4c454dbd6230f4f294cc2cc3433a2f2d5a04b13d65f68a37a
Instruction ID: 6f70aa0f68a09fcce97619d183acc28b0b9159b259c0575cf639fe6f2cb30c7b
Opcode Fuzzy Hash: 53663844cb6302c4c454dbd6230f4f294cc2cc3433a2f2d5a04b13d65f68a37a
Instruction Fuzzy Hash: 9301ADB1A0111AFBCB20AF859981C6AFFB8FF54764F60427AF905A7210D731AE10D7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00551310 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(?,?,?,wT,?,00000000,00000000,?,?,?,?,?,0054E977,?,00587C64), ref: 0055136F

Strings

wT, xrefs: 00551329
wT, xrefs: 00551362, 00551365

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ExceptionRaise
String ID: wT$wT
API String ID: 3997070919-3716118362
Opcode ID: 69d943f1f3c9121cfde5076d17c44aca6dec33c6cd9c300bc633f939b8f64bf8
Instruction ID: 204d7ad2a3ac6ae510d1615dca4c84684966111cd2cc20e6e69a0546dd15ad91
Opcode Fuzzy Hash: 69d943f1f3c9121cfde5076d17c44aca6dec33c6cd9c300bc633f939b8f64bf8
Instruction Fuzzy Hash: 55018436900218ABCF059F99D854BADFFB9FF88710F16855AED0467261CB716C14CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00526418 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 0052642A

Part of subcall function 005609BB: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00525D8F,00000000), ref: 005609CF
Part of subcall function 005609BB: GetProcAddress.KERNEL32(00000000), ref: 005609D6
Part of subcall function 005609BB: GetLastError.KERNEL32(?,?,?,00525D8F,00000000), ref: 005609ED

Part of subcall function 00525BF0: RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00525C77

Strings

Failed to get 64-bit folder., xrefs: 0052644D
Failed to set variant value., xrefs: 00526467

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AddressCloseCurrentErrorHandleLastModuleProcProcess
String ID: Failed to get 64-bit folder.$Failed to set variant value.
API String ID: 3109562764-2681622189
Opcode ID: 98c0a8698f222dc21f2565aabd1f5f59bfff9a78b12a52a7ba3c77af43008ce8
Instruction ID: b6bde57171569d17b3f9f62f782ce8b0909e98de6f9e52c8b63f8f0bab5170a8
Opcode Fuzzy Hash: 98c0a8698f222dc21f2565aabd1f5f59bfff9a78b12a52a7ba3c77af43008ce8
Instruction Fuzzy Hash: 28014F32D41239BBDF12B794EC49AAE7F78FF01721F104155F940A7192E6719E40E6D0

Uniqueness

Uniqueness Score: -1.00%

Function 005233D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,005210DD,?,00000000), ref: 005233F8
GetLastError.KERNEL32(?,?,?,005210DD,?,00000000), ref: 0052340F

Strings

pathutil.cpp, xrefs: 00523433

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: pathutil.cpp
API String ID: 2776309574-741606033
Opcode ID: d111ba3cee49fe32e456e3db75d743c14c1f5dd9bab6ef92edf6b7bbc0f27783
Instruction ID: 2e029663476b31c35e9f54242d1eefee86b5fb397ca9c7b2bf66ef1434cf3745
Opcode Fuzzy Hash: d111ba3cee49fe32e456e3db75d743c14c1f5dd9bab6ef92edf6b7bbc0f27783
Instruction Fuzzy Hash: F1F0C833B0023067AB21666A6C4CA47BE9DFF96760B124162FD05E7190D765CD4192E0

Uniqueness

Uniqueness Score: -1.00%

Function 00530598 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00560E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00565699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00560E52

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,00000001,00000000,?,?,0054BB7C,00000101,?), ref: 005305EF

Strings

Failed to open registration key., xrefs: 005305BF
Failed to update resume mode., xrefs: 005305D9

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to open registration key.$Failed to update resume mode.
API String ID: 47109696-3366686031
Opcode ID: cd41260a616db0dd4ca178c2a60cff09c30ba19bef785a58f50ade5045500ab9
Instruction ID: 56189f42f6db17bf5a143f8936ce0ae9bba2a33d06873a1480da542a5ea10d53
Opcode Fuzzy Hash: cd41260a616db0dd4ca178c2a60cff09c30ba19bef785a58f50ade5045500ab9
Instruction Fuzzy Hash: A6F0A432981629B7D7229A949C06BDEBF69BB00760F101065F500A6190DB75AF10A6D4

Uniqueness

Uniqueness Score: -1.00%

Function 005648CB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(00000000,00000000,00000000,753334C0,?,?,?,0052B919,?,?,?,00000000,00000000), ref: 005648E3
GetLastError.KERNEL32(?,?,?,0052B919,?,?,?,00000000,00000000,?,?,?,00000000,771AC310,00000000), ref: 005648ED

Strings

fileutil.cpp, xrefs: 00564911

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastSize
String ID: fileutil.cpp
API String ID: 464720113-2967768451
Opcode ID: 2d5d06d6a114853ba507c0cc1dc25f90ac27e09ff6aae7348b9f53634c5cb118
Instruction ID: 607c364b7db48a0294ded933a5c3e1bb8ecff580c40e8d3b87f70b32330ae9a5
Opcode Fuzzy Hash: 2d5d06d6a114853ba507c0cc1dc25f90ac27e09ff6aae7348b9f53634c5cb118
Instruction Fuzzy Hash: 72F044B5A10225ABA7149F59980595BFFECFF55750B01411AFC05E7340D771AD10CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 005630BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 005630D4
SysFreeString.OLEAUT32(00000000), ref: 00563104

Strings

xmlutil.cpp, xrefs: 005630E8

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: String$AllocFree
String ID: xmlutil.cpp
API String ID: 344208780-1270936966
Opcode ID: a6b6a84726b299b4d60f7ba534a81a4605e4bec9d0646e7ca43c03baa6295445
Instruction ID: 1cbb3cbd4d69e0a572ff3a73599bc9e47a334e8180abb6a4a597810f450ef64f
Opcode Fuzzy Hash: a6b6a84726b299b4d60f7ba534a81a4605e4bec9d0646e7ca43c03baa6295445
Instruction Fuzzy Hash: 1FF0B435300258E7DB215E049C09F6B7FA5FF82B61F140068FC04AB310CB758E10DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0056336E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00563383
SysFreeString.OLEAUT32(00000000), ref: 005633B3

Strings

xmlutil.cpp, xrefs: 0056339A

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: String$AllocFree
String ID: xmlutil.cpp
API String ID: 344208780-1270936966
Opcode ID: e666ed36e4cf8c81dafaf487aee57a0018d6b9ca1232b0f65f11c6cbbf7ac025
Instruction ID: bf064ac956b43caed24046f2b704e7f8535c4fdcbe97330d8250fc5f34634134
Opcode Fuzzy Hash: e666ed36e4cf8c81dafaf487aee57a0018d6b9ca1232b0f65f11c6cbbf7ac025
Instruction Fuzzy Hash: D7F0BE35300228A7CB221F09AC08E6B3FA8FF95760B240819FC05AB310CBB4CE40DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00561344 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,?,0052F11A,00000005,Resume,?,?,?,00000002,00000000), ref: 00561359

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00561347
regutil.cpp, xrefs: 00561381

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: Value
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce$regutil.cpp
API String ID: 3702945584-2416625845
Opcode ID: bf5545893d7eb3f71dc3e5ca8f9c0310f411f403e3a50142763804f1d24de17f
Instruction ID: 179b45908ce0163e3f44438acf28e66c00f9fe091fbe3e1cbd6dcaf36f37e551
Opcode Fuzzy Hash: bf5545893d7eb3f71dc3e5ca8f9c0310f411f403e3a50142763804f1d24de17f
Instruction Fuzzy Hash: 91E06D72B402397AEB206AA64C09F977E8CEF05AA0F014021BE08EA1A0D761CD0082E4

Uniqueness

Uniqueness Score: -1.00%

Function 00560CD1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00560CF2

Strings

AdvApi32.dll, xrefs: 00560CD7
RegDeleteKeyExW, xrefs: 00560CE7

Memory Dump Source

Source File: 0000000D.00000002.50389617811.0000000000521000.00000020.00000001.01000000.00000009.sdmp, Offset: 00520000, based on PE: true

Associated: 0000000D.00000002.50389581428.0000000000520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50389915426.000000000056B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390036471.000000000058A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.50390089194.000000000058E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_520000_vc_redist.jbxd

Similarity

API ID: AddressProc
String ID: AdvApi32.dll$RegDeleteKeyExW
API String ID: 190572456-850864035
Opcode ID: 053fab66aa9cee301a1c6f005a6edc2af79dd357fadfd1de66aa89aec284483e
Instruction ID: 6cae5b7004043390ab581e2c377156fcaf57866b69a17b384155f5dbc7ea60e1
Opcode Fuzzy Hash: 053fab66aa9cee301a1c6f005a6edc2af79dd357fadfd1de66aa89aec284483e
Instruction Fuzzy Hash: 4EE086B07056259BEB046F66BC0A9053E94FF35B157001218EC01F33B1EBB05808AB54

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vc_redist.x64.exePID: 3740, Parent PID: 6744COMMON

Executed Functions

Function 00F33BC3 Relevance: 47.6, APIs: 23, Strings: 4, Instructions: 311
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00000000,?,?), ref: 00F33C3F
GetLastError.KERNEL32(?,?,?,00000000,?,?), ref: 00F33C52
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000000,?,?), ref: 00F33C9D
GetLastError.KERNEL32(?,?,?,00000000,?,?), ref: 00F33CA7
GetTempPathW.KERNEL32(00000104,?,?,?,?,00000000,?,?), ref: 00F33CF5
GetLastError.KERNEL32(?,?,?,00000000,?,?), ref: 00F33CFF
FindFirstFileW.KERNELBASE(?,?,?,*.*,?,?,?,?,00000000,?,?), ref: 00F33D52
GetLastError.KERNEL32(?,?,?,00000000,?,?), ref: 00F33D63
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00000000,?,?), ref: 00F33E3D
DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,00000000,?,?), ref: 00F33E51
GetTempFileNameW.KERNEL32(?,DEL,00000000,?,?,?,?,00000000,?,?), ref: 00F33E78
MoveFileExW.KERNEL32(?,?,00000001,?,?,?,00000000,?,?), ref: 00F33E9B
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000000,?,?), ref: 00F33EB4
FindNextFileW.KERNELBASE(000000FF,?,?,?,?,?,?,?,00000000,?,?), ref: 00F33EC4
GetLastError.KERNEL32(?,?,?,00000000,?,?), ref: 00F33ED9
GetLastError.KERNEL32(?,?,?,00000000,?,?), ref: 00F33F08
GetLastError.KERNEL32(?,?,?,00000000,?,?), ref: 00F33F2A
GetLastError.KERNEL32(?,?,?,00000000,?,?), ref: 00F33F4C
RemoveDirectoryW.KERNELBASE(?,?,?,?,00000000,?,?), ref: 00F33F63
GetLastError.KERNEL32(?,?,?,00000000,?,?), ref: 00F33F6D
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000000,?,?), ref: 00F33F93
GetLastError.KERNEL32(?,?,?,00000000,?,?), ref: 00F33FAE
FindClose.KERNEL32(000000FF,?,?,?,00000000,?,?), ref: 00F33FE4

Strings

dirutil.cpp, xrefs: 00F33C75, 00F33EF9
*.*, xrefs: 00F33D2B
DEL, xrefs: 00F33E6C
43u, xrefs: 00F33CF5

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorFileLast$AttributesFindMove$Temp$CloseDeleteDirectoryFirstNameNextPathRemove
String ID: 43u$*.*$DEL$dirutil.cpp
API String ID: 1544372074-664229191
Opcode ID: a22eeef97f4dc752f10f69dd5865ff6097cd7074c24e05b0a7671e3dbd3c06e0
Instruction ID: 7dfc1c38eb1befe627f82fbd8d6f535fc5d6c67724f018cf813e98d4af950548
Opcode Fuzzy Hash: a22eeef97f4dc752f10f69dd5865ff6097cd7074c24e05b0a7671e3dbd3c06e0
Instruction Fuzzy Hash: 91B1DC72E012399AEB30DA758C44BEAB6F5AF44770F4102A5ED09F7190D7718EC0EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F469CC Relevance: 31.9, APIs: 6, Strings: 12, Instructions: 358
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F3D39D: EnterCriticalSection.KERNEL32(?,?,00000000,?,?,00F5B2BB,?,00000000,?,00F5967A,00000000,00000000,00000001,00000000,00000001,?), ref: 00F3D3AC
Part of subcall function 00F3D39D: InterlockedCompareExchange.KERNEL32(00000028,00000001,00000000), ref: 00F3D3BB
Part of subcall function 00F3D39D: LeaveCriticalSection.KERNEL32(?,?,00F5B2BB,?,00000000,?,00F5967A,00000000,00000000,00000001,00000000,00000001,?,?,?,?), ref: 00F3D3D0

ReleaseMutex.KERNEL32(00000000,?,00000000,?,00000000,00000001,00000000), ref: 00F46D9A
CloseHandle.KERNEL32(00000000), ref: 00F46DA3
CloseHandle.KERNEL32(00F34740,?,00000000,?,00000000,00000001,00000000), ref: 00F46DC0

Strings

Failed to register bundle., xrefs: 00F46C00
Engine cannot start apply because it is busy with another action., xrefs: 00F46A2F
Failed to elevate., xrefs: 00F46BA5
core.cpp, xrefs: 00F46A9C, 00F46C76
crypt32.dll, xrefs: 00F46CD2
Another per-machine setup is already executing., xrefs: 00F46BD9
Failed while caching, aborting execution., xrefs: 00F46CA8
Another per-user setup is already executing., xrefs: 00F46AF1
Failed to set initial apply variables., xrefs: 00F46B18
UX aborted apply begin., xrefs: 00F46AA6
Failed to cache engine to working directory., xrefs: 00F46B7F
Failed to create cache thread., xrefs: 00F46C80

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CloseCriticalHandleSection$CompareEnterExchangeInterlockedLeaveMutexRelease
String ID: Another per-machine setup is already executing.$Another per-user setup is already executing.$Engine cannot start apply because it is busy with another action.$Failed to cache engine to working directory.$Failed to create cache thread.$Failed to elevate.$Failed to register bundle.$Failed to set initial apply variables.$Failed while caching, aborting execution.$UX aborted apply begin.$core.cpp$crypt32.dll
API String ID: 322611130-4292671789
Opcode ID: 5e5e34ef06f19ccbd13980eb3352eb62c0f03bde453e6504b425cdadf98d354e
Instruction ID: 3dcd764d48b6c64223145368d3b546da1acb3d6e456adfe5040cb3344011c862
Opcode Fuzzy Hash: 5e5e34ef06f19ccbd13980eb3352eb62c0f03bde453e6504b425cdadf98d354e
Instruction Fuzzy Hash: BFC1D471E01616BFDB199BA0CC45BEEBBB8FF05715F00422AFE15E6140DB34AD44AB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F31070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F333D7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,00000000,00000000,?,00F5AD27,00000001,00000000,?,WixBundleSourceProcessPath,00000001,?), ref: 00F333F8

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 00F310F6

Part of subcall function 00F31174: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,00F3111A,cabinet.dll,00000009,?,?,00000000), ref: 00F31185
Part of subcall function 00F31174: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,00F3111A,cabinet.dll,00000009,?,?,00000000), ref: 00F31190
Part of subcall function 00F31174: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00F3119E
Part of subcall function 00F31174: GetLastError.KERNEL32(?,?,?,?,00F3111A,cabinet.dll,00000009,?,?,00000000), ref: 00F311B9
Part of subcall function 00F31174: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00F311C1
Part of subcall function 00F31174: GetLastError.KERNEL32(?,?,?,?,00F3111A,cabinet.dll,00000009,?,?,00000000), ref: 00F311D6

CloseHandle.KERNEL32(?,?,?,?,00F7B4C0,?,cabinet.dll,00000009,?,?,00000000), ref: 00F31131

Strings

wininet.dll, xrefs: 00F310AE
cabinet.dll, xrefs: 00F31099
clbcatq.dll, xrefs: 00F310BC
comres.dll, xrefs: 00F310B5
msasn1.dll, xrefs: 00F310C3
crypt32.dll, xrefs: 00F310CA
feclient.dll, xrefs: 00F310D1
msi.dll, xrefs: 00F310A0
version.dll, xrefs: 00F310A7

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 3687706282-3151496603
Opcode ID: f4677433cab61b1bc12d79b87c73199dbb51eb9000d3506f410825d92a20ac4f
Instruction ID: 72a9685f87fa1ad9238e77471f4473314231efbe7aac323852cda9a4f99f6476
Opcode Fuzzy Hash: f4677433cab61b1bc12d79b87c73199dbb51eb9000d3506f410825d92a20ac4f
Instruction Fuzzy Hash: 5E21867190021CABDB10EFA5CC49BEEBBB8FF45724F508116F914B7292D7705508EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F6FDC2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130threadtimeCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00F9B60C,00000000,?,?,?,?,00F51014,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00F6FDF0
GetCurrentProcessId.KERNEL32(00000000,?,00F51014,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00F6FE00
GetCurrentThreadId.KERNEL32 ref: 00F6FE09
GetLocalTime.KERNEL32(8007139F,?,00F51014,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00F6FE1F
LeaveCriticalSection.KERNEL32(00F9B60C,?,00000000,00000000,0000FDE9), ref: 00F6FF12

Strings

%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 00F6FEB9

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls
API String ID: 296830338-59366893
Opcode ID: 5f33c293d678b36f6b7114b9139b05c2549bd01c22db3f24cf2d3050d3a468b1
Instruction ID: 6c84df4e43a5b17765fbe14101a247ff610bece66f623bb341b177648bfde944
Opcode Fuzzy Hash: 5f33c293d678b36f6b7114b9139b05c2549bd01c22db3f24cf2d3050d3a468b1
Instruction Fuzzy Hash: 1A419272D00219EFDF20CBA4ED45ABEB7F9AB09B11F404126F904E2161D7359D44FBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F4993E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,*.*,?,?,?,00000000,.unverified,?), ref: 00F499ED
lstrlenW.KERNEL32(?), ref: 00F49A14
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00F49A74
FindClose.KERNEL32(00000000), ref: 00F49A7F

Part of subcall function 00F33BC3: GetFileAttributesW.KERNELBASE(?,?,?,?,00000000,?,?), ref: 00F33C3F
Part of subcall function 00F33BC3: GetLastError.KERNEL32(?,?,?,00000000,?,?), ref: 00F33C52

Strings

*.*, xrefs: 00F499C7
.unverified, xrefs: 00F49981

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: FileFind$AttributesCloseErrorFirstLastNextlstrlen
String ID: *.*$.unverified
API String ID: 457978746-2528915496
Opcode ID: 20fdcd3efc4e4deaa252df5e5b494dd02c0e52bd30505da3362cdcc7bfb1bb77
Instruction ID: 7161d0cf0d2dcb3bad5e8d3375adda81235184e504ae8d63137e2186590e1f41
Opcode Fuzzy Hash: 20fdcd3efc4e4deaa252df5e5b494dd02c0e52bd30505da3362cdcc7bfb1bb77
Instruction Fuzzy Hash: AB416731A0456CAEDF20EB64DC49BEE7BB8AF44711F4001E5E909E50A0E7B89EC4EF55

Uniqueness

Uniqueness Score: -1.00%

Function 00F64812 Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00F647E8,00000000,00F97CF8,0000000C,00F6493F,00000000,00000002,00000000), ref: 00F64833
TerminateProcess.KERNEL32(00000000,?,00F647E8,00000000,00F97CF8,0000000C,00F6493F,00000000,00000002,00000000), ref: 00F6483A
ExitProcess.KERNEL32 ref: 00F6484C

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 8230eaed36b6e0023bd863c4202540e619f2993f1d48bf32f8ce4190d77a2b9d
Instruction ID: eadeea3b5aa7df397dd79e0b1c488568214c5e000cdd8a8423f87792dbb4c875
Opcode Fuzzy Hash: 8230eaed36b6e0023bd863c4202540e619f2993f1d48bf32f8ce4190d77a2b9d
Instruction Fuzzy Hash: 37E0B63140168CAFCF127F65DD09A5A3F69FB52392F450028F8098B132CB39ED92EB95

Uniqueness

Uniqueness Score: -1.00%

Function 00F74315 Relevance: 3.0, APIs: 2, Instructions: 44fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,?,00000000,00000000,?), ref: 00F74350
FindClose.KERNEL32(00000000), ref: 00F7435C

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f24e2064e72256eaeb955d914112692ef809fd3111a572cb5ecadadbc5fee4e2
Instruction ID: 8ed4b480e1679f1e582a7ebe439911bdd2b1fafd0845beeb9f5fffe2f6c3829f
Opcode Fuzzy Hash: f24e2064e72256eaeb955d914112692ef809fd3111a572cb5ecadadbc5fee4e2
Instruction Fuzzy Hash: 0701D631A0010CABDB20EF699D89EAAB3ACEBC6321F400166E90CC3250D7346D4D9B95

Uniqueness

Uniqueness Score: -1.00%

Function 00F3F86E Relevance: 112.4, APIs: 3, Strings: 61, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to get @HelpTelephone., xrefs: 00F3FAB3
DisplayName, xrefs: 00F3FA08
AboutUrl, xrefs: 00F3FAC1
Failed to get @PerMachine., xrefs: 00F3F9AF
Registration, xrefs: 00F3F888
Failed to get @Manufacturer., xrefs: 00F3FCF0
Failed to get @AboutUrl., xrefs: 00F3FAD8
ParentDisplayName, xrefs: 00F3FB0B
Failed to get @DisableModify., xrefs: 00F3FC42
Manufacturer, xrefs: 00F3FCDD
Failed to select Update node., xrefs: 00F3FCC6
Failed to get @DisableRemove., xrefs: 00F3FC6A
HelpLink, xrefs: 00F3FA77
Failed to get @ParentDisplayName., xrefs: 00F3FB22
HelpTelephone, xrefs: 00F3FA9C
button, xrefs: 00F3FB9F
Register, xrefs: 00F3F9E7
Failed to get @ExecutableName., xrefs: 00F3F991
Department, xrefs: 00F3FD01
DisplayVersion, xrefs: 00F3FA2D
Comments, xrefs: 00F3FB33
Tag, xrefs: 00F3F8E1
Failed to parse software tag., xrefs: 00F3FC9A
Failed to select ARP node., xrefs: 00F3F9D9
Name, xrefs: 00F3FD4B
Failed to get @Version., xrefs: 00F3F92E
ProviderKey, xrefs: 00F3F95D
Failed to get @ProviderKey., xrefs: 00F3F970
Failed to get @UpdateUrl., xrefs: 00F3FAFD
registration.cpp, xrefs: 00F3FC11
Failed to get @Name., xrefs: 00F3FD5E
PerMachine, xrefs: 00F3F99C
Failed to get @HelpLink., xrefs: 00F3FA8E
Invalid modify disabled type: %ls, xrefs: 00F3FC1E
ProductFamily, xrefs: 00F3FD26
Arp, xrefs: 00F3F9BD
DisableRemove, xrefs: 00F3FC53
Failed to select registration node., xrefs: 00F3F8A6
Version, xrefs: 00F3F91B
Failed to get @Classification., xrefs: 00F3FD7F
ExecutableName, xrefs: 00F3F97E
Update, xrefs: 00F3FCA8
Failed to get @DisplayName., xrefs: 00F3FA1F
Failed to set registration paths., xrefs: 00F3FD92
Classification, xrefs: 00F3FD6C
Publisher, xrefs: 00F3FA52
DisableModify, xrefs: 00F3FB80
Failed to get @Register., xrefs: 00F3F9FA
Failed to get @Id., xrefs: 00F3F8D3
Failed to get @Department., xrefs: 00F3FD18
yes, xrefs: 00F3FBC0
Failed to get @Publisher., xrefs: 00F3FA69
UpdateUrl, xrefs: 00F3FAE6
Failed to get @Contact., xrefs: 00F3FB72
Contact, xrefs: 00F3FB5B
Failed to get @DisplayVersion., xrefs: 00F3FA44
Failed to get @ProductFamily., xrefs: 00F3FD3D
Failed to get @Tag., xrefs: 00F3F8F4
Failed to parse related bundles, xrefs: 00F3F90D
Failed to parse @Version: %ls, xrefs: 00F3F94F
Failed to get @Comments., xrefs: 00F3FB4A

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID:
String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$registration.cpp$yes
API String ID: 0-2956246334
Opcode ID: ed3ea039364f3862553d72cabe0bab10deb32bea894af545b171154781fda95c
Instruction ID: 513d0a15a14a6fa5436ba10bd04cc735cf233e3b60b9f8e2bfd63820906bbe0d
Opcode Fuzzy Hash: ed3ea039364f3862553d72cabe0bab10deb32bea894af545b171154781fda95c
Instruction Fuzzy Hash: BFE1A633E40766BBCB21A6A0CC45FEEBA68BB00730F514375FD14B6290D7659E09B782

Uniqueness

Uniqueness Score: -1.00%

Function 00F3B389 Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 565
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000000,771AC310,00000000), ref: 00F3B3FF
SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,771AC310,00000000), ref: 00F3B44C
GetLastError.KERNEL32(?,?,?,00000000,771AC310,00000000), ref: 00F3B452
ReadFile.KERNELBASE(00000000,00F3435C,00000040,?,00000000,?,?,?,00000000,771AC310,00000000), ref: 00F3B49A
GetLastError.KERNEL32(?,?,?,00000000,771AC310,00000000), ref: 00F3B4A0
SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,771AC310,00000000), ref: 00F3B4FD
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,771AC310,00000000), ref: 00F3B503
ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,771AC310,00000000), ref: 00F3B54C
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,771AC310,00000000), ref: 00F3B552
SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,771AC310,00000000), ref: 00F3B5C3
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,771AC310,00000000), ref: 00F3B5C9

Strings

Failed to get total size of bundle., xrefs: 00F3B91F
PE, xrefs: 00F3B594
Failed to read NT header., xrefs: 00F3B57D
Failed to find valid NT image header in buffer., xrefs: 00F3BACC
section.cpp, xrefs: 00F3B420, 00F3B473, 00F3B4C1, 00F3B524, 00F3B573, 00F3B5EA, 00F3B639, 00F3B688, 00F3B6DD, 00F3B794, 00F3B7D4, 00F3B826, 00F3B88B, 00F3B8B5, 00F3B8DC, 00F3B9C3, 00F3BA03, 00F3BA22, 00F3BA5F, 00F3BA9D, 00F3BAC0, 00F3BADB
Failed to read section info, data to short: %u, xrefs: 00F3B7A6
.wix, xrefs: 00F3B72C
PE Header from file didn't match PE Header in memory., xrefs: 00F3BA0D
Failed to read section info., xrefs: 00F3B895
4, xrefs: 00F3B780
Failed to seek to section info., xrefs: 00F3B5F4, 00F3B830
Failed to find valid DOS image header in buffer., xrefs: 00F3BAE7
Failed to seek past optional headers., xrefs: 00F3B6E7
Failed to read signature offset., xrefs: 00F3B643
Failed to seek to NT header., xrefs: 00F3B52E
Failed to read complete image section header, index: %u, xrefs: 00F3BA71
(, xrefs: 00F3B719
Failed to find Burn section., xrefs: 00F3BA2E
Failed to open handle to engine process path., xrefs: 00F3B42A
Failed to read section info, unsupported version: %08x, xrefs: 00F3B8F1
Failed to read DOS header., xrefs: 00F3B4CB
Failed to seek to start of file., xrefs: 00F3B47D
burn, xrefs: 00F3B734
Failed to allocate memory for container sizes., xrefs: 00F3B9CF
Failed to allocate buffer for section info., xrefs: 00F3B7E0
Failed to read signature size., xrefs: 00F3B692
Failed to read complete section info., xrefs: 00F3B8C1
Failed to read image section header, index: %u, xrefs: 00F3BAA8

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorLast$File$Pointer$Read
String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$section.cpp
API String ID: 2600052162-695169583
Opcode ID: 8a23f74f2fcd202ed5cb3ff1234eb198052177ed11d7a0466ebc42f0eb784796
Instruction ID: 888502ab4e37243617dd5cd46fcebf8c2efb637ed6a72bf66b11a1ebfb73d0cb
Opcode Fuzzy Hash: 8a23f74f2fcd202ed5cb3ff1234eb198052177ed11d7a0466ebc42f0eb784796
Instruction Fuzzy Hash: F912B671E40325ABEB20DA25CC55FA776A8EF05720F0141A6FE0DEB281D775CD41EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F50A77 Relevance: 54.5, APIs: 20, Strings: 11, Instructions: 288
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,00000000,00000000,?,00F50621,?,?), ref: 00F50A85
GetLastError.KERNEL32(?,?,?,00000000,00000000,?,00F50621,?,?), ref: 00F50A92
WaitForSingleObject.KERNEL32(?,?,?,?,?,00000000,00000000,?,00F50621,?,?), ref: 00F50ACE
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,?,00F50621,?,?), ref: 00F50AD8

Strings

Failed to copy stream name: %ls, xrefs: 00F50BB7
Failed to set end of file., xrefs: 00F50DCC
Failed to set operation complete event., xrefs: 00F50AC0
cabextract.cpp, xrefs: 00F50AB6, 00F50AFC, 00F50B41, 00F50B6D, 00F50CBE, 00F50D2B, 00F50D7D, 00F50DC2, 00F50E16
Failed to reset begin operation event., xrefs: 00F50B4B
Failed to create file: %ls, xrefs: 00F50D38
Failed to wait for begin operation event., xrefs: 00F50B06
Failed to set file pointer to end of file., xrefs: 00F50D87
Invalid operation for this state., xrefs: 00F50B79
Failed to allocate buffer for stream., xrefs: 00F50CC8
Failed to set file pointer to beginning of file., xrefs: 00F50E20

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorLast$EventObjectSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 3600396749-2104912459
Opcode ID: 7590eee31a8b4608d40db45d0c6162e5fbfc7c23bd9dfc2de26960c1ac2742b9
Instruction ID: 00aa2d8167948a0135e576fba2993a6b4299279b18a650b03d38712648377ad6
Opcode Fuzzy Hash: 7590eee31a8b4608d40db45d0c6162e5fbfc7c23bd9dfc2de26960c1ac2742b9
Instruction Fuzzy Hash: B6912473B40722BBF7206A798D49BA735D4EF05761F114225FE09EA5A0EB64CC00B7E2

Uniqueness

Uniqueness Score: -1.00%

Function 00F452E3 Relevance: 45.7, APIs: 17, Strings: 9, Instructions: 222
filepipesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,?,00000000,?,00F7B4F0,?,00000000,?,00F3442A,?,00F7B4F0), ref: 00F45304
GetCurrentProcessId.KERNEL32(?,00F3442A,?,00F7B4F0), ref: 00F4530F
SetNamedPipeHandleState.KERNELBASE(?,000000FF,00000000,00000000,?,00F3442A,?,00F7B4F0), ref: 00F45346
ConnectNamedPipe.KERNELBASE(?,00000000,?,00F3442A,?,00F7B4F0), ref: 00F4535B
GetLastError.KERNEL32(?,00F3442A,?,00F7B4F0), ref: 00F45365
Sleep.KERNELBASE(00000064,?,00F3442A,?,00F7B4F0), ref: 00F45396
SetNamedPipeHandleState.KERNELBASE(?,00000000,00000000,00000000,?,00F3442A,?,00F7B4F0), ref: 00F453B9
WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,00F3442A,?,00F7B4F0), ref: 00F453D4
WriteFile.KERNEL32(?,00F3442A,00F7B4F0,00000000,00000000,?,00F3442A,?,00F7B4F0), ref: 00F453EF
WriteFile.KERNEL32(?,?,00000004,00000000,00000000,?,00F3442A,?,00F7B4F0), ref: 00F4540A
ReadFile.KERNELBASE(?,00000000,00000004,00000000,00000000,?,00F3442A,?,00F7B4F0), ref: 00F45425
GetLastError.KERNEL32(?,00F3442A,?,00F7B4F0), ref: 00F4547D
GetLastError.KERNEL32(?,00F3442A,?,00F7B4F0), ref: 00F454B1
GetLastError.KERNEL32(?,00F3442A,?,00F7B4F0), ref: 00F454E5
GetLastError.KERNEL32(?,00F3442A,?,00F7B4F0), ref: 00F4557B

Strings

Failed to write secret length to pipe., xrefs: 00F45543
Failed to reset pipe to blocking., xrefs: 00F45574
Failed to write our process id to pipe., xrefs: 00F454DB
crypt32.dll, xrefs: 00F453D2
Failed to read ACK from pipe., xrefs: 00F454A7
Failed to write secret to pipe., xrefs: 00F4550F
Failed to set pipe to non-blocking., xrefs: 00F455A5
Failed to wait for child to connect to pipe., xrefs: 00F45473
pipe.cpp, xrefs: 00F45469, 00F4549D, 00F454D1, 00F45505, 00F45539, 00F4556A, 00F4559B

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
String ID: Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$crypt32.dll$pipe.cpp
API String ID: 2944378912-2047837012
Opcode ID: c8d472212252b2d9d89e97f7182aa65539acbcea948aa74441a94c590dbe8ee9
Instruction ID: 3d5aa643b6ca736a03cb896d43075711d9c6ee153495e100ac1e3caa2eff50d2
Opcode Fuzzy Hash: c8d472212252b2d9d89e97f7182aa65539acbcea948aa74441a94c590dbe8ee9
Instruction Fuzzy Hash: 3E61C872E40729ABE710FAA58C45BFA7AE8AF04B50F114125BD05F7191D764CD40A7E2

Uniqueness

Uniqueness Score: -1.00%

Function 00F3508D Relevance: 44.1, APIs: 5, Strings: 20, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 00F3510F

Part of subcall function 00F703F0: InitializeCriticalSection.KERNEL32(00F9B60C,?,00F3511B,00000000,?,?,?,?,?,?), ref: 00F70407

Part of subcall function 00F31209: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,00F35137,00000000,?), ref: 00F31247
Part of subcall function 00F31209: GetLastError.KERNEL32(?,?,?,00F35137,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00F31251

CoInitializeEx.OLE32(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00F3517D

Part of subcall function 00F70CD1: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00F70CF2

GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 00F3520F
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00F35219
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F3549B

Strings

Invalid run mode., xrefs: 00F352F1
Failed to run RunOnce mode., xrefs: 00F35314
Failed to run per-machine mode., xrefs: 00F35364
Failed to initialize Regutil., xrefs: 00F351C1
Failed to initialize COM., xrefs: 00F35189
engine.cpp, xrefs: 00F3523D
Failed to initialize Wiutil., xrefs: 00F351D9
Failed to run untrusted mode., xrefs: 00F353AE
Failed to parse command line., xrefs: 00F3513D
3.10.4.4718, xrefs: 00F3527C
Failed to run embedded mode., xrefs: 00F3533C
Failed to initialize XML util., xrefs: 00F351F1
Failed to initialize Cryputil., xrefs: 00F3519E
Failed to initialize engine state., xrefs: 00F35164
txt, xrefs: 00F353F2
_Failed, xrefs: 00F353F7
Failed to initialize core., xrefs: 00F352BB
Setup, xrefs: 00F353FC
Failed to get OS info., xrefs: 00F35247
Failed to run per-user mode., xrefs: 00F3538C

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.10.4.4718$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$Setup$_Failed$engine.cpp$txt
API String ID: 3262001429-867073019
Opcode ID: 637d3178c06843c01f181658b193a1a7408bf77a959541edc6a1e371db5053df
Instruction ID: 8a8fb3d60b686b6bd5cfb0642d8553eacaf0ccd9394d5299b8dcc6f4cbb5ca44
Opcode Fuzzy Hash: 637d3178c06843c01f181658b193a1a7408bf77a959541edc6a1e371db5053df
Instruction Fuzzy Hash: 2FB1B972D416299BDB32AF64CC45BED76B4AF84B21F040096FD08B6241DB74DE80BF92

Uniqueness

Uniqueness Score: -1.00%

Function 00F47337 Relevance: 35.3, APIs: 1, Strings: 19, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract bootstrapper application payloads., xrefs: 00F475DD
Failed to set source process path variable., xrefs: 00F474F7
Failed to load manifest., xrefs: 00F473F5
WixBundleSourceProcessFolder, xrefs: 00F47522
Failed to initialize internal cache functionality., xrefs: 00F4758D
Failed to get source process folder from path., xrefs: 00F47513
Failed to load catalog files., xrefs: 00F475FD
Failed to parse command line., xrefs: 00F47474
WixBundleElevated, xrefs: 00F474B3, 00F474C4
Failed to initialize variables., xrefs: 00F4737E
Failed to set original source variable., xrefs: 00F47558
Failed to get unique temporary folder for bootstrapper application., xrefs: 00F475BC
Failed to set source process folder variable., xrefs: 00F47533
WixBundleSourceProcessPath, xrefs: 00F474E6
Failed to open manifest stream., xrefs: 00F473B8
Failed to get manifest stream from container., xrefs: 00F473D9
Failed to open attached UX container., xrefs: 00F4739B
Failed to overwrite the %ls built-in variable., xrefs: 00F474C9
WixBundleOriginalSource, xrefs: 00F47547

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath
API String ID: 32694325-252221001
Opcode ID: 7a110ba19a96568569b8601b332f02a7d99345cd3bb1cb9e9d93e7ed666412d5
Instruction ID: a04375ad067dce9d2043f0d0224a03d8e9eb8dac0835bb89954d01f2e88e0f05
Opcode Fuzzy Hash: 7a110ba19a96568569b8601b332f02a7d99345cd3bb1cb9e9d93e7ed666412d5
Instruction Fuzzy Hash: EB916472E44B1ABACB12EAA4CC41FEEBBADBF04710F054226F905E7141D774E944ABD1

Uniqueness

Uniqueness Score: -1.00%

Function 00F484C4 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 205
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,40000000,00000005,00000000,00000002,08000080,00000000,?,00000000,00000000,00F34CB6,?,?,00000000,00F34CB6,00000000), ref: 00F48507
GetLastError.KERNEL32 ref: 00F48514
FindCloseChangeNotification.KERNELBASE(00000000,?,00000000,00F7B4F0,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F486F6

Strings

cabinet.dll, xrefs: 00F4866F
Failed to seek to checksum in exe header., xrefs: 00F485F9
Failed to copy engine from: %ls to: %ls, xrefs: 00F4859C
Failed to zero out original data offset., xrefs: 00F486E8
Failed to seek to signature table in exe header., xrefs: 00F48660
Failed to update signature offset., xrefs: 00F48615
Failed to create engine file at path: %ls, xrefs: 00F48545
msi.dll, xrefs: 00F48608
Failed to seek to original data in exe burn section header., xrefs: 00F486CF
Failed to seek to beginning of engine file: %ls, xrefs: 00F4856D
cache.cpp, xrefs: 00F48538, 00F485EF, 00F48656, 00F486C5

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ChangeCloseCreateErrorFileFindLastNotification
String ID: Failed to copy engine from: %ls to: %ls$Failed to create engine file at path: %ls$Failed to seek to beginning of engine file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$cabinet.dll$cache.cpp$msi.dll
API String ID: 4091947256-1976062716
Opcode ID: 1e26b1502e6b360d4f5a6c77b481f58b3bf9dc6857736e28f53920fad5fb5a25
Instruction ID: 1064c73d5642c9629b4c580f6e128663030b9bd4486eff9489ae0c7a3e1b2778
Opcode Fuzzy Hash: 1e26b1502e6b360d4f5a6c77b481f58b3bf9dc6857736e28f53920fad5fb5a25
Instruction Fuzzy Hash: 7051B572A41325BBE7116A688C4AFBF7A98EF05750F120125FE05FB191EB64CC01B7E6

Uniqueness

Uniqueness Score: -1.00%

Function 00F3567D Relevance: 33.5, APIs: 3, Strings: 19, Instructions: 476
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(000002C0,00000100,00000100,00000000,00000000,?,00F399BB,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,00000100), ref: 00F356A2
lstrlenW.KERNEL32(00000000,?,00F399BB,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,00000100), ref: 00F356AC
LeaveCriticalSection.KERNEL32(000002C0,00000000,00000000,00000000,00000000,00000000,00000001,?,00F399BB,000002C0,?,00000000,00000000,000002C0,00000100,000002C0), ref: 00F35B56

Strings

Failed to allocate variable array., xrefs: 00F35991
Failed to append placeholder., xrefs: 00F35959
Failed to format placeholder string., xrefs: 00F35963
Failed to set variable value., xrefs: 00F3596D
Failed to get formatted length., xrefs: 00F35A6D
Failed to allocate record., xrefs: 00F35917
Failed to format record., xrefs: 00F35B1A
Failed to allocate string., xrefs: 00F35AD1
Failed to append string., xrefs: 00F35728
Failed to set record string., xrefs: 00F35AA2
Failed to determine variable visibility: '%ls'., xrefs: 00F35946
Failed to allocate buffer for format string., xrefs: 00F356CA
[%d], xrefs: 00F3586F
Failed to reallocate variable array., xrefs: 00F35938
*****, xrefs: 00F35820
Failed to get variable name., xrefs: 00F35998
variable.cpp, xrefs: 00F3590A, 00F3592B, 00F35984, 00F359D0, 00F35A60, 00F35A95, 00F35B0D
Failed to set record format string., xrefs: 00F359DD
Failed to copy string., xrefs: 00F35B3A

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeavelstrlen
String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$variable.cpp
API String ID: 3224049430-2050445661
Opcode ID: f93547b1b95d0e20966ecaee32a1dab510a84713b310205dade24453e6b1f000
Instruction ID: 69a7bea5b588f4b83b970a6e7cdee9331007750f8e7e418104baa8e49be1252e
Opcode Fuzzy Hash: f93547b1b95d0e20966ecaee32a1dab510a84713b310205dade24453e6b1f000
Instruction Fuzzy Hash: 2AF18672D01729EBDF11DFA48C41AAF77A4EF84B70F15812ABD05A7240D778DE01ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F480AE Relevance: 33.4, APIs: 7, Strings: 12, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,?,?), ref: 00F48104

Part of subcall function 00F7076C: OpenProcessToken.ADVAPI32(?,00000008,?,?,?,?,?,?,?,00F48110,00000000), ref: 00F7078A
Part of subcall function 00F7076C: GetLastError.KERNEL32(?,?,?,?,00F48110,00000000), ref: 00F70794
Part of subcall function 00F7076C: FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,00F48110,00000000), ref: 00F7081D

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 00F4812A
GetLastError.KERNEL32 ref: 00F48134
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 00F481B1
GetLastError.KERNEL32 ref: 00F481BB

Strings

Failed to get windows path for working folder., xrefs: 00F48162
Failed to copy working folder path., xrefs: 00F4827F
Failed to concat Temp directory on windows path for working folder., xrefs: 00F481A1
Failed to get temp path for working folder., xrefs: 00F481E9
Temp\, xrefs: 00F48189
Failed to ensure windows path for working folder ended in backslash., xrefs: 00F4817F
%ls%ls\, xrefs: 00F4824C
43u, xrefs: 00F481B1
Failed to create working folder guid., xrefs: 00F48207
Failed to append bundle id on to temp path for working folder., xrefs: 00F48264
Failed to convert working folder guid into string., xrefs: 00F4823A
cache.cpp, xrefs: 00F48158, 00F481DF, 00F48230

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorLast$Process$ChangeCloseCurrentDirectoryFindNotificationOpenPathTempTokenWindows
String ID: 43u$%ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$cache.cpp
API String ID: 58964441-2656921328
Opcode ID: ba5793c318f5ea3d21c4663b5a1070f5c9e9b0e10255a692fb1ccdb7ebe325a9
Instruction ID: 689d4f4e74948c73fd6dcfc677352133dd596bb9a452868dd9094eae6e8638fd
Opcode Fuzzy Hash: ba5793c318f5ea3d21c4663b5a1070f5c9e9b0e10255a692fb1ccdb7ebe325a9
Instruction Fuzzy Hash: C841EA72B40728A7EB60A6A48C4AF9B77A8AB00750F004256FD09F7140EA74DE4577E2

Uniqueness

Uniqueness Score: -1.00%

Function 00F59BB3 Relevance: 30.0, APIs: 4, Strings: 13, Instructions: 230
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForMultipleObjects.KERNEL32(00000001,?,00000000,000000FF,00000001,00000000,00000000,?,00F5BA53,00000001), ref: 00F59C18
GetLastError.KERNEL32(?,00F5BA53,00000001), ref: 00F59D88
GetExitCodeThread.KERNEL32(00000001,00000000,?,00F5BA53,00000001), ref: 00F59DC8
GetLastError.KERNEL32(?,00F5BA53,00000001), ref: 00F59DD2

Strings

Invalid execute action., xrefs: 00F59E23
Failed to execute compatible package action., xrefs: 00F59D45
Failed to execute MSU package., xrefs: 00F59CCD
Failed to load compatible package on per-machine package., xrefs: 00F59D2E
Failed to execute EXE package., xrefs: 00F59C4F
Failed to execute package provider registration action., xrefs: 00F59CE9
Failed to execute MSP package., xrefs: 00F59C9D
Failed to execute dependency action., xrefs: 00F59D08
Failed to get cache thread exit code., xrefs: 00F59E03
apply.cpp, xrefs: 00F59DAC, 00F59DF6
Failed to execute MSI package., xrefs: 00F59C78
Failed to wait for cache check-point., xrefs: 00F59DB9
Cache thread exited unexpectedly., xrefs: 00F59E14

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorLast$CodeExitMultipleObjectsThreadWait
String ID: Cache thread exited unexpectedly.$Failed to execute EXE package.$Failed to execute MSI package.$Failed to execute MSP package.$Failed to execute MSU package.$Failed to execute compatible package action.$Failed to execute dependency action.$Failed to execute package provider registration action.$Failed to get cache thread exit code.$Failed to load compatible package on per-machine package.$Failed to wait for cache check-point.$Invalid execute action.$apply.cpp
API String ID: 3703294532-2662572847
Opcode ID: f02011d7115ecf432d2ec78967174693d5f2ed5934d2c7495b98a95e633e3c54
Instruction ID: b1e3c6393e3138d244220278f451b193ad2fabb07046ce190dc90431a70526a5
Opcode Fuzzy Hash: f02011d7115ecf432d2ec78967174693d5f2ed5934d2c7495b98a95e633e3c54
Instruction Fuzzy Hash: 7D717F71A05219EFDB18DF64CD45EBEB7F8EB08711F104169FE05E7290D2B49E04ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F53870 Relevance: 28.6, APIs: 1, Strings: 15, Instructions: 589COMMON

Download Yara Rule

Strings

Failed to get version for product in user unmanaged context: %ls, xrefs: 00F53E97
Invalid state value., xrefs: 00F53F47
UX aborted detect compatible MSI package., xrefs: 00F53B00
msiengine.cpp, xrefs: 00F539F5, 00F53AF6, 00F53F3D, 00F53F54
Failed to copy the installed ProductCode to the package., xrefs: 00F53B20
UX aborted detect related MSI package., xrefs: 00F539FF
Failed to get product information for ProductCode: %ls, xrefs: 00F53A1F
Language, xrefs: 00F53CBC
Failed to enum related products., xrefs: 00F53EC3
Failed to query feature state., xrefs: 00F53F2B
VersionString, xrefs: 00F538CB, 00F53A52, 00F53BAC, 00F53BE3
msasn1.dll, xrefs: 00F539D6, 00F53ADD, 00F53DB3, 00F53EFE
Failed to convert version: %ls to DWORD64 for ProductCode: %ls, xrefs: 00F5390F
Failed to get version for product in machine context: %ls, xrefs: 00F53EB9
UX aborted detect., xrefs: 00F53F5E

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: lstrlen
String ID: Failed to convert version: %ls to DWORD64 for ProductCode: %ls$Failed to copy the installed ProductCode to the package.$Failed to enum related products.$Failed to get product information for ProductCode: %ls$Failed to get version for product in machine context: %ls$Failed to get version for product in user unmanaged context: %ls$Failed to query feature state.$Invalid state value.$Language$UX aborted detect compatible MSI package.$UX aborted detect related MSI package.$UX aborted detect.$VersionString$msasn1.dll$msiengine.cpp
API String ID: 1659193697-2574767977
Opcode ID: 0ab7417cdd9430639f1701e00d97792e9cbb9eca1143a4833223753ce7eadc35
Instruction ID: 28f3bd3f18765740ea4b77fa64b8e751cb46d0245ef5cc2f231d62cafdda6349
Opcode Fuzzy Hash: 0ab7417cdd9430639f1701e00d97792e9cbb9eca1143a4833223753ce7eadc35
Instruction Fuzzy Hash: A722AF71E00619AFDB24DFA8CC81FADBBB9FF04351F10411AEA09AB151D730AE59EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F44CE8 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 161
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 00F44D16
GetLastError.KERNEL32(?,00000000,?,?,00F3442A,?), ref: 00F44D1F
CreateNamedPipeW.KERNELBASE(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,?,?,00000000,?,?,00F3442A,?), ref: 00F44DC0
GetLastError.KERNEL32(?,00F3442A,?), ref: 00F44DCD
CloseHandle.KERNEL32(00000000,pipe.cpp,00000132,00000000,?,?,?,?,?,?,?,00F3442A,?), ref: 00F44E93
LocalFree.KERNEL32(00000000,?,00F3442A,?), ref: 00F44EC1

Strings

Failed to create the security descriptor for the connection event and pipe., xrefs: 00F44D4D
D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD), xrefs: 00F44D11
Failed to allocate full name of pipe: %ls, xrefs: 00F44D8D
\\.\pipe\%ls, xrefs: 00F44D77
\\.\pipe\%ls.Cache, xrefs: 00F44E14
Failed to allocate full name of cache pipe: %ls, xrefs: 00F44E2A
Failed to create pipe: %ls, xrefs: 00F44DFE, 00F44E84
pipe.cpp, xrefs: 00F44D43, 00F44DF1, 00F44E77

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: DescriptorErrorLastSecurity$CloseConvertCreateFreeHandleLocalNamedPipeString
String ID: D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD)$Failed to allocate full name of cache pipe: %ls$Failed to allocate full name of pipe: %ls$Failed to create pipe: %ls$Failed to create the security descriptor for the connection event and pipe.$\\.\pipe\%ls$\\.\pipe\%ls.Cache$pipe.cpp
API String ID: 3065245045-3253666091
Opcode ID: 55b9629107782b46c562cd9c92a317b495cdc536ac7f39cb502ea2787a5dd259
Instruction ID: dee24e4d9cdcc9ca7308080f9eed2043d43e59df60c1ae545ef6b5e81f2cdb59
Opcode Fuzzy Hash: 55b9629107782b46c562cd9c92a317b495cdc536ac7f39cb502ea2787a5dd259
Instruction Fuzzy Hash: 61518371E40315BBEB11ABA49C46BDEBAA4EF04720F104125FD15F61D0D375AE80BB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F341D2 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 158stringCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,00F3515E,?,?,00000000,?,?), ref: 00F341FE
InitializeCriticalSection.KERNEL32(000000D0,?,?,00F3515E,?,?,00000000,?,?), ref: 00F34207
lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,00F3515E,?,?,00000000,?,?), ref: 00F3424D
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,00F3515E,?,?,00000000,?,?), ref: 00F34257
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00F3515E,?,?,00000000,?,?), ref: 00F3426B
lstrlenW.KERNEL32(burn.filehandle.attached,?,?,00F3515E,?,?,00000000,?,?), ref: 00F3427B
lstrlenW.KERNEL32(burn.filehandle.self,?,?,00F3515E,?,?,00000000,?,?), ref: 00F342CB
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,00F3515E,?,?,00000000,?,?), ref: 00F342D5
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00F3515E,?,?,00000000,?,?), ref: 00F342E9
lstrlenW.KERNEL32(burn.filehandle.self,?,?,00F3515E,?,?,00000000,?,?), ref: 00F342F9

Strings

burn.filehandle.self, xrefs: 00F342C6, 00F342CE, 00F342D3, 00F342D4, 00F342F4, 00F343C6
Failed to parse file handle: '%ls', xrefs: 00F3437D
engine.cpp, xrefs: 00F34390, 00F343BC
burn.filehandle.attached, xrefs: 00F34248, 00F34250, 00F34255, 00F34256, 00F34276, 00F3439A
Missing required parameter for switch: %ls, xrefs: 00F3439F
Failed to initialize engine section., xrefs: 00F34362

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$engine.cpp
API String ID: 3039292287-3209860532
Opcode ID: b735506e93a8a344c5c8dc46cf53fdc10dfb8d2229dcfe196245e9dda4654f21
Instruction ID: 36a0e933c6d7adeda3c9577445a43f1f49d25f00677abd99e65cde36e5fc876d
Opcode Fuzzy Hash: b735506e93a8a344c5c8dc46cf53fdc10dfb8d2229dcfe196245e9dda4654f21
Instruction Fuzzy Hash: B951D471A0021ABFC7249B69DC86FAAB76CEF05730F004116F618E7290DB74F950E7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00F4E563 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 135registryCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 00F4E5AE
RegisterClassW.USER32(?), ref: 00F4E5DA
GetLastError.KERNEL32 ref: 00F4E5E5
CreateWindowExW.USER32(00000080,00F89CC4,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 00F4E64C
GetLastError.KERNEL32 ref: 00F4E656
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 00F4E6F4

Strings

Unexpected return value from message pump., xrefs: 00F4E6DF
Failed to register window., xrefs: 00F4E613
WixBurnMessageWindow, xrefs: 00F4E5D3, 00F4E6EF
uithread.cpp, xrefs: 00F4E609, 00F4E67A
Failed to create window., xrefs: 00F4E684

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
API String ID: 213125376-288575659
Opcode ID: 28095a1c85a2344f1f8b3846e4c2419fda5269bad65a7cee9b8681223b3afeef
Instruction ID: 84056d818f7926d874666438dbc37c209bd05f881e4d94f32b9d619d75f2f0e1
Opcode Fuzzy Hash: 28095a1c85a2344f1f8b3846e4c2419fda5269bad65a7cee9b8681223b3afeef
Instruction Fuzzy Hash: 99419572A00219EBDB109BA5DC48BDABFE8FF09360F114126FD09E6190D7719940EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F729B3 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00F337EA: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00F33829
Part of subcall function 00F337EA: GetLastError.KERNEL32 ref: 00F33833

Part of subcall function 00F74932: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00F7495A

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 00F729FD
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 00F72A20
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 00F72A43
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00F72A66
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00F72A89
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00F72AAC
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00F72ACF

Strings

MsiSetExternalUIRecord, xrefs: 00F72A93
MsiGetPatchInfoExW, xrefs: 00F72A4D
MsiSourceListAddSourceExW, xrefs: 00F72AB6
MsiGetProductInfoExW, xrefs: 00F72A70
MsiDetermineApplicablePatchesW, xrefs: 00F72A07
Msi.dll, xrefs: 00F729C5
MsiEnumProductsExW, xrefs: 00F72A2A
MsiDeterminePatchSequenceW, xrefs: 00F729F2

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: AddressProc$ErrorLast$DirectorySystem
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 2510051996-1735120554
Opcode ID: 9f230215372f03af2d4abc7a8dbde351f5c2d57000315e11f433c43876b886e4
Instruction ID: 354818ef9ec606f6d4ec2a4db75ee5c07bb05741b72b5b502d8bed7591b1c4a2
Opcode Fuzzy Hash: 9f230215372f03af2d4abc7a8dbde351f5c2d57000315e11f433c43876b886e4
Instruction Fuzzy Hash: BC31C6B1A4121CAFEF58DF29FE52A293AB5AB44B0074145AFE509D22A0D7B5B900FB41

Uniqueness

Uniqueness Score: -1.00%

Function 00F3C129 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 128fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00F5AB22,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,?,?,00F5AB22), ref: 00F3C170
GetLastError.KERNEL32(?,00F5AB22), ref: 00F3C181
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00000000,?,?,00F5AB22), ref: 00F3C1D0
GetCurrentProcess.KERNEL32(000000FF,00000000,?,00F5AB22), ref: 00F3C1D6
DuplicateHandle.KERNELBASE(00000000,?,00F5AB22), ref: 00F3C1D9
GetLastError.KERNEL32(?,00F5AB22), ref: 00F3C1E3
SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00F5AB22), ref: 00F3C235
GetLastError.KERNEL32(?,00F5AB22), ref: 00F3C23F

Strings

Failed to duplicate handle to container: %ls, xrefs: 00F3C214
container.cpp, xrefs: 00F3C1A5, 00F3C207, 00F3C263
Failed to open file: %ls, xrefs: 00F3C1B2
Failed to move file pointer to container offset., xrefs: 00F3C26D
Failed to open container., xrefs: 00F3C28B

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp
API String ID: 2619879409-2168299741
Opcode ID: f8149445d00b78e569d554d3a97f8c7e69100b1f5e2a61a33f624ea454dd097e
Instruction ID: c7c846a212a8df790b6bebc8c8dde873cb3b232a2b41077ef629f1611c789fd3
Opcode Fuzzy Hash: f8149445d00b78e569d554d3a97f8c7e69100b1f5e2a61a33f624ea454dd097e
Instruction Fuzzy Hash: 8A41C432240305ABDB109F69DC44F573BE9EB85770F118129FD18EB291DA71C811EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F6FBAD Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 00F6FBD5
GetProcAddress.KERNEL32(SystemFunction041), ref: 00F6FBE7
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 00F6FC2A
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00F6FC3E
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 00F6FC76
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00F6FC8A

Strings

Crypt32.dll, xrefs: 00F6FC0B
CryptProtectMemory, xrefs: 00F6FC1F
CryptUnprotectMemory, xrefs: 00F6FC6B
AdvApi32.dll, xrefs: 00F6FBB4
SystemFunction040, xrefs: 00F6FBCA
cryputil.cpp, xrefs: 00F6FC5F
SystemFunction041, xrefs: 00F6FBD7

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$cryputil.cpp
API String ID: 4214558900-3191127217
Opcode ID: e5b5acceb1fed806b8a6f1366488bc89d471e3c7268e9ff1b0b2d5938b84c482
Instruction ID: f41f4c728f6868fb001e5441ff464a0fc1bb602b605d4969baddf653c2b59bc9
Opcode Fuzzy Hash: e5b5acceb1fed806b8a6f1366488bc89d471e3c7268e9ff1b0b2d5938b84c482
Instruction Fuzzy Hash: 40218771A4032EABEB226B27BF04B1275D1AB00BA1F070136FC04E7164EB65CD44BA91

Uniqueness

Uniqueness Score: -1.00%

Function 00F51484 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 103COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,0000001C,?,00000000,00000000,00000000,00000000,?,00F3C285,00000000,00F5AB22,?,00F5AB22), ref: 00F514BB
GetLastError.KERNEL32(?,00F3C285,00000000,00F5AB22,?,00F5AB22), ref: 00F514C4

Strings

Failed to copy file name., xrefs: 00F514A6
cabextract.cpp, xrefs: 00F514E8, 00F5152E, 00F5157A
Failed to wait for operation complete., xrefs: 00F51597
Failed to create extraction thread., xrefs: 00F51584
Failed to create operation complete event., xrefs: 00F51538
Failed to create begin operation event., xrefs: 00F514F2

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp
API String ID: 545576003-1680384675
Opcode ID: bcd336a0b5efdff1901c2b6aeb977655cb3da6590438924938d1f94b366da825
Instruction ID: d1954f7419aa9ae7a1a23cbd09caa545462f2dc1232314c47cf6d46536eb61cb
Opcode Fuzzy Hash: bcd336a0b5efdff1901c2b6aeb977655cb3da6590438924938d1f94b366da825
Instruction Fuzzy Hash: 7721E3B2A407267AF72166795C45FA775ECEF457A1F010222BE09E7180E768EC00B6F7

Uniqueness

Uniqueness Score: -1.00%

Function 00F50627 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 103fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 00F50657
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 00F5066F
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 00F50674
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 00F50677
GetLastError.KERNEL32(?,?), ref: 00F50681
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 00F506F0
GetLastError.KERNEL32(?,?), ref: 00F506FD

Strings

Failed to duplicate handle to cab container., xrefs: 00F506AF
cabextract.cpp, xrefs: 00F506A5, 00F50721
<the>.cab, xrefs: 00F50650
Failed to open cabinet file: %hs, xrefs: 00F5072E
Failed to add virtual file pointer for cab container., xrefs: 00F506D6

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$cabextract.cpp
API String ID: 3030546534-3446344238
Opcode ID: 45da1303a1dac7bcf9f966cccf38fd67504418409c869053a100f7b30711c4b2
Instruction ID: 96708c0d3f68412b3af206d43a285407c1c0b411e0383f22cd31fd0e0b46f195
Opcode Fuzzy Hash: 45da1303a1dac7bcf9f966cccf38fd67504418409c869053a100f7b30711c4b2
Instruction Fuzzy Hash: 48312872A01729BBEB20AB658C48FDB7AACEF05760F100126FD08E7150CB64DD10E7E6

Uniqueness

Uniqueness Score: -1.00%

Function 00F36C5D Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 167COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000001,?,00000000,?,00000000,00000001), ref: 00F36C6E

Part of subcall function 00F355B6: CompareStringW.KERNEL32(0000007F,00001000,?,000000FF,?,000000FF,?,?,?,?,?,?,00F35CA1,?,?,00000000), ref: 00F355F2
Part of subcall function 00F355B6: GetLastError.KERNEL32(?,?,?,00F35CA1,?,?,00000000,?,00000000,?,?,00F373AF,?,?,00000000), ref: 00F35621

LeaveCriticalSection.KERNEL32(00000001,?,00000001), ref: 00F36E02

Strings

Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 00F36E14
Setting string variable '%ls' to value '%ls', xrefs: 00F36D96
Failed to set value of variable: %ls, xrefs: 00F36DEA
Failed to insert variable '%ls'., xrefs: 00F36CB3
Setting numeric variable '%ls' to value %lld, xrefs: 00F36DA3
Failed to find variable value '%ls'., xrefs: 00F36C89
Unsetting variable '%ls', xrefs: 00F36DBE
Attempt to set built-in variable value: %ls, xrefs: 00F36CFC
variable.cpp, xrefs: 00F36CF1
Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 00F36D79
Setting hidden variable '%ls', xrefs: 00F36D2C

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CriticalSection$CompareEnterErrorLastLeaveString
String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$variable.cpp
API String ID: 2716280545-445000439
Opcode ID: 951ccf168d51ba2d35c4a651f2731cafa1f088eadc7fc880cb4cd37d9075f43e
Instruction ID: ccec9ea86246a88acff5e52b99fd63cced7922855379a53101b5092f7725f118
Opcode Fuzzy Hash: 951ccf168d51ba2d35c4a651f2731cafa1f088eadc7fc880cb4cd37d9075f43e
Instruction Fuzzy Hash: 9651D272B00215B7CB309F14CD4AF6B7BA8EB95734F10811AF848EA281C675DD51FAE2

Uniqueness

Uniqueness Score: -1.00%

Function 00F42A60 Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 298COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,006C0064,000000FF,002C002B,000000FF,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 00F42ACD

Strings

wininet.dll, xrefs: 00F42D1E
Failed to add registration action for self dependent., xrefs: 00F42D9E
Failed to add self-dependent to ignore dependents., xrefs: 00F42B51
Failed to add dependent bundle provider key to ignore dependents., xrefs: 00F42C37
crypt32.dll, xrefs: 00F42B18, 00F42C16, 00F42D0B, 00F42D80
Failed to allocate registration action., xrefs: 00F42B36
Failed to check for remaining dependents during planning., xrefs: 00F42C73
Failed to create the string dictionary., xrefs: 00F42B06
Failed to add registration action for dependent related bundle., xrefs: 00F42DD5
Failed to add dependents ignored from command-line., xrefs: 00F42B82

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CompareString
String ID: Failed to add dependent bundle provider key to ignore dependents.$Failed to add dependents ignored from command-line.$Failed to add registration action for dependent related bundle.$Failed to add registration action for self dependent.$Failed to add self-dependent to ignore dependents.$Failed to allocate registration action.$Failed to check for remaining dependents during planning.$Failed to create the string dictionary.$crypt32.dll$wininet.dll
API String ID: 1825529933-1705955799
Opcode ID: df6bcc79f2dbd2441720ca954e915a153804e14b6c5a989846d9152e1a51391c
Instruction ID: 8cf3ffa34b57c8c373a688bfa809b4548f186ed24b8b2c13499b6c42930a8929
Opcode Fuzzy Hash: df6bcc79f2dbd2441720ca954e915a153804e14b6c5a989846d9152e1a51391c
Instruction Fuzzy Hash: 55B17A31E00626EFCBA59F54C881BAEBBB1FF44320F408179FD04AA251D774DA91EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F349DF Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 144windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00F34B5E
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00F34B6F

Strings

Failed to open log., xrefs: 00F34A12
WixBundleLayoutDirectory, xrefs: 00F34AEF
Failed to check global conditions, xrefs: 00F34A43
Failed to query registration., xrefs: 00F34AA8
Failed to create the message window., xrefs: 00F34A92
Failed to set action variables., xrefs: 00F34ABE
Failed to set registration variables., xrefs: 00F34AD8
Failed while running , xrefs: 00F34B24
Failed to set layout directory variable to value provided from command-line., xrefs: 00F34B00

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: MessagePostWindow
String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
API String ID: 3618638489-3051724725
Opcode ID: b521e53f881a8bef6c53f8ec8f1a6b5d6dbd3f651b0f12938a3f298a8f4f364c
Instruction ID: 9a24a45e4b834b3e153baa37d6367d5785c91d9f12daf31726bdd479ed213d59
Opcode Fuzzy Hash: b521e53f881a8bef6c53f8ec8f1a6b5d6dbd3f651b0f12938a3f298a8f4f364c
Instruction Fuzzy Hash: 7141D672A4061ABBDB269A60CC45FBBFA5CFF41770F004216B808A6150DB78FD50B7D2

Uniqueness

Uniqueness Score: -1.00%

Function 00F32DE0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 198sleepfiletimeCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001,00000000,00000000), ref: 00F32E7A
GetLastError.KERNEL32 ref: 00F32E84
GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00F32F1F
CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 00F32FAD
GetLastError.KERNEL32 ref: 00F32FBA
Sleep.KERNEL32(00000064), ref: 00F32FCC
CloseHandle.KERNEL32(?), ref: 00F3302C

Strings

pathutil.cpp, xrefs: 00F32EA8
%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 00F32F7D
43u, xrefs: 00F32E7A

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
String ID: 43u$%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$pathutil.cpp
API String ID: 3480017824-1407774293
Opcode ID: ddb19b19a6efe8443faf866c112dec37216a1c8f188f24212f5b57bd29fe5244
Instruction ID: 3e6f13efb13b71634146faaa606cfa6cd7aa5b2d3b94831136bb7642c62c6217
Opcode Fuzzy Hash: ddb19b19a6efe8443faf866c112dec37216a1c8f188f24212f5b57bd29fe5244
Instruction Fuzzy Hash: 72715472D41229ABDB70DBA4DC49BAEB7F8AB08720F004195F909E7190D7749E80EF61

Uniqueness

Uniqueness Score: -1.00%

Function 00F4E82A Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 99threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,00F35386,?,?), ref: 00F4E84A
GetLastError.KERNEL32(?,00F35386,?,?), ref: 00F4E857
CreateThread.KERNELBASE(00000000,00000000,Function_0001E563,?,00000000,00000000), ref: 00F4E8B0
GetLastError.KERNEL32(?,00F35386,?,?), ref: 00F4E8BD
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,00F35386,?,?), ref: 00F4E8F8
CloseHandle.KERNEL32(00000000,?,00F35386,?,?), ref: 00F4E917
FindCloseChangeNotification.KERNELBASE(?,?,00F35386,?,?), ref: 00F4E924

Strings

Failed to create the UI thread., xrefs: 00F4E8E8
uithread.cpp, xrefs: 00F4E878, 00F4E8DE
Failed to create initialization event., xrefs: 00F4E882

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CloseCreateErrorLast$ChangeEventFindHandleMultipleNotificationObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$uithread.cpp
API String ID: 1372344712-3599963359
Opcode ID: 4970f7ad84a224809da99bdc4ccbe01c6bbe8f84714978c017d2d7300fe0e339
Instruction ID: 06e4c61012dd402d263d4e4ec73e4ebe36cc8a8fb3202af2b4e657f9000229a4
Opcode Fuzzy Hash: 4970f7ad84a224809da99bdc4ccbe01c6bbe8f84714978c017d2d7300fe0e339
Instruction Fuzzy Hash: 04315471E01219BBEB11EFA99D84AAFBAECFF08350F114166FD05E3151D6718E00A7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F51224 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,00000000,75332F60,?,00000000,?,?,?,00000000), ref: 00F51249
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,00F5B555,?,?,80000000,?,?,?,?,?), ref: 00F5125C
GetExitCodeThread.KERNELBASE(?,?,?,?,00000000,?,?,?,?,00F5B555,?,?,80000000,?,?,?), ref: 00F5129E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,00F5B555,?,?,80000000,?,?,?,?,?), ref: 00F512AC
ResetEvent.KERNEL32(?,?,?,00000000,?,?,?,?,00F5B555,?,?,80000000,?,?,?,?), ref: 00F512E7
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,00F5B555,?,?,80000000,?,?,?,?,?), ref: 00F512F1

Strings

Failed to get extraction thread exit code., xrefs: 00F512DD
cabextract.cpp, xrefs: 00F51280, 00F512D0, 00F51315
Failed to reset operation complete event., xrefs: 00F51322
Failed to wait for operation complete event., xrefs: 00F5128D

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$cabextract.cpp
API String ID: 2979751695-3400260300
Opcode ID: a23366af2ff5bbfcce50612bb12045051a6ad0c38f262915a7905ac497ced5c5
Instruction ID: 41a97a758a4f96d2521f23189d206bd2e5bf5a1941ac23941817c5a9dd4c3422
Opcode Fuzzy Hash: a23366af2ff5bbfcce50612bb12045051a6ad0c38f262915a7905ac497ced5c5
Instruction Fuzzy Hash: 1121BF71700304AFFB14AB298D19BBE76E8EB05711F00412EE94AD61A0E774DA00BB16

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D5C0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?,00000000,?,00F346F8,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00F35386,?,?), ref: 00F3D5CD
GetLastError.KERNEL32(?,00F346F8,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00F35386,?,?), ref: 00F3D5DA
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 00F3D612
GetLastError.KERNEL32(?,00F346F8,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00F35386,?,?), ref: 00F3D61E

Strings

wininet.dll, xrefs: 00F3D5F8, 00F3D63C, 00F3D667
BootstrapperApplicationCreate, xrefs: 00F3D60C
Failed to load UX DLL., xrefs: 00F3D605
Failed to create UX., xrefs: 00F3D662
Failed to get BootstrapperApplicationCreate entry-point, xrefs: 00F3D649
userexperience.cpp, xrefs: 00F3D5FB, 00F3D63F

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$userexperience.cpp$wininet.dll
API String ID: 1866314245-1140179540
Opcode ID: ae005afca0cb47b47efbb13fd3b6940891b7ef06aaa957d453c3eccbc3dec0bc
Instruction ID: 2503058de39c219794a6cefb25a664ca748b94c5fe46c495a2317e13a9a7e5ea
Opcode Fuzzy Hash: ae005afca0cb47b47efbb13fd3b6940891b7ef06aaa957d453c3eccbc3dec0bc
Instruction Fuzzy Hash: D511C632A40721ABEB215A69AC05F9736D4AF05760F01822AFD1DE7590DB24CC00BAE7

Uniqueness

Uniqueness Score: -1.00%

Function 00F5B2F6 Relevance: 16.3, APIs: 2, Strings: 7, Instructions: 553COMMON

Download Yara Rule

Strings

Failed to set syncpoint event., xrefs: 00F5B88F
(, xrefs: 00F5B760
end cache package, xrefs: 00F5B707
UX aborted cache., xrefs: 00F5B350
layout bundle, xrefs: 00F5B452
apply.cpp, xrefs: 00F5B346, 00F5B882
begin cache package, xrefs: 00F5B4AF

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID:
String ID: ($Failed to set syncpoint event.$UX aborted cache.$apply.cpp$begin cache package$end cache package$layout bundle
API String ID: 0-826262529
Opcode ID: 207424740864b1bc04ea564d0c6255ca67d99a2e3f29893a7c4f4c55af0af97d
Instruction ID: 9c5ad8372577f2e332d1e6c1013d19130bc6e2326d8ef45ec769884460eb061b
Opcode Fuzzy Hash: 207424740864b1bc04ea564d0c6255ca67d99a2e3f29893a7c4f4c55af0af97d
Instruction Fuzzy Hash: 1F224972A00615FFDB15CF94CC80FAABBB6FF48711F108259FA14AB251D331A965EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F79814 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 221libraryCOMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F798A2
LoadLibraryExA.KERNELBASE(?,00000000,00000000), ref: 00F7992E
GetLastError.KERNEL32 ref: 00F7993A
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 00F7997A

Strings

$, xrefs: 00F79836

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: 15725e136c9b732f3fba2f5051fca50d9dafc52d7cb9a9bfd21526a9723a7952
Instruction ID: f980abd7dcebf1c7c86acd3213de32519e08e321f2c3e98e73528fa2e5fb9d3c
Opcode Fuzzy Hash: 15725e136c9b732f3fba2f5051fca50d9dafc52d7cb9a9bfd21526a9723a7952
Instruction Fuzzy Hash: B1818D75D0121DAFDB11DF95D884AAEB7B9FF84320F15802AE909AB310DBB0DD41DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F3CABE Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 144COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,?,000000FF,00F35381,?,00F352B5,00000000,00F35381,FFF9E89D,00F35381,00F353B5,00F3533D,?), ref: 00F3CB15

Strings

payload.cpp, xrefs: 00F3CC16
Failed to extract file., xrefs: 00F3CBE0
Payload was not found in container: %ls, xrefs: 00F3CC22
Failed to ensure directory exists, xrefs: 00F3CBE7
Failed to get next stream., xrefs: 00F3CBFC
Failed to get directory portion of local file path, xrefs: 00F3CBEE
Failed to find embedded payload: %ls, xrefs: 00F3CB41
Failed to concat file paths., xrefs: 00F3CBF5

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CompareString
String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$payload.cpp
API String ID: 1825529933-1711239286
Opcode ID: 7859bc49b2104ab05b0037c6d3da86827e9dde8d802e0a2aec95c57194d94303
Instruction ID: 6d3a91637cccd76275aa9ec28b1aecb0e50dd094cdbd54a17e6a45a8fceaefd9
Opcode Fuzzy Hash: 7859bc49b2104ab05b0037c6d3da86827e9dde8d802e0a2aec95c57194d94303
Instruction Fuzzy Hash: EC419D32D00229EBCF25DE54CD82AAEB7A5AF40770F11816AE809BB251C7759D40FBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00F34690 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 128windowthreadCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 00F346B5
GetCurrentThreadId.KERNEL32 ref: 00F346BB
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00F34749

Strings

wininet.dll, xrefs: 00F346E8
Unexpected return value from message pump., xrefs: 00F3479F
engine.cpp, xrefs: 00F34795
Failed to load UX., xrefs: 00F346FE
Failed to create engine for UX., xrefs: 00F346D5
Failed to start bootstrapper application., xrefs: 00F34717

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: Message$CurrentPeekThread
String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$engine.cpp$wininet.dll
API String ID: 673430819-2573580774
Opcode ID: 72cafca884404af070cc2bf61692fa4f83e19e4a061f389d9d8ebb3a711568ff
Instruction ID: 6be8399ac158f3916e8fb0f2ef232dd4691d0dd36a01d9baff34955d31e854a8
Opcode Fuzzy Hash: 72cafca884404af070cc2bf61692fa4f83e19e4a061f389d9d8ebb3a711568ff
Instruction Fuzzy Hash: 5741A472A00119BFE714DBA4CC85FBAB7ACEF05724F104126F909E7240DB24FD55A7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F4473A Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 115fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000008,?,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000,00000001,00000000), ref: 00F44765
GetLastError.KERNEL32 ref: 00F44772
ReadFile.KERNELBASE(00000000,00000000,?,?,00000000,?,00000000), ref: 00F4481B
GetLastError.KERNEL32 ref: 00F44825

Strings

Failed to read data for message., xrefs: 00F44853
Failed to read message from pipe., xrefs: 00F447F0
Failed to allocate data for message., xrefs: 00F447D9
pipe.cpp, xrefs: 00F447CF, 00F447E6, 00F44849

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$pipe.cpp
API String ID: 1948546556-3912962418
Opcode ID: c4c3cb4df1023c1c432bbbad1e642f926ccfd8aee76f290d9ff5968dcb94e5b5
Instruction ID: d973808595398878256b945a0abd36907f0f22ab108b8cdee28b989a97d47ddf
Opcode Fuzzy Hash: c4c3cb4df1023c1c432bbbad1e642f926ccfd8aee76f290d9ff5968dcb94e5b5
Instruction Fuzzy Hash: 0F31B672E4022ABBE710DE65DC45BAAFB68EF05761F108125FC05F6190E774EE40A7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00F3F69D Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 00F3F7CD
RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 00F3F7DA

Strings

%ls.RebootRequired, xrefs: 00F3F6BA
Failed to open registration key., xrefs: 00F3F736
Failed to read Resume value., xrefs: 00F3F763
Resume, xrefs: 00F3F741
Failed to format pending restart registry key to read., xrefs: 00F3F6D1

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: 2565ef6f765d1dc664f398647d1bc8d81d2cadf95c63d777e680d78544357728
Instruction ID: b50d538af1268be82544d633e84dc5ab74b51ed6b07b30e1f3505750da3f76aa
Opcode Fuzzy Hash: 2565ef6f765d1dc664f398647d1bc8d81d2cadf95c63d777e680d78544357728
Instruction Fuzzy Hash: A8415C36D00219EFCB11AF98C981AEDBBB5FF01330F658176E814AB250D3759E45BB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F39B3F Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 86COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,00000100), ref: 00F39B72
GetLastError.KERNEL32 ref: 00F39B81

Strings

Failed to set variable., xrefs: 00F39C07
search.cpp, xrefs: 00F39BB3
Failed get to file attributes. '%ls', xrefs: 00F39BC0
Failed to format variable string., xrefs: 00F39B65
File search: %ls, did not find path: %ls, xrefs: 00F39BD5

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: Failed get to file attributes. '%ls'$Failed to format variable string.$Failed to set variable.$File search: %ls, did not find path: %ls$search.cpp
API String ID: 1799206407-2053429945
Opcode ID: 706b4ac10a9644a2eddccad588d0970b1dfce2094577f1ddb875a7586b9565be
Instruction ID: 0f3db040fbb5ff33bcf723ec7dcdc18f9a2789f13c1dede3dcb80c6f9bd70f49
Opcode Fuzzy Hash: 706b4ac10a9644a2eddccad588d0970b1dfce2094577f1ddb875a7586b9565be
Instruction Fuzzy Hash: 58210B32E44215BBDB116AA49D02B6EB769EF55330F208357F804E1190EBF19E50F6E3

Uniqueness

Uniqueness Score: -1.00%

Function 00F467B0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 52synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,?,00F46CFB,00F34740,?,00000000,?,00000000,00000001), ref: 00F467BD
GetLastError.KERNEL32(?,00F46CFB,00F34740,?,00000000,?,00000000,00000001), ref: 00F467C7
GetExitCodeThread.KERNELBASE(00000001,00000000,?,00F46CFB,00F34740,?,00000000,?,00000000,00000001), ref: 00F46806
GetLastError.KERNEL32(?,00F46CFB,00F34740,?,00000000,?,00000000,00000001), ref: 00F46810

Strings

core.cpp, xrefs: 00F467EB, 00F46834
Failed to get cache thread exit code., xrefs: 00F46841
Failed to wait for cache thread to terminate., xrefs: 00F467F8

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$core.cpp
API String ID: 3686190907-2546940223
Opcode ID: 6331168704994602c9493ce70786259ba9c3986355b81cd957409b57eb797cca
Instruction ID: b0d6b4de542f6cdda20a85c9a2527c0c8c704c98648140b1be8bb668d7134262
Opcode Fuzzy Hash: 6331168704994602c9493ce70786259ba9c3986355b81cd957409b57eb797cca
Instruction Fuzzy Hash: 12015E71740309BBEB08AB65DD16BBE76E5EB00710F10412DB80AD51A0EB79DA40B62A

Uniqueness

Uniqueness Score: -1.00%

Function 00F4D206 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,?,00000001,00F7B4F0,?,00000001,000000FF,?,?,757A95A0,00000000,00000001,00000000,?,00F472F3), ref: 00F4D32F

Strings

Failed to elevate., xrefs: 00F4D311
Failed to create pipe name and client token., xrefs: 00F4D270
UX aborted elevation requirement., xrefs: 00F4D244
elevation.cpp, xrefs: 00F4D23A
Failed to create pipe and cache pipe., xrefs: 00F4D28C
Failed to connect to elevated child process., xrefs: 00F4D318

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CloseHandle
String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$elevation.cpp
API String ID: 2962429428-3003415917
Opcode ID: 83c2e05a5b1dca80a480d9014f020e88536755ae31243371f5faaf913417b0e0
Instruction ID: 0fa53ae2b66cafbe6eb260e67bcc35318977db8d623afc06568843aa9d1ccf3a
Opcode Fuzzy Hash: 83c2e05a5b1dca80a480d9014f020e88536755ae31243371f5faaf913417b0e0
Instruction Fuzzy Hash: EB31E972A45722BBE715AA609C46FBF7A5CEF01730F100215FD05B71D1DAA9FE0072A6

Uniqueness

Uniqueness Score: -1.00%

Function 00F7041B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00F9B60C,00000000,?,?,?,00F35407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 00F7042B
CreateFileW.KERNEL32(40000000,00000001,00000000,00000002,00000080,00000000,?,00000000,?,?,?,00F9B604,?,00F35407,00000000,Setup), ref: 00F704CC
GetLastError.KERNEL32(?,00F35407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 00F704DC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00F35407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 00F70515

Part of subcall function 00F32DE0: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00F32F1F

LeaveCriticalSection.KERNEL32(00F9B60C,?,?,00F9B604,?,00F35407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 00F7056E

Strings

logutil.cpp, xrefs: 00F704FA

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
String ID: logutil.cpp
API String ID: 4111229724-3545173039
Opcode ID: 796bce7233b33bfb87ed5cb6c77279b9a461bfb7b59ee0b19ba86eeb43b8f0a3
Instruction ID: 770fa8386fe0b89b3e2c9eb7da33b5961728b29c2f19b90a8d6bbaa32273b0c5
Opcode Fuzzy Hash: 796bce7233b33bfb87ed5cb6c77279b9a461bfb7b59ee0b19ba86eeb43b8f0a3
Instruction Fuzzy Hash: 57316972E01219FFEF219F61ED46E6A3669EF00B60F04816BF908A6150DB74DD50BF92

Uniqueness

Uniqueness Score: -1.00%

Function 00F37203 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 92COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,?,?,00F3583F,000002C0,000002C0,00000000,00000100,00000001,00000000,000002C0,00000002), ref: 00F37215
LeaveCriticalSection.KERNEL32(00000000,00000000,00000002,00000000,?,?,?,00F3583F,000002C0,000002C0,00000000,00000100,00000001,00000000,000002C0,00000002), ref: 00F372F4

Strings

Failed to format value '%ls' of variable: %ls, xrefs: 00F372BE
Failed to get value as string for variable: %ls, xrefs: 00F372E3
Failed to get unformatted string., xrefs: 00F37285
Failed to get variable: %ls, xrefs: 00F37256
*****, xrefs: 00F372B0, 00F372BD

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: *****$Failed to format value '%ls' of variable: %ls$Failed to get unformatted string.$Failed to get value as string for variable: %ls$Failed to get variable: %ls
API String ID: 3168844106-2873099529
Opcode ID: 9503328fbba24a80ba549ae17b3b244bd5ab1d8f50dc35bb0d152e5b4f168928
Instruction ID: 81003310e7cb82a02ca743b71295fe23cc9d5c7bdb05d96f48dd686b426e2f20
Opcode Fuzzy Hash: 9503328fbba24a80ba549ae17b3b244bd5ab1d8f50dc35bb0d152e5b4f168928
Instruction Fuzzy Hash: 2E319F72D0471AFBCF216A50CC05B9F7B65AF14730F50812AF90866550D775EA90BBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00F7076C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,?,?,?,?,?,?,?,00F48110,00000000), ref: 00F7078A
GetLastError.KERNEL32(?,?,?,?,00F48110,00000000), ref: 00F70794
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,00F48110,00000000), ref: 00F707C6
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,00F48110,00000000), ref: 00F7081D

Strings

procutil.cpp, xrefs: 00F7080B

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: Token$ChangeCloseErrorFindInformationLastNotificationOpenProcess
String ID: procutil.cpp
API String ID: 2387526074-1178289305
Opcode ID: a91d2216f3018a4d7d78cb67664dca713147c7690ab2143eb1776720a1cfdea8
Instruction ID: 57b16de1a04b015d19a9f5c6f32564f90843b869e73de4ff9aca34cc14813df1
Opcode Fuzzy Hash: a91d2216f3018a4d7d78cb67664dca713147c7690ab2143eb1776720a1cfdea8
Instruction Fuzzy Hash: 46219672D40228EBDB109B999C48B9EBBE8EF54720F118167ED19E7190D7708E40FBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00F509B8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00F50A25
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00F50A37
SetFileTime.KERNELBASE(?,?,?,?), ref: 00F50A4A
FindCloseChangeNotification.KERNELBASE(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00F50616,?,?), ref: 00F50A59

Strings

cabextract.cpp, xrefs: 00F509F4
Invalid operation for this state., xrefs: 00F509FE

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: Time$File$ChangeCloseDateFindLocalNotification
String ID: Invalid operation for this state.$cabextract.cpp
API String ID: 1330928052-1751360545
Opcode ID: 3db793d0ef23775f542b3ed58bd74b4e82911790756c39b1710bbb7b87af53a9
Instruction ID: f5151032f7e2918d693d2bfb070f1a91c58006c45b0e465822df6fae05716bbd
Opcode Fuzzy Hash: 3db793d0ef23775f542b3ed58bd74b4e82911790756c39b1710bbb7b87af53a9
Instruction Fuzzy Hash: 1121D572C0021EAB8710DF68DC489EA7BBCFF05721B104216F915D65D0CB78DA55EBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00F7343B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00F7344A
InterlockedIncrement.KERNEL32(00F9B6D8), ref: 00F73467
CLSIDFromProgID.OLE32(Msxml2.DOMDocument,00F9B6C8,?,?,?,?,?,?), ref: 00F73482
CLSIDFromProgID.OLE32(MSXML.DOMDocument,00F9B6C8,?,?,?,?,?,?), ref: 00F7348E

Strings

MSXML.DOMDocument, xrefs: 00F73489
Msxml2.DOMDocument, xrefs: 00F7347D

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: dd6c346ff6b4f6b5dac6598ee3865cacb4097ebe8fd962a546e5c65928fadc21
Instruction ID: da59b1f4ca13cb8d8fe5ed81792ba89d9fbdc5e3ae9cfb351f73d26a49dbe434
Opcode Fuzzy Hash: dd6c346ff6b4f6b5dac6598ee3865cacb4097ebe8fd962a546e5c65928fadc21
Instruction Fuzzy Hash: ACF0A020B40239B6EB26CFA5BD0DB173E65AB81F64F01406AE808D1198D360D981B6A3

Uniqueness

Uniqueness Score: -1.00%

Function 00F74932 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00F7495A
GlobalAlloc.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00F74989
GetLastError.KERNEL32(?,00000000,00000000,00000000), ref: 00F749B3
GetLastError.KERNEL32(00000000,00F7B790,?,?,?,00000000,00000000,00000000), ref: 00F749F4
GlobalFree.KERNEL32(00000000), ref: 00F74A28

Strings

fileutil.cpp, xrefs: 00F74978, 00F749D1

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: fileutil.cpp
API String ID: 1145190524-2967768451
Opcode ID: e57c4929b358a6fcdecb0f06fabb7fe9d2a9285d0fbf2f8551c7463f6172cb43
Instruction ID: 7ae52c6682dac2fdeb12a86b62ff724f03a4d289d0bdd77e7a681ade6930799b
Opcode Fuzzy Hash: e57c4929b358a6fcdecb0f06fabb7fe9d2a9285d0fbf2f8551c7463f6172cb43
Instruction Fuzzy Hash: 6121C536A40329AB97119BA58C45AABBBB8EF84360F018127FD0DE7250D734DD40F6A2

Uniqueness

Uniqueness Score: -1.00%

Function 00F4E705 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 00F4E734
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00F4E743
SetWindowLongW.USER32(?,000000EB,?), ref: 00F4E757
DefWindowProcW.USER32(?,?,?,?), ref: 00F4E767
GetWindowLongW.USER32(?,000000EB), ref: 00F4E781
PostQuitMessage.USER32(00000000), ref: 00F4E7DE

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: 0eb040633eaa2a742e57afeb8dcc3e5d04a11f2d2adb296fbbd9363fa072df9b
Instruction ID: 51422c9e44d8362f4bfa81875e26d9420e4eca56204e36813170466a4a7102d0
Opcode Fuzzy Hash: 0eb040633eaa2a742e57afeb8dcc3e5d04a11f2d2adb296fbbd9363fa072df9b
Instruction Fuzzy Hash: C2218E32504118BFDB115FA8DC88F6A3FA9FF45364F144514FE1AAA1A0C731DD60EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F710C5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 149registrystringCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 00F710ED
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,00F46EF3,00000100,000000B0,00000088,00000410,000002C0), ref: 00F71126
lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 00F7121A

Strings

regutil.cpp, xrefs: 00F71161
BundleUpgradeCode, xrefs: 00F710CC

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: QueryValue$lstrlen
String ID: BundleUpgradeCode$regutil.cpp
API String ID: 3790715954-1648651458
Opcode ID: 83be028790104dc76a1bceb94b878c96c2fe52d2b11875755455ead46f01be6a
Instruction ID: 6de6e49ff872e5677021166b8bcc817660d3649b72e81374a8074eade7698773
Opcode Fuzzy Hash: 83be028790104dc76a1bceb94b878c96c2fe52d2b11875755455ead46f01be6a
Instruction Fuzzy Hash: 1941B531E00219EFDB25CF98C880AAE77B9FF44720F5181AAED09EB211D670DD05EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F5AAE8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to skip the extraction of payload: %ls from container: %ls, xrefs: 00F5ABEF
Failed to extract payload: %ls from container: %ls, xrefs: 00F5ABE3
Failed to extract all payloads from container: %ls, xrefs: 00F5AB9C
Failed to open container: %ls., xrefs: 00F5AB2A

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: Failed to extract all payloads from container: %ls$Failed to extract payload: %ls from container: %ls$Failed to open container: %ls.$Failed to skip the extraction of payload: %ls from container: %ls
API String ID: 1214770103-3891707333
Opcode ID: e9bf1d8b680d74ffa063aaaa0d67dcaaac6746df8c35c106a42014d37a60ce5a
Instruction ID: 68360c2c377ea15f702f855dd339e65ea8d73936a9051e57720cb04ec40c0d14
Opcode Fuzzy Hash: e9bf1d8b680d74ffa063aaaa0d67dcaaac6746df8c35c106a42014d37a60ce5a
Instruction Fuzzy Hash: 1E31C232D0012ABBCF11AAE4CC42E8E7779AF44721F104225FE11A6191E775D969FBE2

Uniqueness

Uniqueness Score: -1.00%

Function 00F507E4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 00F5088A
GetLastError.KERNEL32(?,?,?), ref: 00F50894

Strings

Invalid seek type., xrefs: 00F50820
cabextract.cpp, xrefs: 00F508B8
Failed to move file pointer 0x%x bytes., xrefs: 00F508C5

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$cabextract.cpp
API String ID: 2976181284-417918914
Opcode ID: 0960eb9cf16de482a3aa6d60580b520c2105ce8d9ec3ddad74740251ca6a3ec1
Instruction ID: b1ed1ea487baaada169177e0b0a8103ede21c3db5cc9d599af0165bc77fe0eda
Opcode Fuzzy Hash: 0960eb9cf16de482a3aa6d60580b520c2105ce8d9ec3ddad74740251ca6a3ec1
Instruction Fuzzy Hash: 9C31A532A0061AFFDB04DF68CC84E99B7A9FF04321B04821AFE1997650D734ED14ABD1

Uniqueness

Uniqueness Score: -1.00%

Function 00F74212 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 95registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F74315: FindFirstFileW.KERNELBASE(?,?,00000000,00000000,?), ref: 00F74350
Part of subcall function 00F74315: FindClose.KERNEL32(00000000), ref: 00F7435C

RegCloseKey.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,wininet.dll), ref: 00F74305

Part of subcall function 00F70E3F: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,00000000,00000001,00000000,?,00F75699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,?,00000000,00000000), ref: 00F70E52

Part of subcall function 00F710C5: RegQueryValueExW.KERNELBASE(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 00F710ED
Part of subcall function 00F710C5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,00F46EF3,00000100,000000B0,00000088,00000410,000002C0), ref: 00F71126

Strings

SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00F74244
crypt32.dll, xrefs: 00F7423D
PendingFileRenameOperations, xrefs: 00F74270
\, xrefs: 00F7428E

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CloseFindQueryValue$FileFirstOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager$\$crypt32.dll
API String ID: 3397690329-3978359083
Opcode ID: f271d4f38b0294a263b63cc436d6c481ac8be92e1d284bce3ba4896d0dccb1bf
Instruction ID: 801294c241530c8e0ab37943ebac4fd5ea626021871d77b29ceb89e87a97b6d3
Opcode Fuzzy Hash: f271d4f38b0294a263b63cc436d6c481ac8be92e1d284bce3ba4896d0dccb1bf
Instruction Fuzzy Hash: AB31B335D00229EADF21EFD5CC45AAEB779FF00360F14C16BF908A6152D731AA50EB56

Uniqueness

Uniqueness Score: -1.00%

Function 00F58B73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F70E3F: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,00000000,00000001,00000000,?,00F75699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,?,00000000,00000000), ref: 00F70E52

CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,?,000000FF,00000000,00000000,00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4), ref: 00F58BF7
RegCloseKey.ADVAPI32(00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4,?,?,?,00F3F66B,00000001,00000100,000001B4,00000000), ref: 00F58C45

Strings

Failed to enumerate uninstall key for related bundles., xrefs: 00F58C56
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00F58B94
Failed to open uninstall registry key., xrefs: 00F58BBA

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CloseCompareOpenString
String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 2817536665-2531018330
Opcode ID: 4e41e707f004835c30b23a3332cead8bc294554d6b787b28dba1db7ee6d14830
Instruction ID: 78118881ad4fcf4af2e47c582c998b70e8322ae948d76d8bf11f9740862aaf03
Opcode Fuzzy Hash: 4e41e707f004835c30b23a3332cead8bc294554d6b787b28dba1db7ee6d14830
Instruction Fuzzy Hash: F721B432D00118FBDB21AB90CC49FEEBA79EB003A2F244165F900761A0CB754E95B691

Uniqueness

Uniqueness Score: -1.00%

Function 00F731C7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F731DD
SysAllocString.OLEAUT32(?), ref: 00F731F9
VariantClear.OLEAUT32(?), ref: 00F73280
SysFreeString.OLEAUT32(00000000), ref: 00F7328B

Strings

xmlutil.cpp, xrefs: 00F73210

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: xmlutil.cpp
API String ID: 760788290-1270936966
Opcode ID: 874086364f6af50f47a2f2dab10d9919c656ba0dad713c5e941b635145a655ea
Instruction ID: 3b0ab1ce069cef10522e7966a79b52573034a2fee5f3c545ef083b08d87d785b
Opcode Fuzzy Hash: 874086364f6af50f47a2f2dab10d9919c656ba0dad713c5e941b635145a655ea
Instruction Fuzzy Hash: 74219631901229FFCB10DB98C848EAE7BB9AF45720F158159F909A7211C7319E40FB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F34013 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000003,00000001,00000000,00000000,?,00F7416C,00000001,00000000,?,00F74203,00000003,00000001,00000001,00000000,00000000,00000000), ref: 00F34021
GetLastError.KERNEL32(?,00F7416C,00000001,00000000,?,00F74203,00000003,00000001,00000001,00000000,00000000,00000000,?,00F4A55D,?,00000000), ref: 00F3402F
CreateDirectoryW.KERNEL32(00000003,00000001,00000001,?,00F7416C,00000001,00000000,?,00F74203,00000003,00000001,00000001,00000000,00000000,00000000), ref: 00F34097
GetLastError.KERNEL32(?,00F7416C,00000001,00000000,?,00F74203,00000003,00000001,00000001,00000000,00000000,00000000,?,00F4A55D,?,00000000), ref: 00F340A1

Strings

dirutil.cpp, xrefs: 00F340CF

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: dirutil.cpp
API String ID: 1375471231-2193988115
Opcode ID: 7b887803e7870081738bdd27f692e5211836c2c8202d1692381c3e9fea241ffa
Instruction ID: 47997a844533ea786975742163c45c415226098e7a60a9d9293f0a7ac8b62f0b
Opcode Fuzzy Hash: 7b887803e7870081738bdd27f692e5211836c2c8202d1692381c3e9fea241ffa
Instruction Fuzzy Hash: E41136B6B00325E6EB341AA14C44B7BB694EF42B70F104125FF4AEB150D764BC41B6E2

Uniqueness

Uniqueness Score: -1.00%

Function 00F508F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00F5095F
GetLastError.KERNEL32 ref: 00F50969

Strings

Unexpected call to CabWrite()., xrefs: 00F50923
Failed to write during cabinet extraction., xrefs: 00F50997
cabextract.cpp, xrefs: 00F5098D

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$cabextract.cpp
API String ID: 442123175-3111339858
Opcode ID: 0387025e87dde8e580a1a0c4e5f687022fd11b2d61d2a6d92b89871225b2e1a5
Instruction ID: 6555155b356bde2659dc04840f7ed2c1f2a526716e6d2f941208d9be6985585f
Opcode Fuzzy Hash: 0387025e87dde8e580a1a0c4e5f687022fd11b2d61d2a6d92b89871225b2e1a5
Instruction Fuzzy Hash: 4E21AE76600204EFEB00DF6DDD84EAA77E9FF89720F11415AFE08C7256DA71DA00AB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F44880 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,00000000,00000000,00000000,?,00000000,00000000,?,00F451A4), ref: 00F448CC

Strings

Failed to write message type to pipe., xrefs: 00F4490E
Failed to allocate message to write., xrefs: 00F448AB
pipe.cpp, xrefs: 00F44904

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: FileWrite
String ID: Failed to allocate message to write.$Failed to write message type to pipe.$pipe.cpp
API String ID: 3934441357-1996674626
Opcode ID: 141a5fdc310045b6c6d4b521b6de819b25b631f0181a2cacdc5a0595dca0c1ed
Instruction ID: f8f9891b2ddcd5fa021624e8c0aab5e5dfb7025af19e10f0fc7b325f722258b8
Opcode Fuzzy Hash: 141a5fdc310045b6c6d4b521b6de819b25b631f0181a2cacdc5a0595dca0c1ed
Instruction Fuzzy Hash: F4115972A00259BAEB11DF95DD09B9FBFA9EB40750F114126BC04B2150E770AE50FAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F73B4A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00F73B98
GetLastError.KERNEL32(?,?,00000000), ref: 00F73BA2
CloseHandle.KERNEL32(?,?,?,00000000), ref: 00F73BD5

Strings

shelutil.cpp, xrefs: 00F73BC3
<, xrefs: 00F73B8A

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CloseErrorExecuteHandleLastShell
String ID: <$shelutil.cpp
API String ID: 3023784893-3991740012
Opcode ID: 842a3922664170947cb7923fc78a8ba810b08332c810627e583632d4fdbaf11b
Instruction ID: 018ee382fb76650920fea4a257d72284cb13360c263301e6c00c70e06f3b5eae
Opcode Fuzzy Hash: 842a3922664170947cb7923fc78a8ba810b08332c810627e583632d4fdbaf11b
Instruction Fuzzy Hash: 3511EAB5E01218AFDB10DFA9D944A8E7BF8AF08350F004126FD09E7350E7349A109BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F70D1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNELBASE(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00F58BD8), ref: 00F70D77
RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00F58BD8,00000000), ref: 00F70D99
RegEnumKeyExW.KERNELBASE(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000003,?,?,00F58BD8,00000000,00000000,00000000), ref: 00F70DF1

Strings

regutil.cpp, xrefs: 00F70DC1

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: Enum$InfoQuery
String ID: regutil.cpp
API String ID: 73471667-955085611
Opcode ID: 5037636869d66be05c72b80769efad0620ab97a085529d97264edd8e4bcab48f
Instruction ID: bed8cbda04ffa73e7727d7329cba29bc096cae6cc656a6aa75dbb1acf909d6ab
Opcode Fuzzy Hash: 5037636869d66be05c72b80769efad0620ab97a085529d97264edd8e4bcab48f
Instruction Fuzzy Hash: 473194B6901229FFEB218B99CD40EABB7ADEF04350F118166BD08E7150DB719E11E7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F588CF Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F70E3F: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,00000000,00000001,00000000,?,00F75699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,?,00000000,00000000), ref: 00F70E52

RegCloseKey.KERNELBASE(00000000,00000000,00000088,00000000,000002C0,00000410,00020019,00000000,000002C0,00000000,?,?,?,00F58C14,00000000,00000000), ref: 00F5898C

Strings

Failed to ensure there is space for related bundles., xrefs: 00F5893F
Failed to open uninstall key for potential related bundle: %ls, xrefs: 00F588FB
Failed to initialize package from related bundle id: %ls, xrefs: 00F58972

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
API String ID: 47109696-1717420724
Opcode ID: ebe9cc53635828bba75b3c56374a9a6bed12d496ffb82aafc88ebde5de7ef8d0
Instruction ID: df0ebbb6a82870987b3728d69a556daf9cbf7fff2f1972bf2a3b1679212efe28
Opcode Fuzzy Hash: ebe9cc53635828bba75b3c56374a9a6bed12d496ffb82aafc88ebde5de7ef8d0
Instruction Fuzzy Hash: 4121623294021AFBDB129A84CC06BBEBB68EF01B92F144159FE04B6150DB759D25FB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F43955 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F70E3F: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,00000000,00000001,00000000,?,00F75699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,?,00000000,00000000), ref: 00F70E52

RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,00F43E61,feclient.dll,?,00000000,?,?,?,00F34A0C), ref: 00F439F1

Part of subcall function 00F70F6E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,?), ref: 00F70FE4
Part of subcall function 00F70F6E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00F7101F

Strings

Logging, xrefs: 00F43983
SOFTWARE\Policies\Microsoft\Windows\Installer, xrefs: 00F43966
feclient.dll, xrefs: 00F4395A

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer$feclient.dll
API String ID: 1586453840-3596319545
Opcode ID: e6d391439310b5c63d751086859aed1ecaeab9f328e74d0758180798506ddf40
Instruction ID: fac0165c1372b6a96cc3feffbb307b0b4142ebcce2f7d326bc390118e3be36c3
Opcode Fuzzy Hash: e6d391439310b5c63d751086859aed1ecaeab9f328e74d0758180798506ddf40
Instruction Fuzzy Hash: 1111B633F40208BBDB219A95CD47AAEBFBAEB40B61F404066E90597090D6B19F81F750

Uniqueness

Uniqueness Score: -1.00%

Function 00F70658 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62filestringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00000000,00000000,00000000,?,?,00F6FF0B,?,?,00000000,00000000,0000FDE9), ref: 00F7066A
WriteFile.KERNELBASE(FFFFFFFF,00000000,00000000,00000000,00000000,?,?,00F6FF0B,?,?,00000000,00000000,0000FDE9), ref: 00F706A6
GetLastError.KERNEL32(?,?,00F6FF0B,?,?,00000000,00000000,0000FDE9), ref: 00F706B0

Strings

logutil.cpp, xrefs: 00F706E0

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: logutil.cpp
API String ID: 606256338-3545173039
Opcode ID: c2a66b631dbdf40670733bf4632b215bb84e11b4e02a81bbdbffc20aee72e413
Instruction ID: 619d855425687d6e34f0052dcf5980045e8de67548969d994a1f21abc2a77741
Opcode Fuzzy Hash: c2a66b631dbdf40670733bf4632b215bb84e11b4e02a81bbdbffc20aee72e413
Instruction Fuzzy Hash: 9E11C672A01228AB97109B668C54EAFB76CEF85761B008216FD09D7140DA70ED10A6E2

Uniqueness

Uniqueness Score: -1.00%

Function 00F6FD20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000900,?,00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00F703EC,00000000,00000000,?,00000001,00000001), ref: 00F6FD3F
GetLastError.KERNEL32(?,00F703EC,00000000,00000000,?,00000001,00000001,?,00F35523,00000000,?,00000000,00000000,?,00F48AF7,00000002), ref: 00F6FD4B
LocalFree.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00F703EC,00000000,00000000,?,00000001,00000001,?,00F35523,00000000,?), ref: 00F6FDB3

Strings

logutil.cpp, xrefs: 00F6FD69

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: logutil.cpp
API String ID: 1365068426-3545173039
Opcode ID: 29615f8274db4945de41bd9dbe3de688b8f0213a3a358f8e6260145f1d65d130
Instruction ID: 6fc0960a0731f3cb2fc62abab97f099968819f5f89ede3a1c381ccaad2762272
Opcode Fuzzy Hash: 29615f8274db4945de41bd9dbe3de688b8f0213a3a358f8e6260145f1d65d130
Instruction Fuzzy Hash: 0B118C32A00219AADB21AF94ED05FEF7B69EF55720F01402AFD0596160D7319A60F7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F5074E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F5114F: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00F5077D,?,?,?), ref: 00F51177
Part of subcall function 00F5114F: GetLastError.KERNEL32(?,00F5077D,?,?,?), ref: 00F51181

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 00F5078B
GetLastError.KERNEL32 ref: 00F50795

Strings

Failed to read during cabinet extraction., xrefs: 00F507C3
cabextract.cpp, xrefs: 00F507B9

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$cabextract.cpp
API String ID: 2170121939-2426083571
Opcode ID: b405e2e416d2a6162c1b8dbe54205079464a5844f5e97a03eb55565c76c11acf
Instruction ID: 9e0683f37aba02d7211e34dbdee3827b65173a733a6a9fbd0ed78780fd544bdd
Opcode Fuzzy Hash: b405e2e416d2a6162c1b8dbe54205079464a5844f5e97a03eb55565c76c11acf
Instruction Fuzzy Hash: 8001C872A00628FBDB10AFA8DC04E9A7BA9FF09760F01011AFD08D7550D735DA11E7D5

Uniqueness

Uniqueness Score: -1.00%

Function 00F5114F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00F5077D,?,?,?), ref: 00F51177
GetLastError.KERNEL32(?,00F5077D,?,?,?), ref: 00F51181

Strings

cabextract.cpp, xrefs: 00F511A5
Failed to move to virtual file pointer., xrefs: 00F511AF

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$cabextract.cpp
API String ID: 2976181284-3005670968
Opcode ID: c6739f3d8deee3d71fb637edf9646cb996d5febcf9e9cf7dfe4c930d9b8ccf15
Instruction ID: 74242c273764945023d45b3995d5a46fe49ac4e9bc085dcc499cb13b2ca0e662
Opcode Fuzzy Hash: c6739f3d8deee3d71fb637edf9646cb996d5febcf9e9cf7dfe4c930d9b8ccf15
Instruction Fuzzy Hash: EA012632600635BBE7212A669C04F87BF99FF017B1B108226FE0C96110D735DC10E7D5

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D7CF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,BootstrapperApplicationDestroy), ref: 00F3D7F6
FreeLibrary.KERNELBASE(?,?,00F347D1,00000000,?,?,00F35386,?,?), ref: 00F3D805
GetLastError.KERNEL32(?,00F347D1,00000000,?,?,00F35386,?,?), ref: 00F3D80F

Strings

BootstrapperApplicationDestroy, xrefs: 00F3D7EE

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: AddressErrorFreeLastLibraryProc
String ID: BootstrapperApplicationDestroy
API String ID: 1144718084-3186005537
Opcode ID: 74ac9a73a5725b5dcc0146ab48669f99d9a6b18733a8d972d17b4b0b16cd9724
Instruction ID: e681d530afa066cf340e7a611500478568b7c2f04246b9a3f9faa2996f7bd4e5
Opcode Fuzzy Hash: 74ac9a73a5725b5dcc0146ab48669f99d9a6b18733a8d972d17b4b0b16cd9724
Instruction Fuzzy Hash: 9FF049326007049FD7205F66EC08B67B7E9BF81372B01C53EE46AC2560DB75E840EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F4F086 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 00F4F09B
GetLastError.KERNEL32 ref: 00F4F0A5

Strings

EngineForApplication.cpp, xrefs: 00F4F0C9
Failed to post plan message., xrefs: 00F4F0D3

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post plan message.
API String ID: 2609174426-2952114608
Opcode ID: d826a6fd9081ed2a31dad9dc818a34ff5c2ed4ae9f2dc3b12c82cc695709e71f
Instruction ID: 5cafe5b8548f85c8dade3bbbccc7def94fb21adc60b5703dc34557a97705a9b3
Opcode Fuzzy Hash: d826a6fd9081ed2a31dad9dc818a34ff5c2ed4ae9f2dc3b12c82cc695709e71f
Instruction Fuzzy Hash: C7F0A7327543346AE72076695C09F877BC4DF04BA0F014022FD0CE6091D655CC40A6E6

Uniqueness

Uniqueness Score: -1.00%

Function 00F4F194 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009005,?,00000000), ref: 00F4F1A9
GetLastError.KERNEL32 ref: 00F4F1B3

Strings

EngineForApplication.cpp, xrefs: 00F4F1D7
Failed to post shutdown message., xrefs: 00F4F1E1

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post shutdown message.
API String ID: 2609174426-188808143
Opcode ID: 5fe34ae0b7f1014f372b3d1e1582e3a5090f706749d03a361af425000c2462a9
Instruction ID: 1e6df938f85d69ca1cf4b77fb109619c44c7cee5731181ff55ecb6b67524d9af
Opcode Fuzzy Hash: 5fe34ae0b7f1014f372b3d1e1582e3a5090f706749d03a361af425000c2462a9
Instruction Fuzzy Hash: 03F0A733B443346AA7207AA99C09F877BC4EF04B60F014026BD0CE6091D655CD40A7E6

Uniqueness

Uniqueness Score: -1.00%

Function 00F5051A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,?,00F5145A,00000000,00000000,?,00F3C121,00000000,?,?,00F5AB88,?,00000000,?,?), ref: 00F50524
GetLastError.KERNEL32(?,00F5145A,00000000,00000000,?,00F3C121,00000000,?,?,00F5AB88,?,00000000,?,?,?,00000000), ref: 00F5052E

Strings

cabextract.cpp, xrefs: 00F50552
Failed to set begin operation event., xrefs: 00F5055C

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$cabextract.cpp
API String ID: 3848097054-4159625223
Opcode ID: f89419c3f85770ba282823cfe95753acee6af47e9e52d6338d846ddb220cbe00
Instruction ID: 68f503886e34aa9712937a47b8b0c09519655ca58b2878f4735bc88d54213583
Opcode Fuzzy Hash: f89419c3f85770ba282823cfe95753acee6af47e9e52d6338d846ddb220cbe00
Instruction Fuzzy Hash: 45F0EC33B0173067B71176796C05BDB76D8DF057B1F010126FE09E7150EA189D4076E6

Uniqueness

Uniqueness Score: -1.00%

Function 00F4E978 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009003,00000000,?), ref: 00F4E98D
GetLastError.KERNEL32 ref: 00F4E997

Strings

EngineForApplication.cpp, xrefs: 00F4E9BB
Failed to post apply message., xrefs: 00F4E9C5

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post apply message.
API String ID: 2609174426-1304321051
Opcode ID: 68e8beb6363cbdd36783369b54e25f5cb7119657d7cc5e6ddbb4875cb2fbd11c
Instruction ID: a85d72755450a2a5e182ca74017522a25297d7a7f2e1b0379767293505de1d2c
Opcode Fuzzy Hash: 68e8beb6363cbdd36783369b54e25f5cb7119657d7cc5e6ddbb4875cb2fbd11c
Instruction Fuzzy Hash: 07F0A0327443346AE7207AA9AC09F877BC8EF04BA0F024026BD0CEA091D665CC40A6E6

Uniqueness

Uniqueness Score: -1.00%

Function 00F4EA09 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009000,00000000,?), ref: 00F4EA1E
GetLastError.KERNEL32 ref: 00F4EA28

Strings

EngineForApplication.cpp, xrefs: 00F4EA4C
Failed to post detect message., xrefs: 00F4EA56

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post detect message.
API String ID: 2609174426-598219917
Opcode ID: 0a3ba9f512fc879a9cd02721bc361d0bfd299f6ff075dbd16f92f27e85e43189
Instruction ID: 14057acab5b532ad4a3c08c00c7cdeb06fedf7dc923fc003028322fadcffe7d3
Opcode Fuzzy Hash: 0a3ba9f512fc879a9cd02721bc361d0bfd299f6ff075dbd16f92f27e85e43189
Instruction Fuzzy Hash: DDF0A732B443346BE72076A99C09F977BC4EF05BA0F014112FD0CE6191D655CD40E6E6

Uniqueness

Uniqueness Score: -1.00%

Function 00F73DB5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00F73E5E
GetLastError.KERNEL32 ref: 00F73EC1

Strings

fileutil.cpp, xrefs: 00F73EE5

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: fileutil.cpp
API String ID: 1948546556-2967768451
Opcode ID: e979d88c0d84f253c1681ba2c10ebec37251337226611cedb6c6bb42ae9f094c
Instruction ID: 382ed9d1552e44aa4494de343dc5948343683f4f5dc700423b80cc21c51113e5
Opcode Fuzzy Hash: e979d88c0d84f253c1681ba2c10ebec37251337226611cedb6c6bb42ae9f094c
Instruction Fuzzy Hash: D8413071E00269ABDB21CE54CD407EAB7A4AB48751F1081A7A94DE7240D7B49EC8AB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F455BD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00F455D9
CoUninitialize.OLE32(?,00000000,?,?,?,?,?,?,?), ref: 00F45633

Strings

Failed to initialize COM on cache thread., xrefs: 00F455E5

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: InitializeUninitialize
String ID: Failed to initialize COM on cache thread.
API String ID: 3442037557-3629645316
Opcode ID: 9814ef1d907c4bc5cd601474121e6a37fc781b85650e2382cc1f17e55e8423fa
Instruction ID: 986f0b922fd1b398d03adf005ceb6ae900440caaad8bd2534595040439c16ace
Opcode Fuzzy Hash: 9814ef1d907c4bc5cd601474121e6a37fc781b85650e2382cc1f17e55e8423fa
Instruction Fuzzy Hash: 01016D72600619BFCB059FA5DC80EDAFBACFF08354B408126FA08C7221DB31AD54AB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F3501B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,00F31104,?,?,00000000), ref: 00F3503A
CompareStringW.KERNELBASE(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,00F31104,?,?,00000000), ref: 00F3506A

Strings

burn.clean.room, xrefs: 00F35027, 00F35034, 00F35061

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: dae25d6c4095a02e60a0348de4fdbc080021dfd489263ef50e805397da8b40d6
Instruction ID: 800e14f9f58bf44be088d6b629643d3c9c59367608c3511be73c6e1317e63168
Opcode Fuzzy Hash: dae25d6c4095a02e60a0348de4fdbc080021dfd489263ef50e805397da8b40d6
Instruction Fuzzy Hash: A80162B2A0062AAF83284B599988E77B7ACFB95B70B504116F549C6610D3769C80E6E2

Uniqueness

Uniqueness Score: -1.00%

Function 00F74CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00F73E85,?,?,?), ref: 00F74D12
GetLastError.KERNEL32(?,?,00F73E85,?,?,?), ref: 00F74D1C

Strings

fileutil.cpp, xrefs: 00F74D44

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: fileutil.cpp
API String ID: 442123175-2967768451
Opcode ID: 850587adc05bc8f9714355d6414da485152fc0d6f7fdba54ffc5d93c34984484
Instruction ID: 26448b5c2391a1ab1d55a4c8cd3c6ba2a74bbc12a5a26e3fd701db9cac05ca03
Opcode Fuzzy Hash: 850587adc05bc8f9714355d6414da485152fc0d6f7fdba54ffc5d93c34984484
Instruction Fuzzy Hash: AAF08173A01229BBD720DE9ACC48F9BBBADFB44761F004116FD48D7040D730AD00A6E2

Uniqueness

Uniqueness Score: -1.00%

Function 00F333D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,00000000,00000000,?,00F5AD27,00000001,00000000,?,WixBundleSourceProcessPath,00000001,?), ref: 00F333F8
GetLastError.KERNEL32(?,00F5AD27,00000001,00000000,?,WixBundleSourceProcessPath,00000001,?,?,?,?,?,?,?,?,?), ref: 00F3340F

Strings

pathutil.cpp, xrefs: 00F33433

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: pathutil.cpp
API String ID: 2776309574-741606033
Opcode ID: 00037098b191ae3318dc64b9eed41904788d9557abee240fe3b2b4fdac1b0302
Instruction ID: b1952fee3e846740e639d8a7d548cfedc979eb0d11371be4e15b67adc03ec287
Opcode Fuzzy Hash: 00037098b191ae3318dc64b9eed41904788d9557abee240fe3b2b4fdac1b0302
Instruction Fuzzy Hash: 5AF0C233B002246B9722E76A9C48B87BA99EB46770F124122BD09EB150C671CD01A2F1

Uniqueness

Uniqueness Score: -1.00%

Function 00F747D3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,?,?,00000000,?,00000000,00000000,00000000,?,00F76219,?,?,00000000,00000000,00000000,00000001), ref: 00F747EB
GetLastError.KERNEL32(?,00F76219,?,?,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,00F75AC5,?,?,?), ref: 00F747F5

Strings

fileutil.cpp, xrefs: 00F74819

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: fileutil.cpp
API String ID: 2976181284-2967768451
Opcode ID: af1af59bb59133109f421ed3d347a9ca28d1fa7a92c0d914c64cca29154a0232
Instruction ID: 182da074b4db37d729592de5aa70850cdd1bf204a94b36d1c6f9d85503885c52
Opcode Fuzzy Hash: af1af59bb59133109f421ed3d347a9ca28d1fa7a92c0d914c64cca29154a0232
Instruction Fuzzy Hash: 37F01D71A00259AFAB149F959C09EAB7BA8EB05761B018119BD09D7250D731DD10E6E2

Uniqueness

Uniqueness Score: -1.00%

Function 00F337EA Relevance: 4.6, APIs: 3, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00F33829
GetLastError.KERNEL32 ref: 00F33833
LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 00F3389B

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem
String ID:
API String ID: 1230559179-0
Opcode ID: d68fcc6dfee251f66aed6d20f20b7f06e940274e60c544318dabc4df26d8eda3
Instruction ID: 739301cd170ce235f4badad0f4beed66337aad4f34f78e2ed188455e4bf08f0d
Opcode Fuzzy Hash: d68fcc6dfee251f66aed6d20f20b7f06e940274e60c544318dabc4df26d8eda3
Instruction Fuzzy Hash: 4321C8B3D0132967EB20DBA48C49F9A776C9B01730F150265BE08E7241E674DE489BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00F33999 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00F33B34,00000000,?,00F31472,00000000,80004005,00000000,80004005,00000000,000001C7,?,00F313B7), ref: 00F339A3
RtlFreeHeap.NTDLL(00000000,?,00F33B34,00000000,?,00F31472,00000000,80004005,00000000,80004005,00000000,000001C7,?,00F313B7,000001C7,00000100), ref: 00F339AA
GetLastError.KERNEL32(?,00F33B34,00000000,?,00F31472,00000000,80004005,00000000,80004005,00000000,000001C7,?,00F313B7,000001C7,00000100,?), ref: 00F339B4

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: b47ea145080e437cb798906022f0a38fccd8527eee10609164c03a51a4357485
Instruction ID: f4da35939a12e71476e2c0499af6ccdb7e91dd05a57cde0d31d994c73c306f0a
Opcode Fuzzy Hash: b47ea145080e437cb798906022f0a38fccd8527eee10609164c03a51a4357485
Instruction Fuzzy Hash: BAD01232A002386787106BFA5C0C797BE9CEF065B2B414021FD09D2110D7658850E6E5

Uniqueness

Uniqueness Score: -1.00%

Function 00F4E7EB Relevance: 4.5, APIs: 3, Instructions: 19synchronizationwindowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00F4E7F8
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00F4E80E
WaitForSingleObject.KERNEL32(?,00003A98,?,00F34B37,?,?,?,?,?,00F7B490,?,?,?,?,?,?), ref: 00F4E81F

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: MessageObjectPostSingleWaitWindow
String ID:
API String ID: 1391784381-0
Opcode ID: b6b53ee970b5437e84801dfe008af3d2100a7a0c25e9eb0bd6cbd9aa96e184d0
Instruction ID: e9beaa684e07ddac784323621f76aa876a36d13a566d8921e3184f5ff96a88c1
Opcode Fuzzy Hash: b6b53ee970b5437e84801dfe008af3d2100a7a0c25e9eb0bd6cbd9aa96e184d0
Instruction Fuzzy Hash: 8EE0EC3168030CBBDB225B60EC09BDA7B6CFF0A751F180529B659A50E0D7A27990AB95

Uniqueness

Uniqueness Score: -1.00%

Function 00F3F5E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F70E3F: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,00000000,00000001,00000000,?,00F75699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,?,00000000,00000000), ref: 00F70E52

RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,?,00F47B4D,?,?,?), ref: 00F3F644

Part of subcall function 00F70EEC: RegQueryValueExW.ADVAPI32(00000004,?,00000000,00000000,?,00000078,00000000,?,?,?,00F756EF,00000000,?,00F763FF,00000078,00000000), ref: 00F70F10

Strings

Installed, xrefs: 00F3F60C

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Installed
API String ID: 3677997916-3662710971
Opcode ID: b1673bbda58fbb004e7c6092a70376925d1ad843e7600419ee7fc06c972fbdfd
Instruction ID: a569d2c4e118eff1553df2a0b6553899ae9ebb15170ac43aaa3a305304873c77
Opcode Fuzzy Hash: b1673bbda58fbb004e7c6092a70376925d1ad843e7600419ee7fc06c972fbdfd
Instruction Fuzzy Hash: 04014F36D10118FBCB11EB94CD46BDEBBA8EF04721F1181A9E900A7160D7759E54EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F79006 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,000000B0,00000088,00000410,000002C0), ref: 00F7905C

Part of subcall function 00F70E3F: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,00000000,00000001,00000000,?,00F75699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,?,00000000,00000000), ref: 00F70E52

Strings

%ls%ls\%ls\%ls, xrefs: 00F79029

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CloseOpen
String ID: %ls%ls\%ls\%ls
API String ID: 47109696-1267659288
Opcode ID: 26ee51f268d0739faeb8f6630fc6a9c837f388ed316527f4526f3e55373ce1dd
Instruction ID: 4e41c62c7b65db83a7acb61ce3242a81cb6a61dcfa00332fbe84e785fdb24294
Opcode Fuzzy Hash: 26ee51f268d0739faeb8f6630fc6a9c837f388ed316527f4526f3e55373ce1dd
Instruction Fuzzy Hash: 0B01FF3281121CFBDF129FD0DC06BDDBB79EB04365F108196F50866161D7B95A60FB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F33A72 Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,?,00F3227D,?,000001C7,00000001,80004005,8007139F,?,?,00F7015F,8007139F,?,00000000), ref: 00F33A86
RtlReAllocateHeap.NTDLL(00000000,?,00F3227D,?,000001C7,00000001,80004005,8007139F,?,?,00F7015F,8007139F,?,00000000,00000000,8007139F), ref: 00F33A8D

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 5520b4b7d1ec127aa02d6054f2bc4097eb857631f098d177262735ebf9d5bc74
Instruction ID: 75da4eadf7aaa2ced3dfc5925e769104ee5c5978226a1a7be39a7420588301e3
Opcode Fuzzy Hash: 5520b4b7d1ec127aa02d6054f2bc4097eb857631f098d177262735ebf9d5bc74
Instruction Fuzzy Hash: 9CD0123215420DEBCF005FE8DC0DEAE3BACEB596127408415F919C2120C77DE4A0AB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F338D4 Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,00F32284,000001C7,00000001,80004005,8007139F,?,?,00F7015F,8007139F,?,00000000,00000000,8007139F), ref: 00F338E5
RtlAllocateHeap.NTDLL(00000000,?,00F32284,000001C7,00000001,80004005,8007139F,?,?,00F7015F,8007139F,?,00000000,00000000,8007139F), ref: 00F338EC

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: d9a2863a41b6bee20d5e0b439b822d4af0d2f56cbc1460d9939b7e17492b4e74
Instruction ID: f9341fd0447479b785c36cc2d61ea64bb936c0b5d6b4bc2e1db3fe931a3b19b8
Opcode Fuzzy Hash: d9a2863a41b6bee20d5e0b439b822d4af0d2f56cbc1460d9939b7e17492b4e74
Instruction Fuzzy Hash: 37C0803319420CA7CF005FF4DC0DD59379CEB156027408410F509C3110C77CE0549761

Uniqueness

Uniqueness Score: -1.00%

Function 00F73499 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F734CE

Part of subcall function 00F72F23: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00F734DF,00000000,?,00000000), ref: 00F72F3D
Part of subcall function 00F72F23: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00F5BDED,?,00F352FD,?,00000000,?), ref: 00F72F49

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID:
API String ID: 52713655-0
Opcode ID: 953a0f3384a7ce1f943ef8cfa7e4a0e1e3d79598c333bc14dbdd049b5483730f
Instruction ID: 1568a37f0cf1d6161a1067098001f1dbd743143162d4c434f8920e12883b5580
Opcode Fuzzy Hash: 953a0f3384a7ce1f943ef8cfa7e4a0e1e3d79598c333bc14dbdd049b5483730f
Instruction Fuzzy Hash: 9C313E76E002199BCB11DFA8C884ADEB7F4EF08710F01456AED15EB350D630AD049BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F7907D Relevance: 1.6, APIs: 1, Instructions: 81registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F78CFB: lstrlenW.KERNEL32(00000100,?,?,00F79098,000002C0,00000100,00000100,00000100,?,?,?,00F57B40,?,?,000001BC,00000000), ref: 00F78D1B

RegCloseKey.ADVAPI32(000002C0,000002C0,00000100,00000100,00000100,?,?,?,00F57B40,?,?,000001BC,00000000,00000000,00000000,00000100), ref: 00F79136

Part of subcall function 00F70E3F: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,00000000,00000001,00000000,?,00F75699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,?,00000000,00000000), ref: 00F70E52

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: CloseOpenlstrlen
String ID:
API String ID: 514153755-0
Opcode ID: 2309c9a1df600a36516b1ad61bdb2a3815ce93d29aecd850ddd1ea153e2591cf
Instruction ID: 77d39f488b18cf5a161cc415ca03e936c884a0f9b4c0fa070d07f3dc275a3805
Opcode Fuzzy Hash: 2309c9a1df600a36516b1ad61bdb2a3815ce93d29aecd850ddd1ea153e2591cf
Instruction Fuzzy Hash: 46219473C0012EEBCF22AFA4CC4589EBAB5EB44750B118267FD0563121D6B24E60F7D2

Uniqueness

Uniqueness Score: -1.00%

Function 00F75728 Relevance: 1.6, APIs: 1, Instructions: 60registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00F9AAA0,00000000,?,00000000,?,00F4890E,WiX\Burn,PackageCache,00000000,00F9AAA0,00000000,?,?), ref: 00F75782

Part of subcall function 00F70F6E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,?), ref: 00F70FE4
Part of subcall function 00F70F6E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00F7101F

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: 9e6e61664f6dc9b75cd34bd8a9736854bfe959a2cefe0395c4dd73a55b8f79ea
Instruction ID: f2239e3f55e6a0c42eb9af03aea7db0fd719a79d15039c4a4bc4cc576d67f112
Opcode Fuzzy Hash: 9e6e61664f6dc9b75cd34bd8a9736854bfe959a2cefe0395c4dd73a55b8f79ea
Instruction Fuzzy Hash: E111C636C0052DEBCF25AEA4DD81AAEB669EF04B30B15823BFD096B110C3754D51FAD2

Uniqueness

Uniqueness Score: -1.00%

Function 00F47BD5 Relevance: 1.5, APIs: 1, Instructions: 34windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00F7B508), ref: 00F47C1B

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: MessagePostQuit
String ID:
API String ID: 1657236379-0
Opcode ID: 069386321ca9f758818467851054a30bdbec3d2de89a0887f4fcb4a59c7c800b
Instruction ID: f50474da70a3bc52d919eb41c2b1b27c98357fadad27617d67fb2b147ed63aef
Opcode Fuzzy Hash: 069386321ca9f758818467851054a30bdbec3d2de89a0887f4fcb4a59c7c800b
Instruction Fuzzy Hash: 24F0E57290026577C7223E9A9C09DABBFADEFD1B70F054125BE0CB7111CB309800A3E1

Uniqueness

Uniqueness Score: -1.00%

Function 00F334C5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,00000000,00000000,00000104,00000000,?,00F489CA,0000001C,?,00000000,?,?), ref: 00F334E5

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 0744b1fdee9457b7861e855cd86b7f7c4de7a42d420d8f11ffbd060f1bda4fcd
Instruction ID: 5b9bc361dd2592efa567d041b9335a4b510884cbb3229fabd0af8aa46335fdaa
Opcode Fuzzy Hash: 0744b1fdee9457b7861e855cd86b7f7c4de7a42d420d8f11ffbd060f1bda4fcd
Instruction Fuzzy Hash: 0DE012722012297BA642AF629C05DEB7B9CEF05770F008055BE44D7040E765E950A7B1

Uniqueness

Uniqueness Score: -1.00%

Function 00F340E2 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00000000,?,00F4A229,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,?), ref: 00F340EB

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: cd9ec4574de1230736bc1d48c507b46366917346c824424a1db12039370c2911
Instruction ID: 814646c579ece0104ef967b743d8f9c9a63830a6a1064c6714768a0d3737cbcb
Opcode Fuzzy Hash: cd9ec4574de1230736bc1d48c507b46366917346c824424a1db12039370c2911
Instruction Fuzzy Hash: A6D02B31601528174719AE698C045667B15EF127B0B414214EC14CA1B0C330BC51D3C0

Uniqueness

Uniqueness Score: -1.00%

Function 00F314B2 Relevance: 1.3, APIs: 1, Instructions: 54stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,00F321B8,?,00000000,00000000,00000000,?,00F48A22,00000000,00000000,00000000,00000000), ref: 00F314E4

Part of subcall function 00F33B51: GetProcessHeap.KERNEL32(00000000,000001C7,?,00F321DC,000001C7,80004005,8007139F,?,?,00F7015F,8007139F,?,00000000,00000000,8007139F), ref: 00F33B59
Part of subcall function 00F33B51: HeapSize.KERNEL32(00000000,?,00F321DC,000001C7,80004005,8007139F,?,?,00F7015F,8007139F,?,00000000,00000000,8007139F), ref: 00F33B60

Memory Dump Source

Source File: 0000000E.00000002.50386068498.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000E.00000002.50386033881.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386146743.0000000000F7B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386200009.0000000000F9A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.50386237740.0000000000F9E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f30000_vc_redist.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: 45103693c337b52b2fcd796ee60dfce2a788d7d2dbe02601e8356d850a08e249
Instruction ID: eeec830e3eca82a3ab60ecf47421c30a8b9e3c45a63fae37df823d5e62291eb8
Opcode Fuzzy Hash: 45103693c337b52b2fcd796ee60dfce2a788d7d2dbe02601e8356d850a08e249
Instruction Fuzzy Hash: 2B012837200218AFCF219F54CC44F9A7795BF82770F258225FA259B161D731DC50A7A0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port and/or vulnerability scans using tools that are brought onto a system.
Tactics:	Discovery
Data Sources:	Cloud Service: Cloud Service Enumeration, Command: Command Execution, Network Traffic: Network Traffic Flow
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://download01.logi.com/web/ftp/pub/techsupport/optionsplus/logioptionsplus_installer.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\90cbe1.rbs

C:\Config.Msi\90cbe5.rbs

C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\PageInstalled.gif

C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\PageLegacyOptions.gif

C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\PageUnsupportedOs.gif

C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\logi_installer_shared_optionsplus.dll

C:\ProgramData\Logishrd\{6b7455ae-a32a-4c6f-8651-da4969097604}_logioptionsplus_setup\vc_redist.x64.exe

C:\ProgramData\Package Cache\.unverified\cab2C04DDC374BD96EB5C8EB8208F2C7C92 (copy)

C:\ProgramData\Package Cache\.unverified\cab5046A8AB272BF37297BB7928664C9503 (copy)

C:\ProgramData\Package Cache\.unverified\vcRuntimeAdditional_x64 (copy)

C:\ProgramData\Package Cache\.unverified\vcRuntimeMinimum_x64 (copy)

C:\ProgramData\Package Cache\{282975d8-55fe-4991-bbbb-06a72581ce58}\VC_redist.x64.exe

C:\ProgramData\Package Cache\{282975d8-55fe-4991-bbbb-06a72581ce58}\state.rsm

C:\ProgramData\Package Cache\{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}v14.24.28127\packages\vcRuntimeMinimum_amd64\cab1.cab (copy)

C:\ProgramData\Package Cache\{7DC387B8-E6A2-480C-8EF9-A6E51AE81C19}v14.24.28127\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi (copy)

C:\ProgramData\Package Cache\{8678BA04-D161-45BE-ACA4-CC5D13073F35}v14.24.28127\packages\vcRuntimeAdditional_amd64\cab1.cab (copy)

C:\ProgramData\Package Cache\{8678BA04-D161-45BE-ACA4-CC5D13073F35}v14.24.28127\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi (copy)

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20240326163939.log

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20240326163939_000_vcRuntimeMinimum_x64.log

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20240326163939_001_vcRuntimeAdditional_x64.log

Windows Analysis Report
https://download01.logi.com/web/ftp/pub/techsupport/optionsplus/logioptionsplus_installer.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre